In 2001, I was at Bank of America leading enterprise business continuity and security for Global Commercial and Investment Banking, Asset Management, and Global Treasury. In July of that year, Code Red hit our networks hard.

The understandable executive response was to classify it as a “once in a lifetime” event. If Code Red was an aberration, then the disruption was serious but did not necessarily require a fundamental change in investment, operating assumptions, or executive priorities.

I did not believe it was an aberration.

I went back to 1988 and modeled the time between major disruptive security events. The interval had been contracting—from roughly 18 months to a matter of a few weeks. The important signal was not simply the severity of Code Red. It was the changing arrival rate of “we haven’t seen this before” security events.
In 2002, when I presented the model and the executives asked whether it would happen again, my answer was unequivocal: yes. I went on record saying that within roughly six months, I believed we would see another major event, probably involving SQL.

Not long after that executive meeting, SQL Slammer happened.

This was not clairvoyance, and Slammer was not a “black swan” in any useful decision-making sense. The trend was already visible. The environment had changed, but the executive model had not.

That experience exposed a problem we still have today: cybersecurity teams can produce technically sound risk analysis that never influences the decision because the result does not appear on the instruments executives use to steer the enterprise.

The risk is not necessarily off the chart.

It is off the executive scorecard, at least in the language that the security team is using.

Technical correctness is necessary—and insufficient

Cybersecurity teams are trained to improve the accuracy of the analysis. We produce better telemetry, more complete risk registers, more precise control assessments and increasingly sophisticated loss estimates.

All of that matters. None of it guarantees movement.

Executives are solving a different problem. They must allocate scarce capital, attention, operating capacity and personal accountability across competing priorities to move the company forward. A security finding may be technically correct and still fail because it has not been converted into the executive lexicon and decision-making framework.

Consider the difference:

A critical vulnerability exists in the payment platform.

That is a valid security finding.

The vulnerability creates a material exposure to checkout availability and cardholder data during the third-quarter revenue cycle. We have three treatment options. Option B reduces the modeled loss exposure within 60 days, fits the existing capital envelope and leaves a defined residual risk with the product owner.

That is a decision product.
The first statement belongs in a security artifact. The second can sit against an executive commitment, but it frames the issue in a way many security pros struggle to do.
Framing risk management in terms of business decisions is consistent with the intent of NIST Cybersecurity Framework 2.0. The framework places GOVERN at the center and calls for cybersecurity priorities to be established in the context of mission, stakeholder expectations and enterprise risk management. It also emphasizes a common language for communicating cyber risks, needs and expectations across the organization.

The translation from finding to enterprise outcome is not cosmetic communication. It is governance.

The scorecard tells you what the organization is prepared to manage

Executives do not operate the company from the cyber-risk register. They operate it through a limited set of commitments: revenue, margin, service availability, regulatory standing, customer retention, strategic delivery and capital allocation.
Security, meanwhile, often measures activity:

• vulnerabilities found and closed;

• patch-service-level compliance;

• control coverage;

• phishing-test performance;

• mean time to detect and respond;

• audit findings by severity.

These measures may be useful for managing the security program. They do not automatically show how the enterprise is more likely to achieve—or fail to achieve—an outcome its leaders already own.

When no one is accountable for connecting the two, cyber results remain orthogonal to the scorecard. Security wonders why a red finding produced no budget. Finance wonders why security keeps presenting issues that do not move a number for which an executive is accountable.

That is why the test I now use is simple:

Which executive scorecard line does this recommendation protect or change, who owns that line, and on what time horizon?

If the CISO cannot answer, the work is not finished and the finding isn’t ready for reporting.

Sometimes the analysis reveals that the scorecard itself is deficient. If a critical dependency, material cyber loss scenario or regulatory exposure has no accountable enterprise owner, that is not a reason to force an artificial financial mapping. It is evidence of a governance gap that should be made explicit. I have found that executive accountability for the security of everything contributing to their P&L is an excellent incentive to work closely with the security team.

The security risk register is not the enterprise-risk view

There is another reason sound analysis fails to influence decisions: sheer volume.
Many cybersecurity risk registers contain hundreds—or thousands—of vulnerabilities, control deficiencies, exceptions, audit findings and remediation items. Each may be valid. Collectively, they can become unmanageable.

When everything is recorded as a risk, the register becomes an inventory rather than a decision instrument.

The problem is compounded by organizational silos. Identity risk, third-party risk, cloud concentration, operational resilience, data governance and AI risk may be assessed separately, assigned to different owners and reported through different committees. Yet the same mission-critical service may depend on all of them.
Executives therefore see the pieces without seeing the enterprise exposure.
Ten individually tolerable risks may combine into an intolerable scenario when they share a business service, technology dependency, third party, privileged-access pathway, data set, control failure or recovery constraint.

This does not mean unlike risks should simply be added together or averaged into another heat-map score. That would create false precision. It means detailed risks must be organized around enterprise objectives, material business services and plausible loss scenarios so that dependencies, concentrations and cascading effects become visible.

The executive question is not:

How many high risks are in the register?

It is:

Which combinations of conditions could prevent us from achieving a material business objective, how much aggregate exposure do they create, and what decision would meaningfully reduce it?

A useful hierarchy distinguishes among:

• Risk details: findings, vulnerabilities, exceptions and control deficiencies;

• Cyber-risk scenarios: credible event-and-impact pathways;

• Composite enterprise exposures: scenarios that converge on the same objective, service or dependency; and

• Executive decisions: the limited number of investments, ownership assignments or risk acceptances requiring governance action.

NIST IR 8286C Revision 1 describes this staging process: integrating information from cybersecurity risk registers into an enterprise risk register and enterprise risk profile so that cyber risks can be considered within the broader risk portfolio. The objective is not to move every cyber entry upward. It is to develop a cohesive understanding that supports enterprise objectives, prioritization and governance oversight.
The risk register should preserve detail. The executive risk profile should reveal concentration, interaction and consequence.

Aggregation is not merely summarization. It is analysis of how multiple risk conditions combine around an enterprise outcome. I’ve written about this approach in A New Way to Think about Cyber Risk Management.

This is Outcome-Based Security

I have written about creating the bridge between technical security and business objectives before. In “The Essential Step Everyone Seems to Skip”, I described a risk profile as the decision-shaping construct between business objectives and security execution. From that foundation, I defined Outcome-Based Security through a governing question:

For the business to achieve its objectives, given the stated risk profile, what would have to be true from a security and control perspective?

The scorecard and aggregation problem is the operational continuation of that framework.
Outcome-Based Security begins with the business objective and works backward. It identifies the mission-critical functions and the constellation of assets, processes, people, third parties and controls on which the outcome depends. It then asks which combinations of risk could prevent the required conditions from remaining true.
That changes the reporting sequence:

Business objective → Required security outcomes → Composite exposure → Prioritized decision → Controls and monitoring

Traditional security reporting often travels in the opposite direction. It starts with findings, groups them by technical domain and hopes that executives can infer the business consequence. Outcome-Based Security performs the aggregation and translation before the information reaches the executive scorecard.

The role of the security team is not simply to report everything it knows. It is to convert detailed evidence into a prioritized view of the conditions that matter to the business—without hiding the underlying uncertainty, dependencies or residual risk.

We were wrestling with this decades ago

At SRI International in the late 1990s, we surfaced this as the Net Present Value of Security problem.

The purpose was not to pretend that every security outcome could be known with financial precision. It was to force the investment into the language of capital allocation: spend now, compare the present value of expected benefits or avoided losses with the cost, and evaluate the result against competing uses of capital.
The limitations were apparent even then.

Security costs are visible, immediate and certain. Many benefits are delayed and counterfactual: the outage that did not happen, the regulatory action that did not occur, the customer trust that was not lost. Timing and uncertainty naturally make these investments difficult to compare with projects that put new revenue directly into a forecast.

This problem did not disappear when quantitative cyber-risk methods improved.
The FAIR Standard is valuable because it decomposes risk into estimable factors such as loss-event frequency and loss magnitude. Instead of stopping at “high risk,” practitioners can produce a range or distribution of potential loss.

But FAIR does not convert uncertain estimates into facts. Nor does a quantified loss distribution automatically become an executive priority.

A probable loss range is still off-scorecard until it is connected to an owned business process, an accountable decision, a treatment option and an explicitly accepted residual risk.

Quantification is a translation method. It is not a substitute for governance.

Code Red, Slammer and the danger of the “once in a lifetime” story

The Code Red experience illustrates how executive framing determines whether evidence becomes action.

Carnegie Mellon’s CERT records document the Code Red advisories in 2001. In January 2003, SQL Slammer exploited Microsoft SQL Server and MSDE 2000. CAIDA’s analysis found that Slammer doubled in size every 8.5 seconds and infected more than 90 percent of vulnerable hosts within ten minutes—nearly two orders of magnitude faster than Code Red.

The important point is not that I named the exact next worm. I did not.
I predicted frequency and identified a likely class of exposure. The model challenged the assumption that each disruptive event was an independent exception drawn from an unchanged environment.

The arrival rate had changed.

Calling Code Red a once-in-a-lifetime event would have protected the existing scorecard. A unique event requires sympathy and recovery. A contracting mean time between disruptive events requires an operating-model and investment decision.
This remains a useful discipline for cyber-risk leaders:

1. Maintain a timeline of material events, not merely a count of tickets or findings.

2. Watch changes in inter-arrival time, not only the severity of the most recent event.

3. Revisit frequency assumptions when the operating environment changes.

4. Map the forecast to a business service, process owner and decision horizon.

5. Refuse language that converts an observable trend into an act of God.

AI will make the risk register less manageable—and may help make risk manageable

AI intensifies both sides of this problem.

The explosion of enterprise AI increases the number of models, agents, data flows, external services, generated artifacts, delegated permissions and machine-to-machine decisions that must be understood. These systems are not static. Their behavior may change as models, prompts, tools, data, policies and surrounding workflows change.

The scope of risk management can therefore expand faster than unaided human teams can recognize the relationships among risks, much less aggregate them into an enterprise view.

Agentic systems increase the challenge because they can act across system boundaries and pursue multi-step objectives with limited human intervention. NIST’s AI Agent Standards Initiative reflects the need for common approaches to agent security, identity, interoperability and accountability.

Recursive self-improvement would accelerate this problem further. It is important to be precise: full recursive self-improvement has not been achieved and is not inevitable. But AI is already performing a growing portion of AI engineering and research. Anthropic describes a plausible future in which systems participate in building their successors, compressing the time available for human review, governance and institutional learning.

Even without that future capability, enterprise AI can already generate new code, configurations, workflows and risk findings faster than conventional governance processes can evaluate them. If every AI-related observation becomes another isolated register entry, organizations will simply automate the production of unmanageable risk inventories.

But the same class of technology can help address the problem—if the risk-management system is designed around institutional memory and the as-built enterprise rather than a generic model of what the enterprise should look like.
I think of this as a memory fabric: a governed, persistent and continuously updated body of organizational knowledge that retains:

• business objectives and accountable owners;

• system architectures and actual dependencies;

• models, agents, tools, data sources and permissions;

• configuration and change history;

• control evidence and known exceptions;

• incidents, near misses and loss experience;

• prior risk decisions, assumptions and accepted residual risk; and

• legal, regulatory and contractual obligations.

The distinction between the as-designed and the as-built system is critical. Policies, architecture diagrams and control frameworks describe intent. Runtime behavior, integrations, exceptions, accumulated technical debt and undocumented workarounds describe the system whose risk must actually be governed.
An AI-enabled risk-management capability grounded in that memory fabric could associate apparently disparate risk factors because it retains context across domains and over time. It could recognize that an identity exception, a third-party dependency, an AI agent’s delegated authority and a recovery limitation all converge on the same revenue-producing service. It could then stage those details into a composite exposure and relate that exposure to an owned business outcome.
This is a more consequential use of AI than generating another polished risk statement. It uses AI to support Outcome-Based Security:

Detailed evidence → As-built system context → Associated risk conditions → Composite exposure → Prioritized business outcome

The safeguards are non-negotiable. Institutional memory can also preserve errors, stale assumptions, poisoned data and undocumented bias. The memory fabric therefore requires provenance, access control, versioning, validation, retention rules and explicit human accountability. The system must show why it associated the risks, which evidence it used, what remains uncertain and who is authorized to accept the resulting exposure.

The NIST AI Risk Management Framework emphasizes incorporating trustworthiness into the design, use and evaluation of AI systems. That principle applies equally when AI is used to govern other risks.

AI should not be the final accountable voice. A human leader must still validate the organizational facts, challenge the composite view, stand behind the recommendation and own the decision.

Explainability of an AI output is not the same as defensibility of the enterprise decision. But an AI capability grounded in reliable institutional memory may help the enterprise see risk relationships that no individual function can hold in view.

