On February 12, 2002, Donald Rumsfeld stood at a Department of Defense press briefing and delivered a sentence that was mocked, parodied, and ultimately recognised as one of the most precise articulations of epistemological risk ever spoken in public:
"There are known knowns — things we know we know. There are known unknowns — things we know we don't know. But there are also unknown unknowns — things we don't know we don't know."
The press laughed. Rumsfeld won a "Foot in Mouth" award from the Plain English Campaign. The concept he described, however, predates him by decades. NASA engineers used the known/unknown matrix during the Apollo programme. The intelligence community had operated with the framework since at least the Cold War. Psychologists had studied metacognitive blindness — the inability to recognise what you don't know — since the 1970s. Rumsfeld didn't invent the idea. He gave it a formulation so clean that it became permanent vocabulary.
The framework creates a 2x2 matrix that maps everything an organisation knows or could know. Known knowns are the facts in your spreadsheet — your revenue, your customer count, your burn rate. Known unknowns are the questions you've identified but can't yet answer — will the competitor launch in Q3? Will the regulation pass? Will the key hire accept the offer? Both categories are manageable. Known knowns require monitoring. Known unknowns require research, scenario planning, and hedging. Standard strategic planning handles both.
The third category breaks the system. Unknown unknowns are the questions you haven't thought to ask — the risks that don't appear on any risk register, the competitive threats that don't show up in any market map, the failure modes that no pre-mortem has surfaced. They are invisible not because they are hidden but because your mental model has no category for them.
COVID-19 was an unknown unknown for most businesses in January 2020. Not "a pandemic" in the abstract — epidemiologists had modelled pandemic scenarios for decades, making pandemics a known unknown for anyone paying attention. The unknown unknown was the specific cascading consequence: that a respiratory virus originating in Wuhan would shut down global commerce for months, shift consumer behaviour permanently toward digital, and destroy businesses optimised for physical presence while creating trillion-dollar opportunities for those positioned for remote everything. No strategic plan contained that scenario. No risk committee had stress-tested it. The businesses that survived weren't the ones that predicted it. They were the ones whose structures could absorb shocks they had never imagined.
The iPhone was an unknown unknown for Nokia in 2006. Nokia held 49.4% of global smartphone market share. Its strategic documents — revealed later in parliamentary testimony — contained no scenario for a touchscreen-only device with no physical keyboard and a software ecosystem that would make the hardware a commodity. Nokia's known unknowns included competitive pricing, carrier relationships, and component costs. The unknown unknown was a category of product that rendered Nokia's entire competitive framework irrelevant.
Nassim Taleb's Black Swan theory is the mathematical formalisation of unknown unknowns with outsized impact. A Black Swan is an unknown unknown that, upon arrival, produces consequences disproportionate to anything the prevailing model could accommodate. The two frameworks overlap but aren't identical. Unknown unknowns describes the epistemological category — things outside your awareness. Black Swans describe a specific subset — the unknown unknowns that carry extreme impact. Every Black Swan is an unknown unknown. Not every unknown unknown is a Black Swan. Your competitor quietly launching a feature you hadn't considered is an unknown unknown. It probably isn't a Black Swan.
There is also a fourth quadrant that Rumsfeld didn't mention but that the Johari Window captures: unknown knowns — things you know but don't realise you know, or things the organisation knows but refuses to acknowledge. These are the institutional blind spots, the tacit assumptions, the risks that engineering has flagged but management has buried. The Challenger disaster in 1986 was an unknown known: Morton Thiokol's engineers knew the O-rings failed in cold temperatures and had documented the risk. Management overruled the engineers. The knowledge existed inside the organisation. The decision-making process excluded it. Unknown knowns are often more dangerous than unknown unknowns because they're fixable — the information exists, but the organisation's structure prevents it from reaching the people who need it.
The defence against unknown unknowns cannot be prediction — you cannot predict what you cannot imagine. The defence is structural. Build optionality so that when the unimaginable arrives, you have room to pivot. Build margin of safety so that the shock doesn't kill you before you understand it. Build antifragility so that certain categories of surprise actually strengthen your position. The founders who survive unknown unknowns share a common trait: they designed their systems to function in worlds they couldn't describe.
Section 2
How to See It
Unknown unknowns reveal themselves only in retrospect — that is their defining feature. But you can detect the conditions that produce them: overconfidence in the completeness of your model, absence of structural redundancy, and organisational cultures that treat the current risk register as exhaustive.
