Defensive Asymmetry in Project Governance: What a Scenario-Based Analysis of the World's Most Consequential Chokepoint Teaches Business Analysts (BA) and Project Managers (PM) About Protecting Their Interests Against a Superior Force.
Conflict, Strategy & Governance
This analysis uses a current geopolitical escalation scenario as a strategic lens, cross-referenced with historical Hormuz disruption patterns (1973 oil crisis, 1980s Tanker War, 2019 strait incidents), Environmental Impact Assessment supply data, and contemporary risk-transfer models from Lloyd's war-risk insurance markets. The scenario is real; the doctrine extracted from it is universal.
In a scenario-based analysis grounded in historical patterns: on February 28, 2026, the United States and Israel launched coordinated strikes on Iran. Within seventy-two hours, Iran enacted the single most economically consequential defensive manoeuvre in modern history — not through equivalent firepower, but through the precise control of twenty-one miles of water.
|
20%
Global seaborne oil trade through Hormuz daily
|
|
$126
Brent crude peak (USD/bbl) — comparable to the 2022 post-invasion
|
|
70%
Drop in tanker traffic within days of effective closure
|
Five Principles Drawn from the Hormuz Scenario for Senior Practitioners
|
#
|
Executive Takeaway
|
|
01
|
Chokepoints, not scale, determine control in asymmetric environments. The entity that holds the gate decides who passes, regardless of relative size.
|
|
02
|
Most projects carry an unidentified single point of total failure. Locating it before an adversary does is the first act of defensive strategy.
|
|
03
|
Defensive strategy increases the cost of change; it does not obstruct governance. The distinction is critical for executive credibility.
|
|
04
|
Coalition pressure from downstream stakeholders is a stronger lever than internal resistance. Make the cost visible to those who depend on the node.
|
|
05
|
Operational friction — insurance, delay, uncertainty — is force multiplication for the defender. You do not need to win the engagement; you need to make it too expensive to sustain.
|
Brent crude surpassed $100 per barrel for the first time in four years, reaching $126 at its peak, a trajectory consistent with the 2022 post-invasion shock and the 1973 oil embargo. Tanker traffic collapsed by approximately 70 percent, with over 150 vessels anchoring offshore rather than risk transit. War-risk insurance premiums quintupled. The largest energy disruption since the 1970s was not produced by a superpower's arsenal. It was produced by a defender's geometry.
The operative question — for scholars of Offense-Defense Theory and, critically, for business practitioners — is this: how does a structurally inferior defender impose costs on a structurally superior attacker that exceed any conceivable gain from the offensive? The Strait of Hormuz provides one of history's cleanest answers. If one node fails, the entire system stops.
I. The Anatomy of a Chokepoint
What Happened
Strip away the geopolitics. The Strait of Hormuz is not, fundamentally, a geographic feature. It is a dependency bottleneck: a single node through which an asymmetric proportion of a system's total value must flow. The passage is 21 miles wide at its narrowest, channelling two unidirectional shipping lanes each just two miles across. Through this corridor transit roughly 20 million barrels of oil per day, the thermal energy that heats homes in South Korea, manufactures petrochemicals in Germany, and sustains the productive capacity of nearly every advanced economy on earth.
Why It Worked
The critical insight is not the volume; it is the irreplaceability. Saudi Arabia, the United Arab Emirates (UAE), Iraq, Kuwait, and Qatar all export through this single egress point. Oman's alternative deep-water ports at Duqm, Salalah, and Sohar were identified as theoretical bypasses and were struck within the first week of conflict. The defender had pre-identified the redundancy infrastructure and neutralised it in advance. This is not improvisation. It is deliberate chokepoint architecture.
What It Means for Projects
Every enterprise system, project dependency map, or supply chain has an equivalent of the strait: a node whose disruption halts everything downstream. Most organisations have never explicitly identified it. Those that have are structurally advantaged in any negotiation, consolidation, or mandate scenario.
|
IN PRACTICE
Audit your project's dependency register and ask: which single vendor, approval gate, legacy system, or dataset — if removed this week — would halt all value delivery? That node is your Hormuz. Mark it. Protect it. Never allow it to exist without a pre-tested continuity protocol.
|
"The defender does not need to stop the offensive force. The defender only needs to make the cost of passage untenable for everyone downstream — including the attacker's own allies."