Treat risk advice as a decision product

Sound advice is unfinished until it can move through the organization’s decision machinery.

Before bringing a material recommendation forward, the CISO should be able to answer:

1. What decision is required? Not “What problem did we find?”

2. Which enterprise outcome is exposed? Name the service, commitment or scorecard line.

3. Who owns the consequence? Security may identify the risk without owning the business outcome.

4. What are the viable options? Include cost, timing, trade-offs and residual risk.

5. What other risks converge on the same outcome or dependency? Determine whether the issue is isolated or one component of a composite exposure.

6. What uncertainty remains? Ranges and assumptions are more credible than false precision.

7. What changes if we wait? Show the 30-, 90- or 180-day consequence of delay.

8. How will the decision be recorded? Accept, mitigate, transfer or avoid—with accountable ownership.

Technical correctness earns a place in the conversation. Organizational trust determines whether the advice is heard. Executive legibility allows the enterprise to act.

AI does not dissolve that chain. It accelerates whatever decision system already exists.
Organizations can now generate risk advice faster than they can build the trust, ownership and executive language required to use it. The firms that pull ahead will not necessarily have the most elaborate scoring engine or the most polished AI-generated report.

They will have security leaders who can make a hard truth legible to the people who must live with the choice.

What’s your experience? I’d love to hear from you.

Executive Summary

For thirty years, my professional mantra has been demonstrating due diligence to a defensible standard of care. This principle has guided security leaders through every regulatory cycle, every technology shift, and every board-level conversation about risk. It has always meant two things: comply with the laws on the books, and show your homework by maintaining a control environment with controls that are appropriate to the specific business context and operationally effective.

That principle has never been more important—or more challenged—than it is today. In February 2026, we find ourselves at a unique inflection point. The regulatory landscape for artificial intelligence is in flux. A patchwork of state-level AI legislation threatens to create an unworkable compliance environment for enterprises operating across jurisdictions. The federal government is working to establish a unified national framework, though comprehensive federal AI legislation that balances innovation with safety has yet to materialize. The EU AI Act faces its own implementation challenges. And enterprises are deploying agentic AI systems that fundamentally change the nature of the governance problem.

This paper argues that the cybersecurity community must reconceive its approach to AI governance. The Zero Trust model—the dominant security paradigm of the past decade—is necessary but insufficient for governing agentic AI systems. These systems do not primarily present an access problem. They present a process integrity and knowledge integrity problem. The right governance model draws from established principles of internal controls, business process assurance, and software integrity—extended to account for autonomous execution and institutional knowledge creation.

For security practitioners navigating an uncertain regulatory environment, the most durable strategy remains the same as it has always been: build a control environment that is defensible regardless of which specific regulatory framework prevails. This paper provides both the intellectual framework and a proven implementation methodology—the Risk2ResiliencePath℠—for getting there.

1. The Regulatory Landscape in 2026: Fragmentation as the Defining Feature

The single most important thing for business leaders to understand about AI governance in 2026 is that there is no coherent regulatory framework. What exists is a set of competing, sometimes contradictory initiatives, shaped more by geopolitical competition than by principled policy development.

1.1 The Federal-State Collision

The United States lacks comprehensive federal AI legislation. The Biden-era executive order on AI (EO 14110) was revoked in January 2025. In its place, the Trump administration has pursued a deregulatory agenda explicitly framed around achieving “global AI dominance.”

The December 2025 Executive Order, “Ensuring a National Policy Framework for Artificial Intelligence,” established an AI Litigation Task Force within the Department of Justice to challenge state AI laws deemed inconsistent with federal policy. It directs the Secretary of Commerce to evaluate state AI laws and withhold broadband infrastructure funding from states with regulations considered “onerous.” The administration’s initial attempt at a 10-year moratorium on state AI legislation—included in an early draft of the One Big Beautiful Bill Act—was dropped after bipartisan opposition, but the executive order represents a targeted alternative approach.

This is not without merit. A patchwork of state regulations, framed by non-technical legislators constrained to legislate individual microcosms of issues, will hinder AI innovation, not protect it. What is needed is comprehensive federal legislation that establishes a coherent, technically informed framework—one that encourages safe AI innovation rather than fragmenting governance across fifty jurisdictions with varying levels of technical understanding.

For enterprises seeking to deploy or develop AI, the practical consequences add significant complexity. At the state level, they face the prospect of fifty different legislatures—each with varying levels of technical understanding—enacting their own AI regulations. Over one thousand AI-related bills have been introduced across state legislatures, creating a compliance environment where a company operating nationally could be subject to dozens of overlapping, inconsistent, and potentially contradictory requirements. Different definitions of “high-risk,” different disclosure obligations, different impact assessment methodologies, different enforcement mechanisms—all layered on top of each other with no harmonization. For the business leader responsible for building a governance program, this is not a regulatory landscape. It is a compliance nightmare. At the same time, the federal government is actively working to dismantle the state laws with which you may already be working to comply. The result is an environment where compliance investments carry genuine risk of obsolescence, and inaction carries genuine risk of liability.

1.2 Colorado as a Cautionary Example

Colorado’s AI Act (SB 24-205) is often cited as the first comprehensive state-level AI law in the United States. In practice, it is a cautionary example of what happens when non-technical legislators attempt to regulate a technology domain they do not fully understand.

The law establishes requirements for developers and deployers of “high-risk” AI systems, including impact assessments, risk management programs, and consumer notification obligations. It introduces a general duty of “reasonable care” to protect consumers from algorithmic discrimination—with a rebuttable presumption that deployers exercised reasonable care if they complied with specified provisions, including those of nationally or internationally recognized risk management frameworks.

In concept, a duty of reasonable care and an affirmative defense for framework compliance are sound legal principles. But the law as written is poorly constructed. Its definition of “consequential decision” is so broad that it sweeps in virtually every business function without meaningful risk differentiation. The compliance burden is disproportionate, particularly for small and mid-sized companies. And the algorithmic discrimination framework is vague enough that organizations genuinely cannot determine what compliance looks like in practice.

The technology community in Colorado has been overwhelmingly opposed. The Colorado Technology Association worked tirelessly to overturn and then amend the legislation. Governor Polis signed the original bill reluctantly and subsequently supported efforts to fix it. During a special legislative session in August 2025, stakeholders reached an agreement on amendments—only to have a Colorado State Representative, one of the bill’s original sponsors, filibuster until the session expired at midnight. The only outcome was a delay of the effective date to June 30, 2026. The law’s primary supporters remain its original sponsors and out-of-state consumer protection organizations—not the technology community that must actually comply with it.

The December 2025 federal executive order specifically singled out Colorado’s law, with White House AI and Crypto Czar David Sacks calling it “probably the most excessive” state AI law. Whether the law survives federal challenge is an open question, but its trajectory illustrates precisely why state-level AI legislation is the wrong approach. Technology regulation requires technical understanding, cross-jurisdictional coherence, and practical enforceability—none of which a single state legislature is positioned to deliver.

That said, the underlying legal concepts the Colorado law attempted to codify—a duty of reasonable care, affirmative defenses for recognized framework compliance, impact assessments—will almost certainly appear in whatever federal legislation eventually emerges. Courts and regulators have always evaluated organizational conduct against these principles. The lesson is not that these concepts are wrong, but that they must be implemented through technically informed federal legislation, not through a patchwork of state laws drafted without adequate technical expertise.

I have been vocal that the Colorado AI Act should have been scrapped entirely. But opposing bad legislation is not the same as opposing responsible governance. Companies moving to adopt AI—particularly those positioning themselves as early adopters—need to navigate doing the right thing even in the absence of existing legislation. They need to take the high road: building governance into their AI deployments now, not because a flawed state law demands it, but because failing to do so creates a rip-and-replace scenario down the road when coherent federal regulation inevitably arrives. The organizations that build defensible practices today will be positioned to adapt. The ones that cut corners will face the far more expensive prospect of retrofitting governance into systems that were designed without it.

1.3 The EU AI Act: Ambition Meets Implementation Reality

The EU AI Act, formally in force since August 2024, is being implemented in phases with full applicability of high-risk system obligations originally scheduled for August 2, 2026. However, the European Commission’s Digital Omnibus proposal, published in November 2025, proposes delaying high-risk provisions to December 2027, acknowledging that harmonized technical standards are not yet ready and that many member states have not established the required enforcement infrastructure.

For organizations with EU exposure, the AI Act creates extraterritorial obligations regardless of US policy. But the implementation delays signal that even the most ambitious regulatory frameworks struggle to keep pace with the technology they aim to govern.

1.4 The Structural Problem with AI Legislation

The challenges facing AI governance are not unique to Colorado or to any single jurisdiction. They reflect structural problems in how AI legislation gets made—problems that persist at the state, federal, and international level.

First, legislators do not understand AI. This is not a criticism of individual intelligence or intent—it is a recognition that artificial intelligence, machine learning, and agentic systems involve technical complexity that most lawmakers have no professional background to evaluate. When legislators cannot independently assess the technology they are regulating, they become dependent on the loudest voices in the room.

Second, the loudest voices are often fear-based. Consumer protection organizations have proven extraordinarily effective at lobbying for AI regulation framed around worst-case scenarios—algorithmic discrimination, autonomous harm, privacy erosion. These are legitimate concerns. But fear-based advocacy produces fear-based legislation: reactive, narrowly targeted, and designed to prevent specific harms rather than to create coherent governance frameworks that balance safety with innovation. The result is laws optimized for political messaging rather than operational effectiveness.

Third, comprehensive legislation loses to point solutions. Building a coherent, technically informed regulatory framework for AI is hard. It requires sustained engagement with technologists, risk professionals, and industry practitioners. It requires understanding trade-offs. It requires resisting the political incentive to legislate narrow, headline-friendly provisions. In practice, legislatures default to point solutions addressing individual microcosms of concern—deepfakes in one bill, hiring algorithms in another, content labeling in a third—rather than undertaking the more difficult work of comprehensive governance.

The cumulative effect is a regulatory landscape that is simultaneously over-regulated in narrow areas and completely ungoverned in the domains that matter most. Enterprises face prescriptive requirements for specific AI use cases while operating without any guidance on the broader challenge of governing agentic systems that execute business processes and create institutional knowledge. This is the worst of both worlds: compliance burden without governance coherence.

1.5 The Governance Gap

The net effect of these competing forces—federal preemption efforts, state law delays, EU implementation challenges, and the structural deficiencies in how AI legislation gets made—is a governance gap. There is no single authoritative framework telling organizations how to govern AI. This gap is not a reason for inaction. It is the precise reason why demonstrating due diligence to a defensible standard of care matters more than ever.

When regulatory frameworks are clear, compliance is relatively straightforward. When they are fragmented or absent, defensibility depends on demonstrating that your organization identified the risks, implemented proportionate controls, tested those controls, documented the results, and maintained a process for adapting as conditions changed. That standard holds regardless of which laws ultimately prevail.

2. Why Zero Trust Is Necessary but Not Sufficient for Agentic AI

Zero Trust has been the dominant security paradigm for the past decade. Its principles—never trust, always verify; assume breach; enforce least privilege—have driven a fundamental rearchitecture of enterprise security. CISA mandates it. NIST frameworks assume it. Every major security vendor positions against it.

And for traditional computing environments, it works. Zero Trust answers a specific question: “Should this subject be allowed to access this object right now?” That question assumes discrete, evaluable access events—a user requesting a file, a service calling an API, a device connecting to a network segment. Each transaction is independently verified against policy.

Agentic AI breaks this model in three fundamental ways.

2.1 The Action Problem

An agentic AI system does not merely access data—it acts on data across multiple systems within a single workflow. A Zero Trust policy engine can evaluate whether an agent is authorized to call a particular API. It cannot evaluate whether the sequence of actions the agent takes across multiple APIs constitutes an appropriate execution of a business process. The threat surface is not unauthorized access—it is authorized access used in an unintended process flow.

Consider a practical example: an agentic system processing insurance claims has authorized access to the claims database, the policyholder records, the payment system, and the correspondence platform. Each individual access is legitimate. But if the agent processes a claim using an incorrect interpretation of policy terms, approves payment, and sends confirmation to the policyholder—all within its authorization envelope—the damage is done without any access control violation ever triggering.

2.2 The Knowledge Creation Problem

When an agent synthesizes information from multiple sources and produces a new artifact—a risk assessment, a contract summary, a strategic recommendation—it has created institutional knowledge that did not previously exist. Zero Trust has no framework for governing the creation of information, only access to existing information.

That synthesized artifact will be consumed by other agents and humans. If it is subtly wrong—not hallucinated, but imprecise in a way that shifts meaning—the error propagates through downstream business decisions with no access violation ever occurring. An agent that summarizes hundreds of vendor contracts and produces a synthesis of standard terms has created a knowledge asset that procurement teams will rely on. If the synthesis subtly mischaracterizes indemnification clauses, the organization makes business decisions based on flawed institutional knowledge.