Business
You're seeing Unknown Unknowns when a company's post-mortem reveals that the failure mode was never on the risk register. When Kodak filed for bankruptcy in 2012, the company had spent a decade managing known unknowns — digital camera pricing, consumer adoption curves, competitive positioning against Canon and Sony. The unknown unknown was that cameras would become a feature of phones, not a product category, and that the competitive threat wasn't camera companies but a smartphone ecosystem that Kodak's strategic framework couldn't accommodate.
Technology
You're seeing Unknown Unknowns when an innovation creates a category that incumbents' strategic maps cannot represent. Blockbuster's internal strategy documents in 2005 modelled Netflix as a DVD-by-mail competitor — a known unknown whose market share trajectory could be estimated. The unknown unknown was that Netflix would pivot to streaming, that broadband penetration would make physical media obsolete, and that the competitive dynamic would shift from distribution logistics to content licensing and recommendation algorithms. Blockbuster's model could not accommodate an enemy it could not categorise.
Finance
You're seeing Unknown Unknowns when a risk model's "impossible" scenario materialises. Long-Term Capital Management's Nobel laureate-designed models treated the simultaneous widening of sovereign credit spreads across Russia, Brazil, and emerging markets as a multi-sigma impossibility. The unknown unknown wasn't Russian default per se — LTCM modelled sovereign risk. It was the correlated contagion across markets that the model's independence assumptions structurally excluded. The model couldn't fail at what it was designed to measure. It failed at what it was designed to ignore.
Geopolitics
You're seeing Unknown Unknowns when intelligence agencies describe a catastrophic event as a "failure of imagination." The 9/11 Commission used that phrase to describe why the intelligence community failed to anticipate the September 11 attacks. The agencies had modelled known unknowns — car bombings, embassy attacks, hostage crises. The unknown unknown was the specific operational concept: commercial aircraft as guided missiles, coordinated across multiple targets, exploiting security protocols designed for hijacking-for-ransom scenarios that the attackers had no intention of following.
Section 3
How to Use It
Decision filter
"Before treating any risk assessment as complete, ask: what category of event has been excluded from this analysis by construction? The excluded category is where the unknown unknowns live. If your risk register only contains events you've already imagined, it is missing the events that will actually test you."
As a founder
Build structural resilience against categories of failure you haven't imagined, not just the specific risks you have. This means cash reserves that feel excessive (sized for scenarios beyond your planning horizon), revenue diversification (no single customer or channel representing more than 25% of revenue), and modular architecture (systems that can be reconfigured when the environment changes in ways your roadmap didn't anticipate). The founders who survived COVID weren't the ones who predicted pandemics. They were the ones whose capital structures, team configurations, and product architectures could absorb a 90-day revenue shock without existential consequences.
As an investor
Evaluate portfolio resilience against unnamed scenarios, not just modelled ones. The question isn't "what happens if the market drops 30%?" — that's a known unknown you can stress-test. The question is "what happens if an event I cannot currently describe causes three of my positions to correlate in ways my diversification model doesn't capture?" Position sizing is the primary defence: no single exposure large enough that its total loss — from a cause you haven't imagined — impairs your ability to continue operating. Taleb's barbell strategy is structurally a response to unknown unknowns: the safe tranche survives anything; the speculative tranche benefits from positive surprises.
As a decision-maker
Run pre-mortem exercises that explicitly target the unknown unknown category. Standard pre-mortems ask "imagine we failed — what went wrong?" This generates known unknowns dressed up as post-hoc analysis. The unknown-unknown variant adds a constraint: "imagine we failed for a reason that is not on our current risk register and that no one in this room has mentioned before." The constraint forces the team to populate the blind spot — to generate scenarios the model has structurally excluded. Gary Klein's research shows that pre-mortems increase the identification of potential failure modes by 30%. The unknown-unknown variant pushes that boundary further by directing attention to the categories the standard exercise misses.
Common misapplication: Treating unknown unknowns as an excuse for paralysis. The framework doesn't say "you can't plan because you don't know everything." It says "plan, but design your plans to survive events the planning process cannot anticipate." The distinction is between fatalism (nothing can be known, so why try) and structural humility (much can be known, but the most consequential events will come from outside the known). The response to structural humility is not inaction — it's optionality, redundancy, and margin.
Second misapplication: Retroactively reclassifying known unknowns as unknown unknowns to avoid accountability. After the 2008 financial crisis, bank executives claimed the collapse was an unknown unknown. For the banks using Gaussian copula models to price mortgage-backed securities, the specific mechanism was arguably outside the model. But the category — a correlated housing decline — had been flagged by analysts including Robert Shiller, Nouriel Roubini, and Michael Burry with specificity and evidence. When experts are shouting a warning and management ignores it, the subsequent failure is a governance failure, not an epistemological one.
