The Overton window
We often encounter change before we know how to talk about it.
A market can be ready for a problem long before it is ready for the language used to describe it.
The Overton window is usually applied to politics: the range of ideas the public considers reasonable at a given moment. Outside that range, an idea can be dismissed as fringe, unnecessary, or too difficult to contemplate. Inside it, the same idea can be debated seriously, funded, and eventually turned into policy.
The concept is useful well beyond politics.
Every category has its own window of acceptable language. It shapes which problems buyers can name in a meeting, which initiatives can survive a budget review, and which claims sound credible coming from a provider.
It also shapes how organizations absorb change.
For risk, security, and resilience teams, that matters enormously. Their work frequently involves asking the organization to prepare for conditions it has not yet experienced, invest in capability before an event creates urgency, or change practices that appear to be working well enough.
The challenge is rarely a lack of expertise. It is that the surrounding organization may not yet have a shared frame for why the change belongs on its agenda.
The language teams are ready to use
A resilience leader may see that a response plan has not kept pace with the business. A security team may understand the implications of a new dependency, a regulatory requirement such as DORA or the EU AI Act, or an AI-enabled workflow. A risk team may be tracking signals that have not yet reached executive consciousness.
They are often working at the edge of the organization’s current Overton window.
The risk is real. The evidence may be sound. But if the proposed action feels disconnected from the priorities people already recognize, it can be categorized as premature, specialist, or discretionary.
That makes communication part of the work.
To move a change forward, teams need to help colleagues understand:
- What has changed in the operating environment
- Why the existing approach no longer provides sufficient confidence
- Which decisions and responsibilities are affected
- What practical action looks like now
A plan, assessment, or exercise becomes more useful when it gives people a shared language for the conditions they may need to navigate.
Change becomes acceptable in stages
Ideas do not usually move from unfamiliar to embedded through a single presentation.
They become part of the organization through repetition, proof, and participation — the same diffusion curve Everett Rogers described for any new practice. A concern starts to feel more immediate when it appears in a customer conversation, a board question, a regulatory update, a near miss, an exercise, or a real disruption elsewhere in the market.
The language becomes familiar. Then useful. Then part of how the business operates.
This is one reason simulations and scenario testing matter, and why frameworks like NIST’s incident response guidance put exercises alongside preparation rather than after it. They allow teams to bring an abstract possibility into a concrete operating context. People can see the dependencies, decisions, tradeoffs, and capabilities involved before an event forces the issue.
That creates a better basis for action than a generic warning ever could.
The window moves when reality becomes harder to dismiss
Ideas do not become acceptable simply because someone argues for them well. They become acceptable when the conditions around them make the previous position harder to hold.
For AI, reported incidents, public dissent from people building the technology, and growing calls to pace frontier development have changed the terms of the conversation. A pause that seemed implausible in 2023 can now be discussed as a question of governance, verification, and collective responsibility.
The same dynamic plays out inside organizations. Risk and resilience teams often see a change before the business has a shared language for it. Then a near miss, a disruption elsewhere in the market, a regulatory signal, or a failed exercise makes the existing approach harder to defend.
That is when the window begins to move.
The changing conditions must be visible early enough for people to understand the implications and respond with intention.
Recognition is not readiness
A shifting window creates permission for a new conversation. It does not create the mechanisms required to respond.
That is where many organizations get stuck. Leaders may agree that a risk has changed, that a dependency deserves closer attention, or that a plan needs to evolve. But agreement does not establish decision rights, clarify ownership, test response capability, or show whether the organization can operate under the conditions it is now preparing for.
For risk and resilience teams, the work has two parts: helping the organization see what is becoming true, then helping it build the capability to act on that recognition.
Visibility. Ownership. Practice. Evidence.
Without those, the window may have moved—but the organization has not.
A better question for leaders of change
Instead of asking only, “How do we get approval?” ask:
Where does this change sit within the organization’s current window of acceptance?
If the issue is well understood, the work may be to make ownership and action clearer.
If it is emerging, the work may be to connect it to business priorities leaders already recognize: customer commitments, continuity of operations, financial exposure, regulatory expectations, or strategic capacity — which is largely how you explain the program to the board.
If it is still unfamiliar, the work begins with visibility. Give people a credible way of seeing the problem, a practical example, and a way to participate in the response.
The goal is not to make every risk feel urgent. It is to help the organization recognize what is becoming true early enough to respond with intention.
That is a core resilience capability: creating the conditions for better decisions before the window closes.