This is a knowledge integrity problem, and it represents a category of risk that the access-centric model was never designed to address.

2.3 The Temporal Problem

Zero Trust evaluates each access decision independently and in the present moment. Agentic AI operates across time—building memory, accumulating context, compounding intelligence. The security-relevant question is not merely “is this access authorized right now” but “is the cumulative knowledge state this agent has built over weeks or months of operation appropriate for the decisions it is now making?”

An agent that has accumulated context across hundreds of sensitive transactions may develop a knowledge state that no individual user would be authorized to hold. Zero Trust, which evaluates discrete access events, lacks a mechanism to govern the emergent properties of accumulated context.

The future of AI governance is not access control—it is process integrity. We must govern what AI does, not just what it can reach.

3. Business Process Integrity: The Right Governance Model for Agentic AI

If Zero Trust’s unit of governance is the access event, what is the right unit of governance for agentic AI? The answer comes not from the cybersecurity domain but from the established discipline of internal controls and business process assurance.

3.1 The Core Insight

Agentic AI systems are deployed to do what businesses do: carry out business processes and make effective use of the company knowledge needed to execute those processes. They are also learning systems that create context as institutional knowledge. This means internal controls must be reconceived as control points embedded in processes—not as a set of static rules defining access mappings between subjects and objects.

Think about how a business actually works. When a human loan officer processes an application, the real controls are not primarily access controls. They are embedded in the process: credit thresholds triggering supervisory review, documentation requirements at each stage, separation of duties between origination and approval, exception handling procedures, and regulatory hold points. These are process controls, and they have been the backbone of internal audit and operational risk management for decades.

SOX compliance, for example, is not primarily about who can access the general ledger. It is about whether the financial reporting process has adequate controls at the right points. When an agentic AI system executes a business process, the controls should be inherent in the process design—built into the workflow at the points where risk decisions are made, where data quality matters, where escalation is warranted, and where regulatory requirements attach.

3.2 Three Interlocking Control Layers

A defensible control architecture for agentic AI requires three interlocking layers:

Process Controls

Control points embedded at decision nodes within business processes, regardless of whether a human or agent is executing. These are the checkpoints where risk materializes: approval thresholds, regulatory hold points, data quality gates, escalation triggers. The control exists because the process demands it, not because the agent requires monitoring.

Knowledge Controls

Governance over the creation, validation, and lifecycle of AI-generated institutional knowledge. This includes provenance tracking (what sources did the agent draw on), confidence signaling (how certain is this synthesis), versioning (how has this knowledge artifact changed over time), and decay management (when does AI-generated context need to be revalidated). This is a new control category that most organizations have not yet conceptualized.

Orchestration Controls

Orchestration is the layer that governs how agentic systems interact with each other and with human workflows. When one agent’s output becomes another agent’s input, controls at the handoff points ensure that errors do not propagate across process boundaries. This is where process control thinking intersects with systems integration—governing the interfaces between autonomous actors.

3.3 Governance at the Point of Reasoning

The most critical architectural principle for agentic AI governance is that controls must be embedded at the point of reasoning—shaping how the system thinks, not filtering what it outputs after the fact.

Traditional AI governance approaches rely on post-hoc output filtering: the system generates a response, and a separate layer evaluates whether that response is acceptable. For agentic systems executing multi-step workflows with real-world consequences, this is inadequate. By the time an output filter catches a problem, the agent may have already taken irreversible actions.

Governance at the point of reasoning means that policy compliance shapes the agent’s decision-making process itself. The agent does not generate an action and then check whether it is allowed. Instead, the governance framework is part of the reasoning architecture—informing what options the agent considers, what evidence it weighs, and what thresholds trigger escalation. This is structurally analogous to how a well-trained professional internalizes compliance—not as a checklist applied after decisions, but as a framework that shapes the decision-making process itself.

4. Defining a Defensible Standard of Care for Agentic AI

A defensible standard of care is one that can withstand scrutiny from regulators, auditors, courts, and boards. It answers the question: “What did you know, what did you do about it, and can you show me?”

For enterprise agentic AI deployment, this standard rests on seven pillars:

4.1 Authorization Boundaries

Define explicit authorization envelopes for each agentic deployment: what tools it can invoke, what data it can access, what external systems it can reach, what actions are irreversible, and what thresholds trigger mandatory human review. This is the principle of least privilege applied not to data access but to action scope. Document these boundaries, tie them to risk classifications, and test them operationally.

4.2 Delegation Governance

Establish frameworks for what constitutes appropriate delegation to an agentic system, analogous to organizational delegation of authority. A CFO can authorize expenditures up to a certain threshold; beyond that, board approval is required. Agentic AI needs equivalent structures: what decisions can the agent make autonomously, what requires escalation, and how is that escalation triggered? Document these delegation boundaries and verify that escalation mechanisms function as designed.

4.3 Auditable Observability

Maintain the ability to reconstruct what the agent did and why—not just “the agent sent an email” but “the agent searched for X, found Y, inferred Z, drafted a message based on that inference, and sent it to this recipient.” Every output should be traceable through sources, policies, reasoning steps, and timestamps. This is the “show your homework” principle operationalized for autonomous systems.

4.4 Failure Mode Analysis and Containment

Document failure mode analysis for each agentic deployment. What happens when the agent misinterprets a task? When an external API returns unexpected data? When the agent encounters an edge case its behavioral boundaries did not anticipate? More importantly: what are the blast radius containment mechanisms? If an agentic system goes off the rails, how far can damage propagate before a circuit breaker trips? This is network segmentation thinking applied to AI action spaces.

4.5 Continuous Behavioral Validation

Conduct regular adversarial testing of agentic deployments—not just at initial deployment but on an ongoing cadence. Are behavioral boundaries holding? Are there task configurations that cause the agent to exceed its authorization envelope? Has a model update changed system behavior in ways the control framework did not anticipate? Document results and remediation actions, just as you would for penetration testing.

4.6 Supply Chain and Third-Party Governance

When deploying frontier AI models as agentic systems, the control environment depends on a foundation that the organization does not fully control. Model updates can change behavior. Vendor policy changes can alter what the system will and will not do. Address this dependency explicitly through contractual assurances, model change management processes, behavioral regression testing after vendor updates, and contingency planning for changes to vendor relationships.

The current tensions between the Pentagon and Anthropic over the use of AI systems in military operations vividly illustrate this risk. Organizations that deployed Claude into sensitive workflows discovered that the vendor’s safety commitments may constrain use cases that were assumed to be covered. That is a supply chain governance issue in the context of agentic AI.

4.7 Proportionality and Business Context

Proportionality and business context map each agentic deployment to a risk tier based on the decisions it influences, the data it accesses, the actions it can take, and the population it affects. Controls must be proportionate to that risk tier. An agent summarizing meeting notes requires fundamentally different governance than an agent processing insurance claims or making hiring recommendations. Document why you chose the controls you did for each tier. That proportionality is what distinguishes a mature governance program from a checkbox exercise.

5. How Existing Frameworks Fit—and Where They Fall Short

No single existing framework fully addresses the governance requirements of agentic AI. However, several provide critical foundations that should be leveraged rather than replaced.

The path forward is not to discard these frameworks but to layer business process integrity controls on top of them. Zero Trust remains essential for the access layer. NIST AI RMF provides the risk management lifecycle. ISO 42001 offers the management system structure. The EU AI Act and state laws like Colorado’s establish the legal context. What is missing is the process integrity layer that governs autonomous execution and knowledge creation—and that is where the cybersecurity community’s expertise in internal controls, audit, and operational risk management becomes indispensable.

5.2 The International Standards Library: You Do Not Need to Wait for Legislation

One of the most consequential misunderstandings in the AI governance conversation is the belief that organizations must wait for legislation before they can build a defensible governance program. This is simply wrong. A robust library of international standards already exists that provides the technical and organizational foundation for AI risk management—and compliance with these recognized frameworks constitutes precisely the kind of “showing your homework” that regulators, courts, and boards find credible.

The key standards form an interlocking stack:

ISO/IEC 42001 (AI Management Systems). The first certifiable management system standard for AI. It defines governance, organizational roles, lifecycle processes, risk integration, monitoring, documentation, and continuous improvement for AI systems. Think of it as ISO 9001 for AI—it provides the structural framework within which all other AI governance activities operate.

ISO/IEC 23894 (AI Risk Management). Provides detailed, practical guidance on identifying, assessing, and treating AI-specific risks across the entire AI lifecycle. Built on ISO 31000 risk management principles, it addresses AI-specific hazards including model drift, bias, hallucination, adversarial inputs, and black-box decision-making. Where ISO 42001 defines the governance system, ISO 23894 provides the risk management playbook.

ISO/IEC TR 24028 (AI Trustworthiness). Defines what it means for an AI system to be trustworthy—covering transparency, explainability, controllability, robustness, and accountability. This standard provides the conceptual framework for the trustworthiness properties that your governance program should be designed to achieve and verify.

ISO/IEC 42005 (AI System Impact Assessment). Published in 2025, this standard provides methodology for assessing the impact of AI systems—directly relevant to the impact assessment requirements appearing in both the EU AI Act and state-level legislation.

ISO/IEC 22989 (AI Concepts and Terminology). Establishes the common language and conceptual framework for AI—essential for ensuring that governance discussions within an organization are precise and consistent.

These standards are voluntary, internationally recognized, and vendor-neutral. Critically, compliance with recognized risk management frameworks like these is already cited as an affirmative defense in existing legislation—the Colorado AI Act explicitly provides a rebuttable presumption of reasonable care for organizations that comply with nationally or internationally recognized frameworks. The NIST AI Risk Management Framework occupies a similar position in the federal approach. Whatever form federal legislation ultimately takes, alignment with these international standards will almost certainly constitute evidence of due diligence.

For organizations Demonstrating Due Diligence to a Defensible Standard of Care™, these standards provide the scaffolding. They do not solve the agentic AI governance problem on their own—as the table above illustrates, none of them fully addresses autonomous execution, knowledge creation, or multi-agent orchestration. But they provide the recognized, auditable foundation upon which the process integrity controls described in this paper can be built. Waiting for legislation is not a strategy. Building on established international standards is.

6. From Framework to Practice: The Risk2ResiliencePath℠

Knowing what a defensible standard of care requires is necessary. Knowing how to build one is what matters. The seven pillars described in Section 4 define the “what.” This section addresses the “how”—using a proven methodology that has its origins in one of the most demanding compliance environments in corporate history.

6.1 Origin: SOX 404 Under Accelerated Filing

I developed the Risk2ResiliencePath℠ methodology while I was the VP of IT Risk Management at AT&T Wireless to move from a business risk profile and target outcomes to operationalized controls under extreme time pressure. The challenge was straightforward but unforgiving: demonstrate to regulators that the company’s internal control environment over financial reporting was effective—in the first year of accelerated filing under Sarbanes-Oxley Section 404, while overhauling the IT environment in response to a massive software deployment failure.

That effort succeeded not because the team built a compliance checklist, but because they built a process for translating business risk into operational controls that were embedded in the workflows where risk actually materializes. The methodology that emerged has since been refined across multiple enterprise contexts and is now directly applicable to the agentic AI governance challenge—because the underlying problem is the same: how do you ensure that business processes have the right controls at the right points, and how do you prove it under scrutiny?

6.2 The Five Phases

The Risk2ResiliencePath℠ moves organizations through five phases, from initial exposure assessment to defensible readiness. Each phase maps directly to the agentic AI governance requirements outlined in this paper:

6.3 Why This Methodology Works for Agentic AI

The Risk2ResiliencePath℠ succeeds where generic compliance frameworks fail for three reasons:

It starts with the business, not the technology. The Discover phase begins with actual business risk—not with AI capabilities or regulatory checklists. This ensures that governance is proportionate to what the organization actually does, not to an abstract threat model.

It operationalizes, not just documents. The Deploy phase insists on lived practices, not policy documents that sit on a shelf. For agentic AI, this means controls embedded in the reasoning architecture of the agents themselves—governance that operates at runtime, not at audit time.

It builds proof, not just protection. The Demonstrate and Defend phases recognize that defensibility requires evidence. When a regulator, auditor, board member, or plaintiff’s attorney asks “what did you do and can you show me,” the answer must be documented, traceable, and current. This is the difference between organizations that feel secure and organizations that can prove it.

6.4 The Defensibility Test

Regardless of which regulatory framework ultimately prevails—whether Colorado’s reasonable care standard survives, whether the EU AI Act’s high-risk provisions take effect as scheduled, or whether federal preemption creates a different compliance environment entirely—the fundamental question remains the same:

“What did you know, what did you do about it, and can you show me?”

