Security Transformation Leadership

The series, originally published on the Corix Partners blog between November 2017 and March 2018, followed the journey of the new CISO…

For many firms, it is a cultural transformation that is required, not just the implementation of some new tools.

Businesses need to break out of the tactical mindsets that have dominated the past few years while their damage can still be reversed

CISOs must avoid the repeat of some historical situations where cybersecurity might have been seen at odds with business needs

It is time to challenge a number of outdated matters framing cybersecurity governance

Without a sense of context, the CISO cannot be expected to communicate meaningfully towards the Board

Implying that cyber resilience is some new elevated concept encompassing preventative, mitigative and reactive measures is somewhat…

Where trust is present between CISOs and top executives, justifying investments is rarely a problem.

It should be central to the role of the CISO to build a vision and a product strategy, and drive the decluttering of cybersecurity…

Hype and FOMO around generative AI are hijacking crucial discussions around cybersecurity in many firms

The Board needs to take an elevated view on cybersecurity, looking for cross-functional governance matters beyond the mere technical…

There is something of a governance malpractice in bringing in a new expert for every problem the Board may encounter

Many small firms would often benefit from looking internally first, before jumping to externalised cybersecurity solutions

Cyber resilience needs clear accountability from the top

You cannot expect the CISO on their own, bottom-up, to reverse widespread business dynamics, where short-termism prevails everywhere across…