Section 4
The Mechanism
Section 5
Founders & Leaders in Action
The operators who navigate unknown unknowns don't try to identify them in advance — that's a contradiction in terms. They build organisations with enough structural flexibility that unnamed shocks become survivable and, in the best cases, advantageous.
Amazon Web Services is the most consequential positive unknown unknown in modern business history. AWS wasn't on any strategic roadmap. It didn't emerge from a market analysis. It materialised because Bezos built Amazon's internal infrastructure to be modular, scalable, and service-oriented — solving Amazon's own computing problems — and then discovered in 2003-2004 that external developers wanted access to those same capabilities. By 2006, AWS launched publicly. By 2024, it generated over $90 billion in annual revenue and the majority of Amazon's operating profit.
The unknown unknown wasn't cloud computing as a concept — others were exploring on-demand computing. The unknown unknown was that Amazon's internal infrastructure decisions, made to serve its retail operations, would produce the foundation for the most transformative enterprise technology business of the 21st century. No one at Amazon in 2000 modelled "become the world's dominant cloud provider" as a strategic outcome. The outcome emerged from structural optionality — building systems with enough modularity that unexpected applications could surface.
Bezos's capital structure provided the second layer of unknown-unknown defence. The $672 million convertible bond raise in February 2000 — six weeks before the Nasdaq peaked — gave Amazon runway to survive a 94% stock decline and the death of most e-commerce competitors. The dot-com crash was a negative unknown unknown for companies that had optimised for growth without margin. Amazon's capital buffer converted it into a survivable challenge that eliminated competitors and left Amazon as the dominant e-commerce platform. The margin existed not because Bezos predicted the crash, but because he built capital reserves against events he couldn't name.
Hastings built Netflix to survive unknown unknowns through a systematic programme of strategic optionality. In 2007, Netflix was a DVD-by-mail company generating $1.2 billion in revenue with 7.5 million subscribers. Hastings launched streaming as a supplement to the DVD business — not a replacement. The streaming library was tiny, the technology was immature, and broadband penetration was insufficient for mainstream adoption. The investment looked premature.
The unknown unknowns that followed validated the architecture. The speed of broadband adoption exceeded all projections — by 2012, streaming had overtaken DVD subscriptions. The collapse of physical media distribution was faster than any analyst modelled. The emergence of original content as a competitive necessity — driven by studios pulling licensed content to launch their own services — was a category of threat that Netflix's 2007 strategic plan couldn't have contained. Each unknown unknown required a different response. Netflix could execute each response because Hastings had built a platform with enough structural flexibility to absorb shocks he hadn't imagined.
The Qwikster debacle in 2011 — Hastings's attempt to split DVD and streaming into separate companies — demonstrated that even unknown-unknown-aware operators make mistakes. The customer backlash was an unknown unknown for Hastings's team, who had modelled the split through operational efficiency logic without adequately gaming the emotional response. Hastings reversed the decision within weeks. The company's ability to survive its own strategic error — and continue the streaming transition — was itself a product of the structural margin (subscriber loyalty, cash reserves, content pipeline) that protected against unnamed shocks.
Section 6
Visual Explanation
Section 7
Connected Models
Unknown Unknowns sits at the foundation of risk epistemology — it defines the boundary of what planning can and cannot accomplish, and it determines whether adjacent risk frameworks are built on solid ground or on assumptions that will break at the worst possible moment.
Reinforces
Black Swan
Black Swan theory is the mathematical and empirical case for why unknown unknowns carry disproportionate impact. Unknown Unknowns provides the epistemological category — things outside your model. Black Swan provides the distributional proof — those things, when they arrive, produce extreme rather than moderate consequences because they occur in fat-tailed domains. The reinforcement is bidirectional: understanding unknown unknowns explains why Black Swans are invisible before they arrive; understanding Black Swans explains why unknown unknowns matter more than known unknowns in any long-term survival calculation.
Reinforces
Pre-mortem
The pre-mortem is the most direct operational tool for probing the unknown-unknown boundary. Standard risk assessment asks "what could go wrong?" — and generates known unknowns. The pre-mortem asks "imagine we already failed — what happened?" The shift from prospective risk identification to retrospective failure analysis activates different cognitive pathways and surfaces scenarios the forward-looking approach misses. The pre-mortem cannot fully penetrate the unknown-unknown space — by definition, some scenarios remain beyond imagination — but it pushes the boundary further than any other structured exercise.