An organization that has completed the Risk2ResiliencePath℠ for its agentic AI deployments can answer that question with documented evidence at every phase: the risks were identified (Discover), proportionate controls were designed for the specific business context (Design), those controls were operationalized in the actual workflows (Deploy), evidence of effectiveness was maintained (Demonstrate), and the controls were stress-tested against realistic scenarios (Defend).

That is what demonstrating due diligence to a defensible standard of care™ looks like in practice. It holds under SOX scrutiny. It holds under regulatory examination. And it holds in the new world of agentic AI.

7. Implications for Security Leaders

7.1 Stop Chasing Specific Regulatory Text

The regulatory landscape will continue shifting. Federal preemption may succeed or fail. State laws will be enacted, delayed, amended, or struck down. The EU will implement, delay, or revise. What will not change is the question a judge, regulator, or board will ask: “What did you know, what did you do about it, and can you show me?”

Build your control environment to answer that question, mapped to multiple frameworks simultaneously, and you are defensible regardless of which specific regulation prevails.

7.2 Inventory and Classify Your Agentic Deployments

Most enterprises are deploying agentic AI capabilities right now—through Copilot, through Claude, through internal tools—without a comprehensive inventory. You cannot govern what you have not identified. Map each deployment to a risk tier based on decisions influenced, data accessed, actions taken, and populations affected.

7.3 Extend Your Internal Audit Capabilities

The skills needed for agentic AI governance are not fundamentally new to the cybersecurity and audit profession. Business process controls, separation of duties, transaction monitoring, evidence preservation—these are established competencies. They need to be extended to account for autonomous execution and knowledge creation, but the intellectual foundation already exists.

7.4 Demand Governance Architecture from Your Vendors

When evaluating agentic AI platforms, assess whether governance is embedded in the architecture or bolted on as an afterthought. Key questions include: Is governance applied at the point of reasoning, or only as post-hoc output filtering? Is every action traceable through sources, policies, reasoning steps, and timestamps? Can new agents inherit existing governance frameworks? Does the platform create auditable evidence of control effectiveness? Who owns the institutional knowledge the system creates?

7.5 Build for Regulatory Optionality

Design your governance program to satisfy the most demanding plausible regulatory requirement, then scale controls proportionally. If you build for Colorado’s reasonable care standard and the EU AI Act’s conformity requirements, you are over-prepared for a regime of voluntary compliance—and exactly prepared for the regime most likely to emerge eventually.

8. Conclusion: The Control Environment Is Your Strategic Asset

We are in a period of extraordinary regulatory uncertainty for AI governance. The federal government is working to preempt state regulation. States are enacting and delaying laws simultaneously. The EU is implementing the world’s most comprehensive AI regulation while proposing to delay its most important provisions. And enterprises are deploying agentic AI systems that operate beyond the assumptions of existing security architectures.

In this environment, the organizations that will be defensible are not the ones waiting for regulatory certainty. They are the ones building governance into how their AI systems think and operate—governance that is embedded in business processes, that ensures the integrity of AI-generated institutional knowledge, and that can demonstrate due diligence through auditable evidence of proportionate, operationally effective controls.

The cybersecurity community is uniquely positioned to lead this work. We have decades of experience building defensible control environments. We understand risk-based governance, proportionate controls, and evidence-based assurance. The unit of analysis has changed—from access events to business processes—but the underlying discipline is the same.

The Risk2ResiliencePath℠ provides the implementation roadmap. It has been proven under the most demanding compliance conditions, and it extends naturally to the agentic AI governance challenge. The organizations that adopt this discipline now—while the regulatory landscape is still forming—will be the ones that can demonstrate due diligence regardless of how governance ultimately resolves. The ones that wait will be playing catch-up, at best, or defending themselves without documentation, at worst.

The future of AI governance is not access control—it is process integrity. We must govern what AI does, not just what it can reach. And the standard we hold ourselves to must be defensible not because a specific law.

About the Author

Karen Worstell is an ISSA Distinguished Fellow with more than thirty years of experience in cybersecurity leadership, including CISO roles at Microsoft and AT&T. She is the founder of W Risk Group and Create Your Leading Edge (CYLE), and the author of CISO SOS, a resource for cybersecurity professionals navigating the evolving demands of security leadership.

The Demonstrate Due Diligence to a Defensible Standard of Care™ Framework and the Risk2ResiliencePath℠ methodology are available through W Risk Group.

Disclaimer: This paper is provided for informational purposes and represents the author’s professional analysis. It does not constitute legal advice. Organizations should consult qualified legal counsel when developing AI governance programs.

Demonstrate Due Diligence to a Defensible Standard of Care™ and Risk2ResiliencePath℠ are trademarks of W Risk Group.

© 2026 Karen Worstell / CISO SOS / W Risk Group LLC. All rights reserved.

You know the feeling.

Back-to-back incident bridges, a board presentation in 40 minutes, and your brain is still locked in threat-detection mode. Your shoulders are up near your ears. Your thinking has narrowed to the tactical. You need to walk into that boardroom and be strategic, composed, and clear — but your nervous system is still running the last crisis.

The standard advice is to meditate, take a walk, breathe. All good. All requiring time you don’t have and a context switch you can’t afford.

What if the reset took 10 seconds and didn’t require leaving your desk?

I’m going to make a case that might surprise you, and it’s going to take a hot minute. Stay with me. There’s science behind it that is important to know. What I’m about to share is a practice so simple on its face that you may not believe it’s effective. I’m asking you to suspend that disbelief long enough to reach the science — and then try it once. If it doesn’t work, you’ve lost 10 seconds. If it does, you’ll want to tell me about it.

We Are Not Okay

Let me put some numbers on the problem of burnout in cybersecurity.

Proofpoint’s 2025 Voice of the CISO report found that 63% of CISOs experienced or witnessed burnout in the past year. Sophos put that number at 76%. BlackFog reported that 93% cite unsustainable stress levels. Seventy-four percent of cybersecurity professionals globally have taken time off due to work-related mental health problems. The average CISO tenure is 26 months — less than half the 5.3-year average for other C-suite roles.

In 2023, Gartner predicted that by 2025, nearly half of cybersecurity leaders would change jobs, with 25% leaving the field entirely. A quarter of CISOs are actively considering stepping down. Some still estimate the global cybersecurity workforce gap stands at 4.8 million unfilled positions — growing 19% year over year, while the active workforce stayed essentially flat.

And then there’s the isolation. CISOs operate under what Shamla Naidoo of Netskope called “a cloud of secrecy and confidentiality” that cuts us off from potential support systems. Unlike other C-suite roles, there’s often nowhere to escalate. As Malcolm Harkins, former CISO at Intel, put it: “Other than to the board, there is really nowhere to go that’s higher.” Fifty-seven percent of CISOs rarely or never switch off from work.

I lived this. I was a corporate CISO at Microsoft and, before that, the head of IT Risk Management and CISO for AT&T Wireless. I know what chronic hyper-vigilance does to your body, your sleep, your relationships, and your decision-making. The threat never stops, so your nervous system never downshifts. CISOs are the tip of the spear - hyper-vigilance affects people throughout the cybersecurity organization. Many of us have been speaking and writing about this for a decade. It is not improving.

The Coping Mechanisms We’d Rather Not Talk About

Here’s where it gets uncomfortable.

A 2023 study by All Points North and Censuswide surveyed 501 tech executives at companies with over 1,000 employees. The findings were devastating. Half of tech executives self-identified as heavy drinkers — consuming between three and seven alcoholic drinks a day. Forty-five percent reported using painkillers. Thirty-six percent are on antidepressants. Thirty-four percent use stimulants. Thirty-five percent use sleeping pills. Over a third reported increasing their alcohol intake specifically to cope with work stress; another third increased their use of controlled substances.

Read those numbers again.

These aren’t junior analysts. These are senior leaders running critical functions in major enterprises. And this is what they’re doing to get through the day.

The pattern is revealing: the coping mechanisms that win are the ones that require no calendar slot, no context switch, and no appointment. Alcohol to downshift after a 14-hour day. Stimulants to push through the next incident. Painkillers to manage the physical toll of chronic stress. They require zero extra effort, and that’s exactly why they beat meditation apps and therapy sessions every time.

They also make everything worse. Alcohol disrupts sleep architecture - and without having good restorative sleep, the damage adds up fast. Stimulants amplify anxiety. Painkillers blunt the cognitive sharpness the role demands. The coping mechanism becomes its own attack surface — on your health, your relationships, and your judgment.

No judgment here, just empathy. I did it too.

I spoke about this “dirty little secret” from the stage at RSA in 2019. Industry spokespersons like Bill Brenner have made this a platform, but as I read these latest statistics, the situation isn’t improving. If these numbers are even directionally accurate, a non-trivial percentage of senior technology leadership may be making high-stakes decisions while physiologically dysregulated or chemically compensated. That should concern all of us.

Why the Current Solutions Aren’t Enough

I’m not here to dismiss therapy, meditation, exercise, or organizational change. They matter. I’ve benefited from all of them.

But they share a common limitation: they’re additive. They add something to your schedule. They require dedicated time blocks, context switching away from work, willingness to acknowledge the problem (there’s still stigma), and sustained practice over weeks before any benefit appears (if it appears at all).

For someone in chronic sympathetic activation — running on cortisol, processing alerts, preparing for the next board meeting — the activation energy to start a meditation session can feel impossible. That’s not weakness. That’s neurophysiology. Your brain is in survival mode, and survival mode doesn’t want to sit still and focus on your breath. It believes it HAS to scan for the next threat.

So the question becomes: what if there was a regulation tool that worked continuously, required no calendar slot, carried no stigma, and actually helped your nervous system rather than numbing it?

What I Found

After I left my CISO role, I did something unexpected. I completed 2,000 supervised clinical hours, earned another master’s degree, and served as a Palliative Care Fellow at the VA hospital in Portland, Oregon. It was there — working with veterans facing life-limiting diagnoses — that I first understood the neuroscience of how our bodies hold stress, how moral injury accumulates silently, and how the nervous system can get stuck in states that no amount of willpower can override.

I studied trauma-informed care. I started studying frameworks for nervous system regulation—what actually shifts someone out of survival mode and into a state where strategic thinking, creativity, and calm decision-making thrive.

Then I stumbled onto something I didn’t expect.

I’ve been a fragrance enthusiast for some time — 225 bottles of niche and indie perfume, if we’re being specific. But what started as a personal interest became something different when I began paying attention to what was happening in my body as I intentionally engaged with scent. Not just wearing perfume. Deliberately pausing to smell. Noticing the shift.

It wasn’t subtle. And it wasn’t placebo. My Whoop data started telling me something I couldn’t ignore: engaging with scent was a gateway to intentionally managing my highly sensitized nervous system.

The Neuroscience (Stay With Me — This Is the Good Part)

Three independent lines of research converge on why this works. None of them are from the fragrance industry. All of them are from peer-reviewed neuroscience and pharmacology.

Your sense of smell is unique in its neuroanatomy. Olfactory signals project directly from the olfactory bulb to limbic structures — including the amygdala and hippocampus — without first routing through the thalamic relay used by vision and hearing. That direct projection pathway is unusual, and it matters.

Executive coaching science takes this to the next level.

In Shirzad Chamine’s Positive Intelligence framework — widely used in executive coaching — a “PQ rep” is 10 seconds of focused sensory attention that shifts brain activation from survival mode to creative and strategic mode. Chamine’s research with over 500,000 participants shows that these brief sensory interventions, practiced consistently, measurably improve performance and reduce stress reactivity. Intentional smelling is a PQ rep — arguably the most neurobiologically efficient one, because it combines direct limbic access with the inhalation-cognition link that Sobel documented.

For certain fragrance materials, there’s a pharmacological layer too.

Researchers at the Chinese Academy of Medical Sciences have published a series of studies showing that agarwood (oud) essential oil exerts sedative and anxiolytic effects through the GABAergic system — the same neurotransmitter system targeted by anti-anxiety medications like diazepam, but through a different mechanism. A 2023 study demonstrated these effects specifically through inhalation, not injection — meaning actual smelling, not a lab-only route. The same research group showed that agarwood essential oil suppresses HPA (hypothalamic-pituitary-adrenal) axis hyperactivity — the very stress-response system that’s perpetually over-activated in people under chronic occupational pressure.

I want to be precise about what I’m claiming and what I’m not. There are two distinct layers here:

First: any quality fragrance, intentionally engaged with, functions as a somatic regulation tool through focused olfactory attention and the inhalation-cognition mechanism. This works regardless of what’s in the bottle. This is the foundation.

Second: specific natural materials — such as agarwood-derived sesquiterpenes — may offer additional neurochemical benefits via documented bioactive pathways. This is compelling, peer-reviewed research, but it’s a bonus layer, not the foundation.

