In the last few years, some of the UK’s biggest cultural institutions have experienced major threats to their security. A report by the public accounts committee (PAC) has warned that such incidents have exposed serious weaknesses across the sector but that the government has failed to devise a strategy to prevent them. This has left Britain’s cultural institutions open to similar future attacks.

We live in a time when digital systems underpin everything from ticketing to surveillance and building access. Sidelining cybersecurity leaves museums vulnerable to attacks that could threaten both their finances and their collections.

If the UK wants to avoid major attacks and thefts, it needs to learn a lesson from the recent Louvre heist where €88 million (£78 million) of jewels were stolen. An audit conducted just weeks before the incident exposed the Louvre’s spending priorities that left them vulnerable to theft. The report found that €169 million was spent on artwork and exhibitions but only €26.7 million on all forms of maintenance, including security.

The likely thinking of cultural institutions is that to remain financially resilient they have to spend more on money-making attractions, like artwork and exhibitions. However, this means that security sometimes becomes a low priority – less money is spent and less thought given to the importance of keeping it up to date. However, the financial loss from theft affects financial resilience by eroding emergency cash reserves and driving up insurance premiums.

As the Louvre’s audit shows, the museum could have perhaps avoided the theft had it taken its findings more seriously.

The issue of outdated security measures at the Louvre goes back to at least 2017. An audit at the time found that “certain workstations [had] obsolete operating systems (Windows 2000 and Windows XP) which no longer guarantee effective security”. Security updates for Windows 2000 ceased in 2010, and Windows XP in 2014.

Three weeks after the heist in 2025, the Louvre was criticised by France’s Court of Auditors for not taking the audits seriously and spending money on art instead of security in the years before the theft.

Similar weaknesses in investment priorities as the Louvre’s were exposed in a report made by The British Library in March 2024 into their cyber-attack.

In October 2023, The British Library experienced a severe cyber-attack. The library’s systems were infiltrated by hackers who locked out all network users and demanded a ransom of 20 Bitcoin (approximately £590,000). The ransom was not paid and the stolen data was auctioned and then leaked on the dark web.

The library’s report into the attack acknowledged that it happened because it had muddled through with a historical mixture of old systems from many sources, which didn’t have a recovery plan. This meant it took the British Library months to restore the most basic tool – the online catalogue. And even now, five major services, including the catalogue of illuminated manuscripts, remain unavailable.

The cultural institutions, government and even the PAC make the classic mistake of divorcing cybersecurity from physical security.

The report by PAC does mention “bringing together chief digital information officers and chief information security officers” and separately it praises the “National Museum Security Group”. However, there is no mention of encouraging dialogue between the groups.

This divide is very common, and is often built into organisational system. The most junior person responsible for both physical and cybersecurity is often the CEO, or possibly a chief operating officer (COO). This structure worked in the days when physical security did not rely on computers. However, today, when so much physical security relies upon technology, it just does not make sense. There should be someone further down the chain, such as a “chief security manager” or equivalent.

As the report by Apolo Security into the Louvre attack found: “this case highlights another growing challenge: the convergence between operational technology (OT) and information technology (IT). When camera, climate or access control systems are connected to the network, any digital divide can have immediate physical consequences.”

This false split between standard IT cybersecurity (the domain of the chief information security officer), operational technology (the unnoticed computer-enabled devices that keep things working like electronic doors or intruder alarms) and physical security is far from unique to the scope of PAC’s report.

A classic example is the cyber-attack on the Colonial Pipeline in 2021 – an American energy system that connects 29 refineries and serves major airports, military bases and more than 50 million Americans. Only the classic IT systems (billing) were attacked, but management shut down the entire operation as they feared the attack spreading to the operational devices on the pipelines themselves. This stopped all pipeline operations leading to flight alterations, panic buying and over 10,000 petrol stations running dry.

A more integrated approach was exhibited by the train operator Go-Ahead in 2022 in the UK, which had a similar attack on its systems. The company was able, however, to keep the trains running and deal with the source of the attack instead of halting all their operations.

It would be good to think that the UK culture sector would also learn these lessons. But alas, neither the evidence the government gave PAC nor the final report give us any reason to believe that things will become more connected when it comes to a joined-up view of security and stopping future attacks.

James Davenport is a Chartered Fellow of the British Computer Society, and sits on relevant British Standards Institute Committees.

People are overconfident, on the whole. Most of us believe we are more intelligent, more skilful or better drivers than the average person. But we can’t all be right.

Such beliefs are not harmless. Overconfidence – and the self-deception that drives this excessive self-belief – can contribute to extreme risk-taking, failed businesses, disastrous investments, dangerous driving and political miscalculations. Why then have so many of us retained this trait?

