Computational Knightian Uncertainty: Undecidability and the Limits of Cyber Risk Quantification in Software-Intensive Firms

Abstract

Frank Knight’s distinction between measurable risk and unmeasurable uncertainty is central in economics and finance. Contemporary practice often collapses uncertainty into risk by assuming that all material hazards can, in principle, be quantified given sufficient data and computation. This assumption breaks down when the asset in question is large-scale software. This paper argues that undecidability in computability theory, as exemplified by Turing’s halting problem and Rice’s theorem, creates a structural form of uncertainty for software-intensive firms that cannot be reduced to standard probabilistic risk. Many security, safety, and compliance properties of interest to insurers, acquirers, and regulators are non-trivial semantic properties of programs and therefore undecidable in general, even under idealized conditions of perfect code visibility and unlimited classical computation. We call the resulting residual uncertainty computational Knightian uncertainty (CKU): a component of uncertainty that persists even if all observable information is known and arbitrarily robust classical computation is available. We introduce structural opacity the extent to which a codebase resists compression into a small set of regular patterns under a chosen description language [3] and explore approximate Kolmogorov complexity (KC) of codebases as one proxy for this opacity. We develop a conceptual model that links undecidability, structural opacity, and observable outcomes, including cyber incident severity, cyber insurance loss experience, and merger and acquisition (M&A) valuation discounts. In this model, KC and related metrics act as structural covariates that may correlate with CKU, rather than as direct risk measures. Two small synthetic simulations illustrate the empirical logic: first, a crude gzip-based compressibility index sharply separates highly regular from highly irregular synthetic code; second, a KC-like covariate is recoverable in regression when it truly affects incident severity and does not appear systematically when it does not. Our theoretical commitment is modest: computability results guarantee that CKU is non-zero for sufficiently expressive systems. The further claims that CKU is economically material in large, structurally opaque codebases and that structural metrics provide usable proxies are empirical hypotheses to be argued and tested, not consequences of undecidability alone.