You don’t need a $700 bottle of oud to regulate your nervous system. You need a scent you love and 10 seconds of intentional attention.

Sidebar: Not Just Oud — Fragrance Materials with Documented Neurochemical Effects

You don’t need rare or expensive materials to access these benefits. Peer-reviewed research supports anxiolytic and regulatory effects for fragrance materials found at every price point.

Jasmine — The strongest evidence after agarwood. Researchers at Ruhr-Universität Bochum screened hundreds of fragrances and found that jasmine-derived compounds increased GABA receptor activity by more than fivefold — matching the potency of barbiturates and propofol, through the same molecular mechanism (Sergeeva et al., 2010, Journal of Biological Chemistry). A 2023 network meta-analysis of randomized controlled trials ranked jasmine as the most effective essential oil for reducing state anxiety (Frontiers in Public Health, 2023). Its active compound linalool modulates GABA-A receptors directly. Jasmine appears in fragrances from drugstore to designer.

Rose — Rose oil inhalation decreases salivary cortisol levels (Fukui et al., 2007, Neuroendocrinology Letters) and suppresses HPA axis hyperactivity under chronic stress — the same stress-response system the agarwood research targets (Fukada et al., 2012, Chemical Senses). Damask rose contains isoflavones that bind directly to GABA receptors (Frontiers in Public Health, 2023). Rose is one of perfumery’s most common materials, available in natural and synthetic forms across every market segment.

Patchouli — A randomized controlled trial with emergency nurses found that patchouli inhalation significantly increased compassion satisfaction — the ability to find meaning in high-stress caregiving work (Seo, Journal of Alternative and Complementary Medicine, 2020). Separate research showed it reduced sympathetic nerve activity by approximately 40% in healthy adults (Haze et al., 2002, Japanese Journal of Pharmacology). Patchoulol, the primary active compound, works primarily through dopamine elevation — a complementary mechanism to the GABAergic effects of jasmine and oud. Patchouli is a base note staple present in thousands of fragrances.

Vanilla — Vanillin shows oral anxiolytic effects comparable to diazepam in animal models, acting through GABA receptors (International Journal of Nutrition, Pharmacology, Neurological Diseases, 2013). Vanillin aromatherapy restored brain BDNF — a neuroplasticity marker — in depression model rats (Journal of Neuropsychiatry, 2018). The inhalation evidence is weaker than for jasmine or rose, but vanilla’s near-universal appeal and presence in fragrance makes it a practical entry point.

The takeaway: The pharmacological research on agarwood is compelling, but it’s not the only path. Jasmine, rose, patchouli, and vanilla (among others) are all supported by peer-reviewed evidence — and they’re ingredients you’ll find in fragrances at every price point. What matters most isn’t the specific material. It’s the intentional engagement with scent that activates the inhalation-cognition mechanism and shifts your nervous system state.

Pick something you love. Smell it on purpose. That’s where the science starts.

From Intervention to Anchor

Here’s where my own experience added something I haven’t seen in any of the research.

Chamine’s PQ reps are designed as reactive interrupts. You notice you’re in saboteur mode — stressed, reactive, narrowed — so you do a 10-second sensory rep to shift back. That’s valuable.

But fragrance on your skin isn’t a one-time intervention. It’s a persistent sensory anchor. Every time you catch it throughout the day, you get a micro-reset you didn’t have to initiate. You don’t have to notice the stress first. You don’t have to remember to do the rep. The fragrance is doing continuous work in the background.

I discovered this by accident. I’d been working through Chamine’s Positive Intelligence program, identifying my own saboteur patterns (Hyperachiever, Restless, and Avoider — a classic combination for someone who’s built a 40-year career and keeps launching new ventures). I designed a weekly task management system to accommodate both high-priority strategic work and the tedious operational tasks that Avoider loves to sidestep — expense reports, tax prep, administrative work.

It worked. Everything was getting done. I was enjoying the process. And then one day I realized: the fragrances I’d been wearing weren’t incidental. They were the continuous Sage anchor keeping my nervous system regulated enough that resistance never fully formed. I wasn’t fighting through the task list. I was regulated enough that the fight never started.

Two weeks from identifying my saboteur patterns to an operational system I actually enjoyed using. The fragrance practice was the variable I almost didn’t notice.

What This Looks Like in Practice

This is not a perfume recommendation. It’s a framework for experimentation.

Before a high-stakes meeting: a deliberate 10-second pause with a scent you’ve chosen for that purpose. Not a spritz on the way out the door — a moment of focused olfactory attention that shifts your state. Bring your wrist to your nose. Inhale. Notice what happens in your chest, your shoulders, your thinking.

During sustained operational pressure, fragrance on your skin is a continuous anchor. Every time you catch it, your nervous system gets a micro-reset without conscious effort. You don’t have to do anything. The scent re-engages the mechanism identified by Sobel’s research.

Transitioning between contexts: notice how different scent profiles affect your state. Cooler compositions for analytical clarity. Warmer resins for depth and sustained focus. Brighter, citrus-forward profiles for activation when you’re dragging after a long afternoon.

This requires no app subscription, no calendar block, no therapist appointment, no stigma, and no substance that impairs your judgment.

It requires one deliberate choice in the morning, a willingness to notice what you’re smelling, and curiosity about what shifts.

The Real Comparison

There’s a better than even chance that you are already using substances or behaviors to regulate your state. The question is which ones.

Alcohol — used by half of tech executives at heavy-drinking levels — provides temporary nervous system depression at the cost of disrupted sleep, impaired cognition, dependency, and health deterioration.

Stimulants — used by a third of tech executives — provide temporary activation and focus at the cost of increased anxiety, crash cycles, and cardiovascular risk.

Painkillers — used by 45% of tech executives — numb physical stress symptoms at the cost of dependency, cognitive dulling, and withdrawal.

And then there are the behaviors we don’t even recognize as numbing. Brené Brown’s research on vulnerability identified that substances are only one category — we also numb through doom-scrolling, staying “crazy busy,” compulsive online shopping, binge-watching, overworking, and overeating. Sound familiar? These aren’t moral failures. They’re nervous system regulation strategies — the ones your body defaults to when it doesn’t have a better option.

Brown’s core insight applies to all of them: “We cannot selectively numb emotions; when we numb the painful emotions, we also numb the positive emotions.” Every one of these behaviors trades short-term relief for diminished access to the creativity, strategic clarity, and joy that make leadership — and life — worth the effort.

Intentional fragrance practice supports nervous system regulation through direct limbic access, at the cost of a bottle of something you enjoy. It doesn’t numb. It doesn’t impair. It doesn’t trade tomorrow’s capacity for tonight’s relief. And unlike every other option on this list, it actually enhances the cognitive functions your role demands.

I’m not suggesting fragrance replaces therapy, medication, or the organizational changes our industry desperately needs. Those matter. But for the daily, in-the-moment regulation that most of us are currently outsourcing to a bourbon after the board meeting or an Adderall before the incident bridge — there’s a better option. One that actually improves cognitive function rather than impairs it.

What I’m Building

I’ve been developing something called The Way of Fragrance — a practice framework that brings together the neuroscience of olfaction, somatic regulation principles, and intentional fragrance engagement. It’s informed by the research I’ve described here, by my clinical training in palliative care, by Chamine’s PQ framework, and by my own biometric data tracking the physiological effects of different fragrance materials.

I’m not publishing this as a clinical trial. I’m publishing it as a practitioner and a 40-year veteran of technology leadership sharing what I’m observing — with data, with citations, and with full transparency about what I know and what I don’t yet know. The peer-reviewed research supports the mechanism. My biometrics support the practice. Early feedback from technology executives who’ve experienced it has been striking — not for the fragrance itself, but for the immediate recognition that this is doing something different from anything they’ve encountered in the wellness space. The word “healing” keeps coming up unprompted.

There’s more to come. I’m writing a series called “Holy Smokes” on my Scents.n.Sensibility Substack (link below) that goes deeper into the science of specific fragrance materials and their somatic effects. I’m building practice kits designed for people who want to experiment with this approach. And I’m continuing to track my own biometric data to build a more robust evidence base.

Your 10-Second Experiment

You spent your career building systems to protect organizations. This is about protecting your own operating capacity.

Here’s what I’m asking: try it. Tomorrow morning, before you open your laptop, pick up a fragrance you love. It doesn’t have to be expensive. It doesn’t have to be niche. It just has to be something that genuinely engages you when you smell it.

Hold it to your nose. Inhale for 10 seconds. Really smell it. Notice what happens to your shoulders. Notice what happens to your breathing. Notice what happens to the quality of your attention.

Then wear it. And notice what happens to your first meeting.

That’s not preference. That’s your nervous system talking.

For more fragrance content and to read the Holy Smokes series, subscribe to Scents.n.Sensibility on Substack.

Karen Worstell served as a serial CISO for iconic brands such as AT&T Wireless, Microsoft, and Russell Investments, and as palliative care chaplain. She is an executive coach, and the founder of Create Your Leading Edge℠ and Way of Fragrance℠. She writes CISO SOS for cybersecurity leaders navigating risk, resilience, and well-being and a fragrance blog on Substack called Scents.n.Sensibility.

References

Burnout and attrition:

• Proofpoint (2025). Voice of the CISO Report

• Sophos (2025). The Human Cost of Vigilance: Addressing Cybersecurity Burnout in 2025.

• BlackFog (2024). CISO Research Report

• Hack The Box / Censuswide (2024). Building a Firewall Against Cybersecurity Burnout

• Nominet. CISO Stress Report

• Gartner (2023). Press release: “Gartner Predicts Nearly Half of Cybersecurity Leaders Will Change Jobs by 2025”

• ISC2 (2024). Cybersecurity Workforce Study

• Dark Reading (2024). “Persistent Burnout Is Still a Crisis in Cybersecurity”

• Computer Weekly (2025). “CISO Burnout: A Crisis of Expectation and Isolation”

Substance use among tech executives:

• All Points North / Censuswide (2023). *2023 Mental Health in Tech Report* (501 tech executives surveyed at companies with 1,000+ employees)

• Employee Benefit News (June 2023). “Tech leaders struggle with mental health and substance abuse”

Cognitive neuroscience and olfaction:

• Perl, O. et al. (2019). “Human non-olfactory cognition phase-locked with inhalation.” Nature Human Behaviour, 3, 501–512.

• Huberman Lab Podcast, Episode #25: “How Smell, Taste & Pheromone-Like Chemicals Control You” (June 2021)

• Huberman Lab Podcast: “Dr. Noam Sobel: How Smells Influence Our Hormones, Health & Behavior” (May 2023)

• Systematic review: “Does Olfactory Training Improve Brain Function and Cognition?” PMC (2023)

• Brown, B. (2010). The Gifts of Imperfection. Hazelden Publishing.

Fragrance materials pharmacology:

• Wang S. et al. (2017). “Agarwood Essential Oil Displays Sedative-Hypnotic Effects through the GABAergic System.” Molecules, 22(12):2190.

• Wang S. et al. (2018). “Agarwood Essential Oil Ameliorates Restraint Stress-Induced Anxiety and Depression by Inhibiting HPA Axis Hyperactivity.” International Journal of Molecular Sciences, 19(11):3468.

• Wang S. et al. (2023). “Agarwood essential oil inhalation exerts antianxiety and antidepressant effects via the regulation of Glu/GABA system homeostasis.” Biomedical Reports, 18(2):13.

• Pang et al. (2022). “Effective Components and Molecular Mechanism of Agarwood Essential Oil Inhalation.” Molecules, 27(11):3483.

• Sergeeva et al. (2010). J Biol Chem. DOI: 10.1074/jbc.M110.103309

• Fukui et al. (2007). Neuroendocrinol Lett 28:433–437

• Fukada et al. (2012). Chem Senses 37(4):347–356

• Haze et al. (2002). Jpn J Pharmacol 90:247–253

• Hongratanaworakit (2009). “Relaxing effect of rose oil on humans.” Natural Product Communications 4:291-296.

• Frontiers systematic review (2023). Front Public Health 11:1144404

Positive Intelligence:

• Chamine, S. (2012). Positive Intelligence. Greenleaf Book Group.

• positiveintelligence.com

• I am a huge fan of Andrew Huberman’s podcast and have referenced it in previous CISO SOS articles. If you want to go deeper on the olfaction science, start with Episode #25 and the Noam Sobel episode.

A jury in Clark County, Washington returned a guilty verdict this week in a case I followed closely. A fire battalion chief strangled his wife in the middle of the night to pursue an extramarital affair, then, in an act of ultimate betrayal, called 911 so his own fire department would help him “save” her.

The evidence was overwhelming. Text messages documenting his plans to leave her the very day she died. iHealth data suggesting a two-hour gap between her death and his emergency call. A medical examiner’s findings of strangulation injuries the defendant tried to explain by blaming his own son.