According to the late evolutionary biologist Robert Trivers, self-deception evolved in humans because it also helps us deceive others more effectively. He argued that when people genuinely believe in a lie or falsehood, they suppress the subtle cues that betray deception – such as nervousness, hesitation, vocal strain or a forced expression.

But we think something is missing from Trivers’s account. When overconfidence is such a common trait, why should anyone believe your hype simply because you believe it yourself? This is the question our latest research set out to answer.

Our approach was based on the handicap principle developed by Israeli biologists Amotz and Avishag Zahavi. The classic example is the peacock’s tail, which demands enormous metabolic energy to grow and maintain, and makes flying, running and escaping from predators harder.

Only an unusually healthy, capable bird can grow such plumage and survive while dragging it around. Because the tail is so costly, it works as an “honest signal” of these attributes. Our claim is that self-belief is a peacock’s tail for people, signalling attributes that are hard to observe directly.

The signal works because the cost of high self-belief is lower for more capable people. Think of it this way: if a complete novice driver has a self-belief rating of ten out of ten, they are very likely to crash with potentially disastrous results. A near-expert driver with extreme self-belief is, of course, much less likely to crash.

Moreover, the benefit of high self-belief is generally greater for more able people. While self-belief opens doors, ability dictates how far someone goes as a result.

But because self-belief is an effective signal of ability, a confidence “arms race” ensues that culminates in the widespread overconfidence among people that we described earlier. Beliefs become excessive – yet even then, we argue that they remain informative. And that’s why overconfidence is such a common condition.

Reappraising the Dunning-Kruger effect

In an influential 1999 paper, US psychologists David Dunning and Justin Kruger stated that the least competent people tend to be the most confident.

According to their original interpretation, most people who are bad at a task lack the awareness needed to recognise how badly they are doing it. They are “unskilled and unaware of it”.

The original study followed a simple design. Participants completed tests of humour, grammar or logical reasoning. Before receiving feedback, they estimated how well they had performed. Researchers then examined whether the expectations of high scorers were more accurate than those of low scorers – and found they were. Less skilled participants overestimated their performance more egregiously.

However, there is a fundamental flaw in this methodology that even Dunning and Kruger recognised. Test performance depends heavily on random factors like luck. As forecasts cannot take these factors into account, low scorers appear more overconfident to a large degree because they were simply unlucky on the test.

To overcome this statistical illusion, the procedure can be flipped. Instead of sorting people by their test scores, they are grouped by their expectations. Asking whether those with high expectations overestimate by more or less than those with low expectations eliminates the “unlucky” measurement bias.

For our study, we revisited data from one of the largest modern replications of the original Dunning-Kruger experiments, involving several thousand participants. Building on the flipping logic to treat randomness in both test scores and predictions equally, we found that those with high expectations performed better and overall exhibit greater overconfidence – exactly as the signalling theory implies.

Loss aversion – a complicating factor?

The same signalling logic, we think, also illuminates another common human trait: loss aversion. It is sensible to dislike losses, but the evidence shows we dislike them too much.

While loss aversion is easily confused with standard risk aversion, the two are fundamentally different. Risk aversion arises because gaining £300 isn’t twice as joyful as gaining £150, so it is rational to prefer a guaranteed £150 over a 50-50 opportunity to gain £300 or nothing.

The evidence is, though, that many choices cannot be explained by this framework. Instead, it is loss aversion, our excessive aversion to losing, that is now the dominant explanation for our excessive rejection of risks.

Overweighting the downside pulls in the opposite direction to overconfidence: it makes us cautious, wary of risky investments, speculative trades and uncertain ventures.

At first glance, this looks like a problem for the whole story. If loss aversion makes us too cautious to ever act on our confident claims, then surely big talk would cost – and mean – nothing? In which case, why has caution not simply cancelled out overconfidence, leaving us with accurate beliefs and no signal value at all?

We argue there are two reasons it has not. The first is that caution cannot be tuned precisely enough to neutralise overconfidence. Doing so would require a different, finely judged level of loss aversion for every situation we face – entrepreneurship, trading, courtship, competition – and that degree of case-by-case calibration is cognitively far too demanding.

So, on a population-wide level, our estimates of caution offset overconfidence only imperfectly. While this balance varies significantly from person to person, enough average cost survives across the population for the signal to remain credible.

In addition, while confidence must be displayed to be effective, there is obviously no need to brag about your timidity – and no gain to be had from doing so. This means that overconfidence remains a costly, and thus credible, signal for many people.

So, we think former US president Franklin D. Roosevelt had a point when he said of his army general, Douglas MacArthur: “Never underestimate a man who overestimates himself.”

The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.

Foreign veterans fighting in Ukraine face intense combat, serious mental health challenges, and limited access to care, leaving many without adequate support. Drone strikes, trench combat, and constant frontline danger have become defining features of the war in Ukraine. Now, a new UK study suggests that foreign military veterans who volunteered to fight in the [...]