Reinforces
Antifragility
Antifragility is the ultimate response to unknown unknowns. If you cannot predict what will surprise you, the strongest position is to build systems that gain from surprise rather than merely surviving it. Taleb's antifragile systems — small businesses that benefit from market volatility, barbell portfolios that profit from extreme events, biological systems that strengthen under stress — don't need to identify unknown unknowns in advance. They are structurally designed to convert unnamed shocks into advantage.
Section 8
One Key Quote
"There are known knowns. There are known unknowns. But there are also unknown unknowns — the ones we don't know we don't know. And it is the latter category that tends to be the difficult ones."
— Donald Rumsfeld, Department of Defense press briefing, February 12, 2002
Section 9
Analyst's Take
Faster Than Normal — Editorial View
The Unknown Unknowns framework is the meta-model — the model that determines whether every other model in your strategic toolkit is honest about its own limitations. A risk register that doesn't explicitly acknowledge an unknown-unknown category is a risk register pretending to be complete. It isn't. The pretence is more dangerous than the absence, because completeness creates confidence, and confidence is what kills you when the unnamed event arrives.
The framework's most practical application is as a design constraint, not an analytical tool. You cannot analyse unknown unknowns — the phrase is a contradiction. You can design systems that survive them. The operational difference is profound. Analysis tries to enumerate risks and assign probabilities. Design assumes the enumeration is incomplete and builds structures that function regardless. Amazon's modular infrastructure design, Netflix's strategic optionality programme, Berkshire's permanent cash reserves — each is a design response to the unknown-unknown problem, not an analytical one.
The biggest error I see in strategic planning: treating the risk register as a boundary rather than a sample. A team that identifies fifteen risks and develops mitigation strategies for each feels thorough. They've built fifteen walls. The unknown unknown walks through the space where there is no wall. The risk register is a sample of the risk space, not a complete map of it. The most dangerous organisations are those that have confused the sample with the map — that believe their fifteen walls protect against all threats because they cannot see the gaps.
The technology industry generates more unknown unknowns per decade than any other domain in economic activity. The most valuable technology company of any era was typically unimaginable from the perspective of the prior era. In 1990, the idea that the world's most valuable company would sell a pocket-sized touchscreen computer was science fiction. In 2000, the idea that the world's most valuable companies would be built on advertising against search queries and renting computing infrastructure was absurd. The unknown unknowns of technology aren't edge cases — they are the main event.
My operational rule: size your margins for events you cannot describe, not events you can. If you can describe the adverse scenario, it's a known unknown, and you can build a specific hedge. The margin that matters is the one protecting you against the scenario you can't articulate — the event that will feel like a category error when it arrives. That margin is cash, optionality, modular architecture, and the organisational capacity to change direction quickly. It is always more expensive than it looks during calm periods and always cheaper than the alternative when the unnamed event arrives.
Section 10
Test Yourself
The scenarios below test whether you can correctly categorise risks within the knowledge matrix — distinguishing genuine unknown unknowns from known unknowns that organisations chose to ignore, and identifying the structural responses that protect against unnamed events.
Is this mental model at work here?
Scenario 1
In January 2007, Nokia's strategic planning team completes an exhaustive competitive analysis covering every handset manufacturer globally. They model market share trajectories for Samsung, Motorola, Sony Ericsson, and LG. Six months later, Apple announces a device that doesn't appear in any competitive category Nokia has defined — a touchscreen computer that makes phone calls.
Scenario 2
A bank's chief risk officer presents quarterly stress tests showing the loan portfolio can withstand a 25% decline in commercial real estate values. Six months later, CRE values decline 35%, and the bank requires a capital injection. The CRO says, 'The decline exceeded our stress scenario — it was an unknown unknown.'
Scenario 3
A SaaS company maintains 18 months of cash runway, distributes revenue across 2,000+ customers with no single customer exceeding 3% of ARR, and builds its platform on a microservices architecture that allows individual components to be swapped without system-wide disruption. The CEO tells the board: 'I can't tell you what will go wrong. I can tell you we'll survive it.'
Section 11
Top Resources
The intellectual architecture of unknown unknowns spans epistemology, cognitive psychology, risk management, and strategic design. The reading path moves from the philosophical foundation (what can we know?) through the psychological mechanisms (why do we think we know more than we do?) to the operational response (how do we build for what we can't imagine?).
The most rigorous treatment of why unknown unknowns carry disproportionate impact. Taleb's three properties of Black Swans — outlier status, extreme impact, retrospective predictability — provide the mathematical framework for understanding why the events outside your model are more consequential than the events inside it. The chapters on the ludic fallacy and narrative fallacy explain the cognitive mechanisms that keep unknown unknowns invisible.