The presentation of the evidence was masterful. The stunning part of this trial was the protective system that formed around the defendant to preserve the belief that “I did nothing wrong.”

His adult children took the stand and blamed their mother. His son suggested that the massage he’d given her the day before caused the neck injuries—including fatal damage to the carotid sheath. His fiancée—the affair partner—testified that their love was real. The defendant’s family have evem filed a joint defamation lawsuit against a neighbor who questioned the official story. The son now lives with the fiancée, co-signers on the same lease.

The clinical term for the people who protect a narcissist’s false reality is “flying monkeys.” They reinforce the narrative. They attack anyone who questions it. They make the person who sees clearly into the problem.

I watched this trial and had a lightbulb moment that CISOs will recognize.

Read more

“Risk assessment is hooey.”
— Donn Parker, SRI International

I remember how stunned we were when Donn—my colleague and a mentor—said this to the International Information Integrity Institute (I-4) consortium he founded.

The statement was deliberately provocative. And it was prescient.

Donn wasn’t rejecting risk management. He was calling out a pattern we still see today: risk assessments performed without an explicit risk profile. When that happens, assessments create the illusion of rigor without the substance of judgment.

Risk assessment becomes meaningless when it is performed without first deciding what the organization actually cares about.

That critical step is still being skipped.

Executive pull quotes (for skimmers)

• Controls aren’t strategy. Without an explicit risk profile, you can’t explain why a control exists—or whether it’s sufficient for this business.

• Framework alignment is not due diligence. Due diligence is the ability to show informed, business‑specific decisions about material cyber risk.

• If you can’t trace controls to risk drivers, you can’t defend priorities. Budgets, exceptions, and trade‑offs become opinion contests instead of risk decisions.

• Risk appetite belongs to executives. Security can recommend; leadership must explicitly decide what loss, disruption, and exposure the organization will accept.

• “What would it take for this to be true?” is the leadership translation layer. Business goals + risk profile → security intent → controls that enable outcomes.

The Pattern I Keep Seeing

Across industries and maturity levels, I see security programs start in the same place: controls. Tool selection. Framework mapping. Gap assessments. Heat maps built from inherited assumptions. What’s missing is not effort or intent—it’s sequencing.

The most often skipped step is deliberately establishing an enterprise‑specific cybersecurity risk profile before defining or selecting security controls. When that step is skipped, organizations may still “implement NIST,” “align to ISO,” or “map to CIS,” but they struggle to demonstrate why those controls are appropriate, sufficient, or defensible for their business.

This matters—not just for program effectiveness, but for demonstrating due diligence to a defensible standard of care.

What a Risk Profile Actually Is (and Is Not)

A cybersecurity risk profile is not:

• A generic risk register populated with boilerplate threats

• A maturity score or color‑coded heat map

• A list of framework categories marked high/medium/low

• A one‑time artifact produced for audit or compliance purposes

A risk profile is a decision‑shaping construct that sits between business objectives and security execution. It makes explicit the assumptions, constraints, and trade‑offs that leadership is willing to accept in pursuit of those objectives.

At a minimum, a defensible cybersecurity risk profile captures:

• Business objectives and critical outcomes cybersecurity is expected to enable or protect

• Mission‑critical functions and services, and the constellation of assets, processes, and dependencies that support them

• Threat exposure grounded in credible adversaries, not hypothetical worst cases

• Impact tolerance and loss thresholds (financial, operational, safety, legal, and reputational)

• Legal, regulatory, and contractual obligations that constrain acceptable risk

• Risk appetite and tolerance statements articulated by leadership, not inferred by security teams

• Assumptions and constraints, including resourcing realities and business velocity requirements

• Risk ownership and accountability, including where risk is accepted, transferred, or avoided

At its core, a risk profile answers three foundational questions:

1. What must be true for the business to achieve its objectives?

2. What could credibly prevent that from being true?

3. How much residual risk is leadership willing to accept in pursuit of those objectives?

Without these elements, security teams are left to make implicit decisions on behalf of leadership—an arrangement that is neither scalable nor defensible.

How Frameworks Accidentally Encouraged Control‑First Thinking

Standardized frameworks—particularly NIST CSF—were designed to be flexible and risk‑based. In practice, their structure has often encouraged control‑first implementation.

Common failure modes include:

• Starting with the CSF Core and treating it as a checklist

• Performing “Current / Target Profile” exercises without first defining enterprise risk drivers

• Selecting controls to improve maturity scores rather than reduce material risk

The irony is that NIST CSF explicitly expects organizations to establish a risk profile first. Framework Profiles were intended to be derived from business requirements, risk tolerance, and threat context. Instead, many organizations reverse the logic—creating profiles by averaging framework categories rather than anchoring them in business reality.

The result is a program that looks aligned but cannot clearly answer:

• Why these controls exist

• Why they are prioritized this way

• Why they are sufficient—or insufficient—given the organization’s actual risk exposure

From a due‑diligence perspective, that gap is consequential.

Due Diligence Requires Intentionality, Not Just Alignment

Regulators, courts, and plaintiffs are not asking whether you “used a framework.” They are asking whether leadership:

• Understood the organization’s specific risks

• Made informed decisions about managing those risks

• Acted reasonably given what was known—or should have been known

A control set that is not traceable to a clearly articulated risk profile is difficult to defend, especially after an incident.

Establishing the risk profile first creates the evidentiary chain that due diligence depends on:

Business Objectives → Risk Profile → Desired Outcomes → Control Selection → Implementation → Monitoring

Break that chain at the beginning, and everything downstream becomes harder to justify.

Translating Business Goals Into “What Would It Take for This to Be True?”

This is where security leadership earns its seat at the table.

Executives articulate goals in business terms:

• Growth in regulated markets

• Increased digital dependency

• M&A velocity

• Operational resilience

• Brand trust

Security leadership must translate those goals—and the organization’s risk profile—through a lens I refer to as outcome‑based security:

For the business to achieve its objectives, given the stated risk profile, what would have to be true from a security and control perspective?

That translation requires:

• A systems‑level view of internal controls and security, recognizing that siloed controls rarely protect end‑to‑end business outcomes

• A clear understanding of the constellation of assets, processes, and dependencies that enable mission‑critical functions

• A continuous understanding of the threat landscape relevant to those functions

• Explicit clarity on legal, regulatory, and contractual obligations that shape acceptable risk

• Recognition that risk transfer mechanisms (e.g., insurance) may share financial exposure but do not transfer accountability

Only then can controls be intentionally designed as enablers of business outcomes, rather than abstract technical safeguards.

Controls selected without this translation often:

• Create friction where the business needs speed

• Fail to address the threats that actually matter

• Underestimate the compounded risk created by technical debt

• Undervalue the contribution of basic cyber hygiene to achieving business objectives

Making the Risk Profile a First‑Class Artifact

To make the risk profile a durable part of the risk management process, it must be:

• Executive‑owned: Security facilitates; leadership sets risk tolerance

• Explicit: Assumptions, trade‑offs, and constraints are documented

• Traceable: Control decisions map back to risk drivers

• Revisitable: Updated as business strategy, threat landscape, or regulatory conditions change

Practically, this means:

• Establishing the risk profile before control frameworks are mapped

• Using the profile to constrain scope and prioritize effort

• Treating deviations from the profile as conscious risk decisions—not accidents

Frameworks then become what they were meant to be: reference architectures, not substitutes for thinking.

Where This Fits in NIST CSF, ISO, and COSO ERM

NIST Cybersecurity Framework (CSF 1.1 and 2.0)

NIST CSF is frequently mischaracterized as a control framework. It is not. It is a risk‑based framework whose proper use depends on a clearly articulated risk profile.

Relevant elements include:

• Framework Profiles: Intended to reflect business requirements, risk tolerance, and threat context before control selection

• Implementation Tiers: Describe how risk management practices are institutionalized—not control completeness

• CSF 2.0 Govern Function (and CSF 1.1 ID.GV elements): Explicitly anchor cybersecurity priorities in organizational context and risk management strategy

When organizations jump directly to Core mappings or maturity scoring, they invert this logic—treating Profiles as an output of controls rather than an input to control design.

ISO and the 27000 Family

ISO standards are unambiguous about sequencing: context and risk assessment precede control selection.

Key references include:

• ISO/IEC 27001 Clause 4: Understanding the organization and its context

• ISO/IEC 27001 Clause 6: Risk assessment and treatment before selecting controls

• ISO/IEC 27005: Information security risk management, including risk context establishment

• ISO 31000: Enterprise risk management principles emphasizing context, risk criteria, and decision‑making

Annex A controls in ISO/IEC 27001 are explicitly subordinate to risk assessment outcomes. Selecting controls without documented risk context and acceptance criteria is non‑conformant in spirit—and often in fact.

COSO Enterprise Risk Management (ERM)

COSO ERM makes the risk‑profile‑first logic board‑relevant by tying risk directly to strategy and performance:

• Governance and Culture: Board and executive oversight of risk appetite

• Strategy and Objective‑Setting: Risk considered alongside business strategy, not afterward

• Performance: Identification and assessment of risks relative to objectives

Under COSO, risk is the possibility that events will occur and affect the achievement of objectives. Controls are a response—not the starting point.

The Bottom Line

Skipping the risk profile step doesn’t save time—it defers the hardest thinking until after decisions have already been made.

If your goal is to demonstrate due diligence to a defensible standard of care, the question is not:

“Are we aligned to a framework?”

It is:

“Can we clearly explain why these controls exist, for this business, given these risks?”

That explanation starts with a risk profile. Everything else is implementation detail.

If this resonates, future posts will go deeper into how to structure a defensible risk profile, how to operationalize it with ERM, and how this risk‑first logic becomes non‑negotiable in areas like agentic AI and autonomous systems.

If I could speak to my younger self—the one working late nights, collecting certifications, solving impossible problems, contributing to industry groups, and believing competence would eventually speak for itself—this is what I would say.

1. Your expertise is necessary. It is not sufficient.

You will be told—explicitly and implicitly—that if you just get better, smarter, more technical, more prepared, recognition will follow.

That is only partially true.

Technical excellence is the entry ticket, not the differentiator. What separates those who advance from those who stall is not capability, but signal: how your work is interpreted, positioned, and remembered by people who control opportunity.

Learn this early:

• Who sees your work matters more than how perfect it is.

• Being indispensable can quietly make you invisible.

• If you don’t shape the narrative of your contribution, someone else will—and they may not get it right.

This is not vanity. It is professional survival.

2. Visibility is not self-promotion. It is stewardship.

I wasted too much energy resisting visibility because I associated it with ego, politics, or performative leadership. That resistance came at a cost.

Here’s the reframing I wish I’d had sooner:

If your work protects people, systems, and institutions, allowing it to be unseen is not humility—it’s abdication.

Visibility done well is not about being loud. It’s about being legible.

• Translating risk into outcomes others can act on

• Naming tradeoffs before they become crises

• Helping decision-makers understand what “good” actually looks like

If you don’t do this, your work will be misunderstood—or worse, dismissed as overhead.

3. Burnout is not a personal failure. It is a system signal.

Cybersecurity is an adrenaline profession. Crisis response is rewarded. Constant vigilance is normalized. Exhaustion is often mistaken for commitment.

I wish I’d understood sooner that burnout is rarely about weakness. It’s usually about misaligned incentives:

• Too much responsibility, too little authority

• Accountability without protection

• Being expected to absorb risk—organizational, legal, reputational—without support

If you are depleted, don’t ask first, “What’s wrong with me?”
Ask, “What is this system demanding that no one could sustainably give?”

That question changes everything.

4. Ethics will cost you something. Plan accordingly.

There will be moments when you know the “right” answer and feel pressure to soften it, delay it, or bury it. Sometimes the pressure is subtle. Sometimes it’s explicit.

You should know this in advance:

• Ethical leadership is rarely rewarded in real time

• Clarity can make people uncomfortable

• Speaking up may limit your options—temporarily or permanently

This doesn’t mean you shouldn’t do it. It means you should build optionality early:

• Relationships outside your organization

• A reputation that travels

• Skills that translate beyond a single role or title

Integrity is easier to hold when your livelihood isn’t hanging by a thread.

5. Titles end. Identity shouldn’t.

I once believed that becoming a CISO would answer a lot of questions—about credibility, belonging, arrival.

It doesn’t.

Titles are roles you inhabit for a time. If you fuse your identity to one, the exit—whether chosen or forced—can feel disorienting.

I would tell my younger self:

• Build a leadership identity bigger than any one job

• Invest in how you think, not just what you know

• Cultivate purpose that isn’t dependent on organizational permission

Careers are longer than roles. Prepare accordingly.

A final word—especially to women in cyber

If you ever feel like you’re working twice as hard to be seen as half as ready, you’re not imagining it.