II. Identifying Your Logistical Jugular
The Three-Property Test
The Iran/Hormuz model instructs analysts to search for three properties simultaneously when mapping defensive architecture. The table below applies each property to both the geopolitical scenario and direct project equivalents, including a payroll system dependency, Enterprise Resource Planning (ERP) migration, and vendor lock-in scenario.
Analyst Framework The Three-Property Chokepoint Test: Geopolitical vs. Project Application
|
Property
|
Geopolitical
|
Project / Organisational
|
|
Non-Substitutability
|
No viable pipeline bypasses the Gulf within an operationally relevant timeline.
|
A single ERP system is the only source of record for compliance reporting. No alternative exists within the project window.
|
|
Leverage Asymmetry
|
Iran's cost of controlling the strait is far lower than the global cost of being denied access.
|
A niche data team's cost of maintaining their process is trivial compared to the cost of rebuilding institutional knowledge after forced migration.
|
|
Cascade Amplification
|
Closure simultaneously impacted Gulf states, Asian importers, and European energy markets, forcing the attacker to manage a fractured coalition.
|
Disruption to the payroll system dependency affects Finance, HR, Legal, and every line manager simultaneously, creating multi-front executive pressure.
|
|
IN PRACTICE
Run the three-property test on your current project's top five dependencies. Any dependency that meets all three criteria is a strategic chokepoint. Any chokepoint without a governance-approved continuity plan is an unmanaged existential risk.
|
III. Strategic Asymmetry: The Economics of Friction
What Happened
Iran's strategic posture embodies what Thomas Schelling termed the "threat that leaves something to chance." The Islamic Revolutionary Guard Corps did not sink the global oil fleet. It destroyed selective targets, struck redundancy infrastructure, and elevated the cost of insurance until commercial actors removed themselves from the equation. War-risk premiums jumped from 0.125% to 0.4% of ship insurance value, an increase of a quarter million dollars per transit for a Very Large Crude Carrier. No carrier, operating on thin-margin arbitrage, could absorb that cost. The market self-blockaded.
The attacker did not lose the engagement. The attacker lost the economics.
Why It Worked
This is the central lesson of operational friction as a strategic instrument. A defender need not deploy kinetic force at the scale of the attacker. The defender need only elevate the transaction cost of the offensive action — in insurance, in delay, in uncertainty, in the political cost of managing fractured third-party stakeholders — until rational actors conclude the campaign's cost exceeds its projected value.
What It Means for Projects
A department facing a hostile consolidation mandate, a project team threatened by a top-down technology replacement, or a niche firm facing an aggressive acquirer does not need budget parity with the aggressor. It needs to identify the chokepoints through which the aggressor must pass to extract value, then clearly articulate the transition risks at those nodes — data integrity exposure, compliance gaps, client attrition, service continuity failures — with sufficient precision that the cost of proceeding becomes visible to senior stakeholders.
|
IN PRACTICE
When facing a forced ERP migration, do not resist the mandate directly. Instead, document with precision: the three compliance reporting dependencies that have no equivalent in the proposed system; the two client SLA obligations that would be breached during transition; and the estimated cost of remediation. Present this as risk disclosure, not resistance. The goal is to make the transition's true cost visible, not to block governance.
Governance Note: These strategies must operate within ethical, regulatory, and organisational governance boundaries. Defensive positioning is most durable when it is grounded in transparent risk articulation, not obstruction.
|
IV. Fortification Strategies for Project Managers
Path Dependency as Defensive Architecture
Iran's geographic control of the strait is a structural outcome of path dependency baked into seventy years of global energy infrastructure investment. The world built around the assumption of Hormuz transit. Your project can engineer equivalent resilience through deliberate institutional design. The PM who builds proprietary integration schemas, documented institutional knowledge, and workflow dependencies calibrated to their team's operational logic is creating path dependency that a hostile consolidation mandate cannot easily unwind.
|
IN PRACTICE
A data governance team facing absorption into a central enterprise function should spend the 90 days before any transition announcement documenting every business process that depends on their current tooling, taxonomy, and institutional knowledge — in terms of business value, not technical detail. This is not obstruction; it is risk disclosure that protects the organisation from a transition it may not be ready to execute.
|
Redundant Capacity and Continuity Architecture
Iran neutralised Oman's bypass ports before the main blockade. A sophisticated defender pre-identifies the redundancy options available to the attacker and ensures either that those options are not viable, or that the defender's own redundant capabilities render substitution unnecessary. For a project manager, this means establishing that your team already maintains continuity protocols, cross-training, and documented handover procedures, so that any argument for external substitution is met with evidence that the risk has already been internally mitigated.