The operational response to unknown unknowns. If you can't predict the shock, build systems that benefit from it. Taleb's distinction between fragile (breaks under stress), robust (withstands stress), and antifragile (gains from stress) provides the design vocabulary for building organisations, portfolios, and careers that don't merely survive unknown unknowns but are strengthened by them.
Klein's research on naturalistic decision-making in high-stakes environments — firefighters, military commanders, intensive care nurses — shows how experienced operators develop intuitive pattern recognition that partially penetrates the unknown-unknown boundary. His pre-mortem methodology, later endorsed by Kahneman as "the single most important piece of advice about decision-making," is the most effective structured exercise for surfacing risks that standard planning processes miss.
Kahneman's synthesis of cognitive bias research explains why unknown unknowns remain invisible despite their documented historical frequency. The chapters on the planning fallacy, overconfidence, and "What You See Is All There Is" (WYSIATI) describe the cognitive architecture that treats the known information as the complete information — the exact mental error that unknown unknowns exploit.
Perrow's analysis of complex system failures — Three Mile Island, aircraft carrier operations, chemical plants — demonstrates that in tightly coupled, complex systems, unknown unknowns are not anomalies but structural features. His concept of "normal accidents" — failures that emerge from the interaction of components in ways no single-component analysis can predict — is the systems-engineering expression of the unknown-unknown problem.
Unknown Unknowns — The four quadrants of awareness, and why the most dangerous category is the one you can't populate until it's too late.
Tension
Margin of Safety
Margin of safety assumes you can estimate the range of adverse outcomes and build a buffer that exceeds that range. Unknown unknowns challenge the assumption: how wide should the buffer be when you cannot name the events it needs to absorb? The tension is productive — it forces practitioners to size margins not by historical stress tests but by structural logic. Buffett's $189 billion cash position at Berkshire isn't calibrated to any specific scenario. It's calibrated to the principle that the most consequential scenario hasn't been imagined yet.
Leads-to
Optionality
If you accept that unknown unknowns will arrive and that you cannot predict their content, the rational structural response is optionality — maintaining the ability to act in ways you haven't yet specified. Cash is optionality (it can be deployed toward any opportunity). Modular architecture is optionality (it can be reconfigured for any requirement). A diversified skill set is optionality (it can be applied to any challenge). The progression from acknowledging unknown unknowns to building optionality is the core strategic arc of the framework.
Leads-to
Fat Tails
The study of unknown unknowns leads directly to fat-tailed distributions because it raises the question: what does the distribution of unnamed events look like? The answer, across domains from finance to technology to geopolitics, is that unnamed events follow power-law distributions where extreme outcomes are rare but not negligibly rare, and where a single extreme outcome can exceed the cumulative impact of all moderate outcomes combined. Understanding unknown unknowns at the category level leads to studying fat tails at the distributional level — and fat-tail awareness is what separates risk management from risk theatre.
The hidden fourth quadrant — unknown knowns — deserves more attention than it gets. These are the things an organisation knows but won't admit: the product deficiency that engineering understands but marketing won't acknowledge, the culture problem that everyone experiences but no one raises, the competitive vulnerability that the data reveals but leadership ignores. Unknown knowns are the most fixable category in the matrix and often the most dangerous, because they combine the certainty of knowledge with the dysfunction of denial. Every post-mortem I've read where someone says "we all kind of knew this was a risk" is describing an unknown known — a risk that lived in the organisation's collective awareness but never made it to the risk register because admitting it would have been politically uncomfortable.
The framework's ultimate value is humility engineering. It forces you to design from the assumption that your model of the world is incomplete — not as a philosophical concession but as an engineering constraint. The bridge engineer doesn't build for the loads in the spreadsheet. She builds for the loads that aren't. The founder who internalises unknown unknowns doesn't plan for the risks on the board deck. They build capital structures, team configurations, and product architectures that function when the board deck turns out to be missing the risk that actually matters. The gap between "we've thought of everything" and "we've built for the thing we haven't thought of" is the gap between fragile and resilient — and it only becomes visible when the unnamed event arrives.
Scenario 4
In 2004, Blockbuster's leadership evaluates Netflix as a DVD-by-mail competitor and concludes that physical stores provide a superior customer experience. Blockbuster launches its own online DVD rental service in response. By 2010, Blockbuster is bankrupt — not because Netflix's DVD service won, but because Netflix pivoted to streaming, a business model that Blockbuster's 2004 competitive analysis did not contemplate.