That doesn’t mean the answer is to shrink, harden, or disappear.
It means the system is giving you information.

Pay attention to it.
Learn how power actually moves.
Decide—consciously—how you want to engage.

You don’t owe the system your silence.

If you work in a high-stress, high-cognitive-load profession, you already know what it feels like to live in your head.

Long hours of vigilance.
Constant context switching.
An always-on nervous system that rarely gets a true off-ramp.

What’s less obvious is that under sustained stress, the body starts looking for faster ways to regulate than thought alone.

One of those ways is smell.

If you’ve ever encountered a scent that immediately calmed you — or one that made you inexplicably tense — you’ve already experienced this.

For some people, scent isn’t decorative.
It’s orienting.

It places you.
It grounds you by centering you in a place you recognize — through scent.

When fragrance becomes orientation

For people under chronic cognitive stress, fragrance doesn’t unfold slowly or intellectually.

Fragrance arrives, carried on a lifetime of experience and memory — some of it long forgotten.

It can register as:

• a sense of location

• a shift in mood

• a change in breathing

• a recalibration of the nervous system

A forest at dusk.
A sun-warmed desert.
A stone chapel.
An ocean beach at the edge of a rain forest.

This happens before you analyze anything.
Before you identify notes.
Before preference or judgment.

The body answers first

.

When stress amplifies smell

The term super smeller is often used to describe something difficult — even distressing. In clinical and popular discussions, it’s frequently associated with hyperosmia, where heightened smell sensitivity leads to overwhelm, nausea, or aversion to everyday odors.

That experience is real.

But in high-stress environments, something slightly different is often happening.

Sustained vigilance changes sensory processing.
Thresholds lower.
Signals travel faster.
Integration between smell, memory, emotion, and physiology increases.

In this context, heightened smell sensitivity isn’t a party trick or a flaw — it’s often stress-amplified sensory integration.

Because scent connects directly to the limbic system — the brain’s center for memory, emotion, and threat detection — smell can either:

• help the body downshift, or

• push it further into overload.

That’s why some scents feel regulating, while others — even objectively “nice” ones — feel intolerable.

This isn’t about intensity alone.
It’s about how directly scent interfaces with the nervous system.

Why traditional fragrance language often fails stressed systems

The tools most people use to talk about perfume — note pyramids, fragrance families, wheels — describe composition.

They do not describe experience.

They can tell you:

• what materials are present

• how a scent is categorized

• what it resembles historically

They cannot tell you:

• whether your breathing will slow or tighten

• whether your attention will settle or fragment

• whether a scent feels grounding or demanding

• whether your body will relax — or brace

For people managing chronic stress or burnout risk, these distinctions aren’t academic.

They’re foundational.

Fragrance as environment, not performance

For people in high-demand cognitive roles, fragrance rarely functions as a “signature.”

What’s usually being sought — consciously or not — is access to reliable internal states.

This is why I’ve long encouraged the idea of “smell swell smells” — using scent intentionally to support regulation, focus, recovery, and resilience.

Some fragrances feel like places:

• a comforting personal sanctuary

• a pine and spruce forest trail on a hot summer hike

• paddling a kayak across an alpine lake

• a wide, grassy field at the edge of effort and accomplishment

Others register more as states:

• confidence

• coziness

• the energy to do the impossible

• expansion, connection, elevation

For people managing cognitive overload, these aren’t abstract associations.

They are state changes:

• from vigilance to rest

• from fragmentation to coherence

• from alertness to recovery

The impact fragrance has on our internal state has little to do with price, prestige, or whether materials are natural or synthetic.

It has everything to do with how scent interacts with your life experience and neurobiology over time.

This is not a modern invention.
Across cultures and history, fragrance has been used functionally — to calm, to energize, to restore, to prepare — depending on what the moment required.

What’s changed is not the mechanism, but our awareness of how to use it deliberately.

A lineage we’ve mostly forgotten

For most of human history, scent wasn’t fashion.

It was used intentionally for:

• prayer

• healing

• purification

• grief

• devotion

• trance

• marking time and transition

Frankincense, for example, wasn’t valued because it smelled “nice.”
It was used because it reliably produced stillness, reverence, and calm — a somatic state appropriate for devotion and reflection.

Across cultures — in Egypt, India, the Middle East, and East Asia — aromatic materials were selected not for novelty, but for predictable effects on mood, breath, and attention.

These practices weren’t spiritual instead of physiological.
They worked because they shifted state.

Modern perfumery inherited the materials, but largely lost the map.

What remains is beauty — often extraordinary beauty — without shared language for what that beauty does to the nervous system.

Why this conversation is re-emerging now

Interestingly, this body-first understanding of scent is beginning to resurface.

“Functional fragrance,” mood-supporting scents, and nervous-system-aware perfumery are gaining attention — often framed in contemporary scientific language, but echoing ancient practices.

What’s often missing is a coherent experiential framework — a way to talk about these effects without reducing them to marketing claims or vague wellness language.

That gap is where this work lives.

Toward a different map

If you experience fragrance primarily through:

• mood

• memory

• regulation

• orientation

You may already sense that something is missing from the way scent is usually discussed.

What’s needed is a framework that begins not with notes or trends, but with:

• grounding vs. stimulation

• warmth vs. austerity

• enclosure vs. expansion

• human presence vs. elemental scale

Over time, clear patterns emerge — not personal quirks, but archetypal sensory experiences that appear again and again across cultures and rituals.

For example:

• scents that reliably induce inward stillness

• scents that warm and soften emotional states

• scents that expand perception and breath

• scents that purify, clear, or reset

These patterns are what I call The Sacred Ten.

They are not categories of perfume.
They are categories of experience.

What comes next

For people in high-demand professions, regulation tools need to be:

• fast

• reliable

• non-cognitive

• usable without adding effort

In the next essays, I’ll introduce The Sacred Ten: a somatic map of fragrance grounded in ritual history and lived bodily response, designed to sit alongside traditional perfumery frameworks.

If you’ve ever thought:

• this scent feels like a place

• this calms me in a way I can’t explain

• this is beautiful but I can’t live inside it

• I don’t want a signature — I want a way to downshift

You’re not imagining it.

You’re already using scent as a regulation tool.

This series is simply giving that experience a language.

Have you used fragrance to manage your state? I’d love to hear about it in the comments.

Read more

On the eve of the twenty-fourth anniversary of the attacks of September 11, New York City — the very city that bore the wound — has elected a 34-year-old Muslim democratic socialist as its mayor.

Even writing that sentence feels charged. For those of us who lived through that morning, the emotional echo is unmistakable: the skyline, the smoke, the silence that followed. The idea that, a quarter century later, a Muslim would lead this city is both astonishing and, in its own way, profoundly symbolic.

It’s a moment that invites paradox — a signal of resilience and a reminder of fragility.

The Irony We Don’t Know How to Talk About

In quieter moments, I’ve caught myself reflecting on the irony — that this moment arrives exactly on the 24th anniversary of 9/11.

History has a dark sense of symmetry. For many, it’s impossible to separate the word Islam from the trauma of that day. For others, this election marks a powerful step toward healing — proof that an entire faith cannot be held accountable for the acts of extremists.

Both reactions are human. Both contain truth. But our public discourse doesn’t easily allow space for such duality.

As Brené Brown reminds us, “Dehumanizing always starts with language.”
And as psychologist Gad Saad warns, “Unbounded empathy can become suicidal when it blinds us to reality.”

These two truths seem to live in tension — one urging us to soften, the other to steel ourselves. But what if wisdom lies in learning to do both?

The Edge Between Empathy and Discernment

Brown teaches that empathy demands curiosity: staying open when it would be easier to withdraw. Saad reminds us that empathy needs boundaries — otherwise, it can dissolve our capacity for discernment.

In leadership and governance, both qualities are indispensable.

• Empathy keeps us human, preventing fear from metastasizing into hate.

• Discernment keeps us grounded, preventing compassion from drifting into naïveté.

What happens in New York will test our ability to hold both.

For me, this is where values become compass.
As a former chaplain and a Jewish convert, I hold two non-negotiables: compassion and justice.

Compassion without justice becomes sentimentality.
Justice without compassion becomes cruelty.
Leadership — and citizenship — demand both.

They are the two rails on which moral courage travels.

Moral Clarity and the Weight of Words

Words matter. And in moments like this, silence matters too.

The new mayor’s refusal to repudiate chants of “Globalize the Intifada” has left many New Yorkers — myself included — deeply unsettled. Faith leaders such as Rabbi Angela Buchdahl of Central Synagogue and Rabbi Elliot Cosgrove of Park Avenue Synagogue have spoken with courage and grace about their concern, reminding us that empathy does not mean moral confusion.

As a chaplain and as a Jew by choice, I hold compassion and justice as sacred twins.
Compassion calls me to see the human being, while justice calls me to name the harm.

When language carries echoes of violence, silence cannot be neutrality; it becomes consent.

And yet, even here, I return to the paradox: how to hold empathy for the human being while demanding accountability for the words that shape our collective conscience.

Remembering Two Ways

Rabbi Angela Buchdahl recently offered a powerful reminder: the Jewish people are called to two kinds of remembering: we are commanded to remember the Passover — when we were strangers in Egypt — so that compassion and empathy remain at the heart of who we are.
And we are also commanded to remember Amalek — those who attacked the vulnerable from behind — so that justice never sleeps and evil is never normalized.

That tension is not a flaw in the human story; it is the moral design.
Compassion without remembrance of harm becomes naïve.
Justice without remembrance of mercy becomes tyranny.

In these two kinds of remembering, we find the sacred pattern for leadership in every age, especially our own.

When Compassion Becomes Control

The balance between compassion and justice isn’t only a personal moral challenge — it’s a civic one.

We can see this tension playing out right now in Great Britain. In the wake of years of social division —Brexit, pandemic, terrorism, economic strain — lawmakers sought to preserve unity and protect citizens from harm. But in doing so, they’ve edged toward legislating empathy.

Recent laws such as the Online Safety Act and expanded Public Order provisions were designed to curb hate, harassment, and misinformation. Noble aims — and yet their language is so broad that speaking uncomfortable truths, questioning ideology, or even organizing peaceful dissent can now be construed as criminal.

When compassion becomes codified as control, justice begins to falter.
A democracy’s strength lies not only in protecting the vulnerable, but also in protecting the conversation that keeps the system honest. When fear of offense replaces the freedom to engage, the scales tip — empathy becomes sentimentality, and justice loses its feedback loop.

The moral risk isn’t cruelty; it’s brittleness. When dissent is suppressed, empathy itself becomes politicized. The remedy is not to abandon compassion, but to couple it again with accountability, to protect people from harm, not from discomfort.

That is the work of remembering both Egypt and Amalek in the civic sphere: compassion for the stranger, justice against oppression, held in perpetual tension.

Talking Around the Irony

It’s not that we can’t name the irony of this moment — it’s that we must learn how to talk around it, rather than through accusation.

We can say, “This moment carries symbolic weight. It touches unresolved grief.”
We can also say, “This is an opportunity to observe how ideology, identity, and governance intersect in one of the world’s most complex cities.”

Neither statement is racist, just as neither is naïve. They are simply starting points for adult conversation — rooted in compassion for those who feel the ache of history, and justice for those who seek equal footing in the present.

Beyond “Us” and “Them”

Our national immune system has grown hypersensitive to critique. Say too little, and you’re complicit. Say too much, and you’re “othering.” We’ve lost the ability to ask hard questions without being cast as villains.

But mature civic discourse depends on precisely that capacity — to evaluate ideas, policies, and systems without demeaning the people who hold them.

It’s possible to ask:

• What will democratic socialism look like at the scale of New York City’s economy?

• How will this administration navigate pluralism, policing, and public trust?

• How will ideology interface with the city’s institutions, checks, and balances?

These are not questions of fear. They are questions of justice — asked in the spirit of compassion.

Holding the Paradox

For me, this election symbolizes both loss and endurance.
Loss, because 9/11 still lives in our collective nervous system.
Endurance, because democracy, with all its flaws, remains capacious enough to contain contradiction.

Maybe this is what moral maturity looks like in a pluralistic society: we can honor the ghosts of the past while allowing new stories to be written in the same skyline. We can hold the wisdom of both Saad and Brown together without conflict if we build the capacity to hold this in tension: if empathy without discernment can destroy us, then discernment without empathy can dehumanize us.

Compassion and justice — together — offer the middle way. They are the tools that allow us to stay human while staying awake.

An Invitation

We can hold two truths at once.
We can mourn what was lost and still welcome what’s new.
We can question ideology and still affirm humanity.

That’s the narrow bridge we’re being asked to cross — the one that stretches between 2001 and 2025, between fear and hope, between grief and renewal.

If we can walk that bridge together, eyes open, hearts steady, then perhaps the very irony that once stung will become the sign that we are, in fact, healing.

