For organisations whose security programme needs rebuilding, not another layer
Transformation leadership for a security function that has to change, not just grow
Security transformation usually gets started by something painful: a breach, a failed audit, an acquisition that doubled the estate, a new regulator, or a board that finally asked the question nobody could answer. The temptation is to respond with a programme of a hundred initiatives. I've led this kind of change, and the organisations that got through it did fewer things in the right order and kept the existing operation running while they did.
How I'd lead the change
First, know what you have. Not a maturity score; an honest picture of what's detected, what's responded to, what's owned, and what's assumed. Most transformations fail because they're built on the programme as described rather than the programme as it is.
Second, fix the things that make everything else possible. Identity, asset visibility, telemetry, and decision rights. Nothing built on top of these works if they're broken, and they're usually broken.
Third, change the operating model, then the tools. Who owns each capability, how work flows, what gets measured, what the business can expect. Tools bought before this is settled get configured to the old model and have to be redone.
Fourth, the team. Transformation changes jobs. People need to know what theirs becomes, who's staying, and what good looks like now. Done badly this is where the knowledge leaves.
Throughout: keep the lights on. The incident that happens during the transformation is the one that decides whether the transformation survives. The response capability gets protected from the change, not sacrificed to it.
What you get
A security function with a clear operating model, a smaller and better-understood tooling estate, measures that mean something, governance the board can use, and a team that knows how it works. And an honest account along the way of what's been accepted rather than fixed, so the end state is a decision rather than a surprise.
The honest fit
This is senior, time-limited, and hard. It works where leadership has decided change is necessary and will fund and back it. It doesn't work as a title given to someone expected to run the existing function and transform it in their spare time, and it doesn't work where every change needs a committee's blessing.
Where this comes from
Thirty years of leading security, with transformations led through incidents, acquisitions, and regulatory change in organisations from startups to governments. Most of the detail is under NDA. What I can say here, I do.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
- Research How Do You Set a Sustainable Workload for a Security Team?
- Research Your Cybersecurity Gap Assessment Is Finished. Now What?
- Research How Do You Know Whether Your SOC Is Actually Effective?
- Short What should a new CISO deliver in the first 90 days?
- Short Is our cybersecurity budget enough? How to tell without a benchmark
Related work.
Other ways I'm engaged on the same problems.
- A programme director who turns the strategy into things that happenOwnership of the security programme end to end: plan, money, people, dependencies, and honest reporting on what's actually done.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- CEOs, CIOs, and boards who've decided the security function has to change and want it led by someone who's done it.
- Private equity operators rebuilding security across a portfolio company after acquisition.
- CISOs who want a transformation lead so they can keep running the function.