For boards, CEOs, and executive search
Hire a CISO who's run the response, not just reported on it
If you're hiring a CISO, you've probably read forty résumés that all say "strategic leader" and "risk-based approach." Here's what mine says underneath that. I've spent thirty years leading security and about twenty of them with my hands on live incidents and the operations that catch them. I've built security operations from nothing and rebuilt ones that looked busy and weren't. I've sat in front of boards during a breach and after one. And I've done the academic work, through a PhD in computer engineering centred on cybersecurity, AI, and the criminal use of technology, so the judgement comes with the theory attached.
What I'd actually do in the role
The job isn't to make the organisation feel secure. It's to find out where it stands, decide what to carry and what to fix, and build an operation that can prove it works. In practice, that means three things I'd start on in the first quarter: an honest assessment that includes what the last leader didn't say; the three risks that would actually hurt, in business terms, with a plan sized to what you'll fund; and an incident process with named decision-makers that's been tested at least once on paper. I've written down what a new CISO should deliver in 90 days, and I'd hold myself to it.
Beyond the first quarter: a security operation measured on detection and containment rather than alert counts, a board relationship built on decisions rather than dashboards, and a team that can run the place when I'm not in the room. I don't buy tools before I understand the problem, and I don't reorganise a team before I understand it.
Where I fit, and where I don't
I fit organisations where security is close to the licence to operate or the product: regulated industries, critical infrastructure, anything with serious data or serious adversaries. I fit boards that want an uncomfortable truth over a comfortable slide. I fit CEOs who'll give the role authority to stop work and a budget that can't be quietly reallocated, because without those the title is decorative.
I don't fit a role that reports through someone measured on shipping features with no path to the board. I don't fit an organisation that wants a compliance function with a C-title. And I'm not the person who'll tell you it's all fine.
Where this comes from
Much of my work can't be described in public, and some of it can't be shared at all. What I can say: I've served as the subject-matter expert for blue-chip companies, startups, high-net-worth individuals, NGOs, and US and allied governments from the municipal level to the national. I've been through the ones that made the news and the ones that didn't. The rest we talk about in confidence.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
- Research How Can a Board Verify That Cyber Risk Is Improving?
- Research Your Board Needs a Decision, Not Another Security Dashboard
- Research How Do You Know Whether Your SOC Is Actually Effective?
- Short What should a new CISO deliver in the first 90 days?
- Short Should the CISO report to the CIO or the CEO?
Related work.
Other ways I'm engaged on the same problems.
- A fractional CISO who sets the rules and takes the hard callsSenior security leadership on a part-time basis: direction, the hard decisions, the board, and the questionnaires, with a capable person of yours running the day to day.
- An interim CISO who holds the line while you hire wellFull accountability for security for a defined period, so the search can take the time a good hire needs.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- Boards and CEOs who want a security leader who's been inside the breach, not just briefed on it.
- Executive search firms with a CISO mandate where the client needs operational depth as well as presence.
- Organisations between leaders who want to talk about interim or fractional cover while they search.