Transition Risk Articulation as Negotiating Posture
A project team that can clearly articulate the transition risks of forced change — data integrity exposure, regulatory compliance gaps, client service interruption, institutional knowledge loss — is not holding a threat. It is exercising its governance obligation to ensure informed decision-making at the executive level. The strength of this posture comes from its credibility. Vague resistance is dismissed. Quantified, documented transition risk is a governance artefact that senior leaders must engage with before proceeding.
|
IN PRACTICE
In a vendor lock-in scenario: do not claim the current vendor cannot be replaced. Instead, present a transition cost model covering estimated migration effort (in hours), data re-validation requirements, parallel-run period, regulatory re-certification timeline, and client notification obligations. When the true cost is visible, decision-makers can make an informed choice. That is not obstruction; that is governance.
|
Multi-Front Coalition Building
Iran's most effective move was not military — it was economic contagion. By disrupting flows that affected Gulf states, Asian economies, and European energy markets simultaneously, it forced the attacker to manage allies whose interests diverged from the offensive campaign's objectives. Germany declared the conflict outside the scope of the North Atlantic Treaty Organization (NATO). China and NATO declined to commit naval support. The defender had successfully imposed costs on third parties who then applied pressure to the aggressor's coalition.
For a project manager, the equivalent is identifying which clients, regulators, partner teams, or executive sponsors are materially disadvantaged by the proposed offensive action. The goal is not to organise opposition; it is to ensure that all affected parties have accurate information about the transition's cost to their operations, so that executive decision-making reflects the full impact, not only the proposing team's cost model.
"The attacker's superiority in resources is irrelevant at a bottleneck. At a bottleneck, only control matters — and control belongs to whoever holds the gate, not whoever fields the largest army beyond it."
V. The Paradox Resolved
The Hormuz Paradox is this: the world's dominant military power, executing a precision offensive against a significantly outmatched adversary, finds itself unable to extract the primary value of its campaign — regional stabilisation, energy normalisation, deterrence credibility — because the defender controls a 21-mile passage that cannot be economically bypassed on any operationally relevant timeline. Superiority at the theatre level is negated by inferiority at the chokepoint level.
Resolved to its strategic essence, the paradox yields a universal principle applicable in boardrooms, project governance forums, and mergers and acquisitions integration war rooms equally: scale wins campaigns; chokepoints win wars. The attacker who fails to identify and secure the defender's logistical jugular before initiating the offensive is not executing a strategy — it is executing an assumption. And assumptions, as the anchored tanker fleet outside the Strait of Hormuz demonstrates, are extraordinarily expensive.
For the BA and the PM, the mandate is clear. Map your dependencies at chokepoint resolution. Fortify through path dependency, friction economics, and transparent risk disclosure. And when the superpower advances — as superpowers invariably do — ensure the true cost of passage is fully visible to every stakeholder who must ultimately bear it.
The strait does not need to be impenetrable. It only needs to be costly enough that rational actors choose to anchor, recalculate, and negotiate.
|
30-Second Project Diagnostic
Complete before any defensive or risk-mitigation strategy session
|
|
What single dependency, if removed, would halt your project entirely?
|
Your answer:
|
|
How quickly could that dependency be replaced? (Hours / Days / Weeks / Never)
|
Your answer:
|
|
How many downstream stakeholders are impacted if it fails?
|
Your answer:
|
|
Have you quantified the cost of that failure in business terms?
|
Yes / No / Partially
|
|
Does the proposed change increase or decrease your control of this node?
|
Your answer:
|
Author: Olam Osah
Olam Osah is a seasoned Project Manager and strategic leader with a strong foundation in business analysis and information systems. He holds a PhD in Information Systems from the University of Cape Town, along with Honours and Masters degrees from the University of the Witwatersrand, Johannesburg. Olam specializes in leading complex projects that bridge technology and business, delivering impactful solutions across public and private sectors. Known for his ability to turn vision into actionable plans, he combines academic depth with real-world execution to drive results. Connect with him at [email protected].