Comments open. Please bring your curiosity, not your certainty.

Just another Tuesday in Iceland. “Just like a day in the life of a CISO,” I thought to myself.

The storm reached its peak as I stood in the spreading gap between the North American and Eurasian continental plates known as the Mid-Atlantic Ridge. It is the source of incredible geologic tension that makes Iceland famous for its volcanic activity, as the plates drift apart at a rate of 2 cm per year. I was in a narrow passage between massive basalt walls at Thingvellir National Park. On this site, the Viking parliament was formed in 930 AD, where laws were decided among chieftains, and capital punishment was carried out for lawbreakers. As the wind screamed down the crevasse where I struggled to stand, I had to grab the railing for stability.

The storm lasted through the next day when we boarded the National Geographic Explorer headed northward. The 15-foot swells would have been a respectable Tuesday morning on Deadliest Catch - not the 60-foot monsters that make captains question their life choices, but severe enough to remind you that the ocean doesn't negotiate. It's that middle ground where experienced CISOs know the real danger isn't the obvious catastrophe that gets everyone's attention, but the 'manageable' crisis that lulls you into thinking you've got it handled. It was a night of faith in our excellent captain and crew as the staff passed out Dramamine and ginger candy to a lot of wide-eyed passengers.

Iceland offers a compelling set of metaphors for the challenges faced by a CISO.

The Grinding Plates of Security Mission and Business Reality

Every CISO lives on a fault line where two massive continental plates grind against each other daily: the relentless pressure to enable business velocity and the immutable need to protect organizational assets. Like the North American and Eurasian plates beneath Iceland, these forces move at different speeds, in different directions, creating constant friction. The business plate pushes forward—faster deployments, cloud migrations, and digital transformation initiatives that can't wait for security reviews. Meanwhile, the security plate moves with geological deliberation through thorough risk assessments, compliance frameworks, and incident response protocols that demand time and attention. Between these grinding forces, CISOs feel every tremor, every shift, every moment when the pressure builds beyond what the bedrock can bear.

When the Pressure Becomes Too Much

The warning signs are always there for those who know how to read them: the hairline cracks in team morale, the subtle slippage in communication between departments, the built-up tension in budget meetings where security investments compete with revenue initiatives. Beneath the surface, molten stress accumulates in the spaces between competing priorities.

A CISO's ability to anticipate and prioritize tectonic-level tension becomes the seismometer, registering every micro-earthquake as stakeholder expectations shift, regulatory requirements evolve, and threat landscapes transform. When the pressure finally exceeds the fault line's capacity—a significant breach, a compliance failure, a budget cut at the worst possible moment—the eruption is violent and transformative. Careers end, teams scatter, and the organizational landscape reshapes itself around the new reality. The question isn't whether the next eruption will come, but whether the CISO has developed the resilience and planning to channel that immense pressure into something constructive rather than destructive.

Now Layer Barometric Chaos unto a Shifting Landscape

CISO expectations swing as wildly as Iceland's weather—one day you're the strategic visionary enabling digital transformation, the next you're the compliance guardian blocking innovation. Suddenly, you're the crisis commander whose every decision gets dissected in the boardroom.

Regulatory requirements shift like storm fronts, bringing new compliance frameworks that arrive with the force of hurricane winds: GDPR's data protection mandates, SOX attestations, an exploding threat landscape, and emerging AI governance rules that didn't exist six months ago. Each change generates its own pressure system, creating updrafts of new requirements that collide with downdrafts of budget constraints. The churn is relentless—security tools that were cutting-edge last year become legacy systems this year, vendor relationships that seemed stable get swept away by acquisition storms, and industry best practices evolve faster than any organization can implement them. Like navigating a ship through constantly shifting weather patterns while the sea floor itself is moving beneath you, CISOs must make critical decisions in conditions where the only constant is change itself. The barometric pressure never stabilizes long enough to catch your breath, let alone plan for what's coming next.

A CISO’s steadiness in the storm, like that of a trusted captain on the bridge, is essential. But as the captain on “Explorer” told us, “You can’t sail a ship without a captain, but the captain cannot sail without a great crew.” No one can handle the storm 24/7/365. From “steady as she goes” to “batten down the hatches”, CISOs need to develop their bench as much as their skills and resilience.

So what’s the key to CISO success? I think we can learn a lesson from the residents of Heimaey, on the Westman Islands.

CISO Resilience: Be Like the Icelanders

Repeatedly, I was impressed by the utter resilience of Icelanders, from the eider duck farmer on Vigur Island in the West Fjords, to the herring girls of years past in Siglufjörður, to the residents of many tiny villages along Iceland’s wild coastline. For CISOs, resilience is embodied in the story of the residents of Heimaey, part of the Vestmannaeyjar (Westman Islands).

In January 1973, in the middle of the night on Heimaey Island, Iceland, a violent volcanic fissure ripped open, spewing columns of fire and lava on the edge of town. The eruption buried homes in tephra and ash, burned others, and threatened their lifeline: the harbor.

It was a geological mother of all breaches - volcano-style.

Volcano was not on anyone’s bingo card. Locals who lived through it say they believed they were safe from eruptions, even though they were located on top of the mid-Atlantic Ridge. A 60-year resident, a former kindergarten teacher, told me that she would walk with her students to the top of an “old and cold” cinder cone near town in the early 1970s and reassured them that it could never happen again.

But it did.

Most of the residents evacuated safely because the entire fishing fleet had put into the harbor the night before because of a strong storm. Those who remained on the island were able to divert the lava from blocking the harbor, their community's lifeline, by constructing a system that kept seawater sprayed directly onto the lava as it advanced. They kept at it for months, working around the clock, and ultimately used 6.2 million tons of seawater to save the harbor. Miraculously, no one was injured although 800 homes were destroyed.

In the end, the lava flowed over a period over 6 months, increasing the island's area by 20% and creating an effective windbreak from the south and east gales that it had not previously had. The citizens worked together to rebuild the town, and Heimaey now boasts about 5,000 residents living in the shadow of two volcanic cinder cones.

What makes this resilience lesson so compelling are these things: the impossible timeline, adaptive strategies, and the engagement of the entire community.

The photos of people handling the hoses as they pour seawater onto the advancing lava starkly highlight their fatigue in the face of a relentless menace of existential proportions. Close enough to the molten inferno to feel the intense heat, they could not afford to let the relentless attacker—the volcano—close in on the “crown jewels” of the island: the harbor. Without the harbor, Heimaey would cease to be viable for human habitation.

The mission was clear, but the tools to fight a live eruption were limited. The residents devised an adaptive strategy and created the necessary infrastructure to deliver massive volumes of seawater continuously to the most significant threats. The mission to save the island’s harbor was clear, but since most of the island's residents had evacuated to Reykjavik via the fishing fleet, the task of fighting the lava was left to a small team.

I imagine there was a command center that kept this intrepid team motivated and mobilized. Patient, consistent, and urgent action, day after day, required a special kind of leadership that could withstand the grinding pressure when the mission was critical to the survival of a way of life.

Tectonic Leadership

This is tectonic leadership - the ability to channel immense geological and atmospheric level pressures into focused, sustained action that protects what matters most. Like the Heimaey residents, CISOs must master three critical capabilities: rapid crisis mobilization when eruptions occur without warning, adaptive strategy development that deploys unconventional solutions against existential threats, and patient coordination of sustained response efforts that may take months to resolve.

One tool in the CISO leadership toolbox is the strategy of demonstrating due diligence to a defensible standard of care. It provides the foundation of adaptive strategies in a chaotic environment, one that serves the mission, focuses on the most critical business imperatives, and optimizes the use of available resources.

Tectonic leadership operates at the intersection of urgency and endurance, innovation and persistence. It's why the best CISOs don't just survive the storms and eruptions - they emerge stronger, with better harbors and more effective windbreaks than they had before. It's why we love this impossible, essential work.

NOTE: This is an edited text of the closing keynote speech I gave recently at Exec.Sec.Con in Houston, Texas.

When I started in cybersecurity as a graduate student in Computer Science, hacking the university mainframe (VAX VMS 4.0, yes I’m a dinosaur) was tacitly encouraged, and hacker was an honorific instead of a dirty word. We had one known virus - the Brain virus that affected Apple machines. Microsoft was still a garage venture. There was no such term as "information security," let alone "cybersecurity," and there were three computer security products on the market: ACF2 and RACF for IBM mainframes, and government-furnished crypto gear.

We've come a long way and we have so much to focus on that is still wrong and even more to think about that can go wrong. In fact, with the state of cybersecurity in play today, I sometimes wonder if we got off on the wrong foot and just stayed there for the last 30+ years.

But today, I want to talk about something even more important than what could go wrong...

Before we go further, let’s take 60 seconds to align on what I mean by empathy, because many people confuse it with sympathy or kindness.”

“Empathy isn’t about feeling sorry for someone. That's sympathy. Empathy is about having the skill to step into their perspective, to feel with them, not for them. It’s seeing the world through their eyes, even if you disagree with their view.”

You might say that empathy is in short supply these days. We'll get to why that is later.

“Brené Brown says: ‘Empathy fuels connection. Sympathy drives disconnection.’ Empathy is a choice to get close, to stay present with someone else’s experience as THEY are experiencing it, especially when it’s messy or uncomfortable.”

Empathy requires us to dig deeply into our own life experience, and to draw upon feelings in order to relate deeply to another person - not to advise, coach or FIX them, but to be present in a way that makes the other feel seen, heard and valued.

In leadership, empathy isn’t soft. It’s strategic. It’s the key to building systems, teams, and technologies that serve people—not just users. It is the ESSENTIAL skill needed to solve very hard problems.

And in an AI-driven world where scale replaces context, that ability to understand—really understand—human experience becomes more valuable than ever.

Outcome-based Security as a Paradigm and a Method

Over the years, I developed a method called “Outcome-based security.”
It’s deceptively simple—like a kitchen remodel. You think: ‘How hard can it be?’ And six months later, you’re eating over the sink with no countertops and two open risk registers, but I digress.

It was created out of necessity in 2002 when AT&T Wireless had to overhaul its entire information security architecture in 10 months as part of the terms and conditions for its hastily designed sale to Cingular.

We were required to pass third party audits prior to closing the $41B cash sale with ZERO DEFICIENCIES in the first year of accelerated filing for Sarbanes Oxley.

No one knew what the rules to pass SOX 404 were. We had to define and design a defensible security strategy, fix all our considerable gaps, document it, and verify it. That meant we had to demonstrate due diligence to a defensible standard of care™️, and it had to be custom-fit to our business model and our materiality threshold, which was a tiny 1% because of the catastrophic losses the company incurred the year before.

It was a death march of a project. And we passed all four external audits with zero deficiencies. So - this methodology slaps.

It has 3 main steps.

Step 1: Embrace the Radical Reality

Get clear, really clear, on the current state of your technology.
Not wishful thinking. Not “aspirational spin.”
Just reality. Or as Ray Dalio calls it: embracing radical reality.

I’ll share a bit about what this was like - AT&T Wireless had grown over the year through acquisitions and mergers. At the start of our overhaul we had:

• 36 different IDAM systems and 9 systems of record

• WAREZ sites running in our data center

• Critical business applications on end-of-life hardware

• Aging operating systems beyond obsolescence

• 60,000 unidentified accounts on mission critical applications

• A recovery point for our data center operations of infinity

And when I would walk around and try to find out where we stood - the teams would try to tell me what they thought I wanted to hear, not what I needed to hear.

It was the basis for our new mantra:

Step 2: Define the Risk Profile

Embracing the radical reality helps you define your business context and identify areas of materiality and potential risk, so you can define the risk profile. This is the process that the ISO standards for risk management require.

It’s more than just technical vulnerabilities. It includes reputation, financial, legal, security, operational, even market and credit risk. This requires alignment across departments—it’s not a solo sport.

This process has been one of the most eye-opening exercises I’ve ever done with companies regarding cybersecurity risk management.

The great news is that you can complete the first draft of the risk profile through the publicly available information for many companies. One thing that the Solar Winds and Uber legal cases made abundantly clear is that we have to align our public-facing statements with our reality. If we put aspirational spin on public websites and don’t have validated controls in place to back up those statements, we’re headed for serious legal exposure.

What’s shocking to me is how few companies apparently do this work to set the foundation for their risk register – they prefer to use a generic framework like NIST or a specific method like CIS RAM or, worse, a maturity model, to jump straight to creating a risk register based on the frameworks’ controls. It’s a little like going into a shoe store and buying size 6.5 shoes because they are the average, even if they don’t fit. The point here is that when you know where you really are and have clarity about materiality and risk, you can take meaningful next steps. Anything else is just guessing and a lot more work in the long run.

Step 3: Declare the Desired Outcome

At AT&T Wireless back in 2003, we were an early filer under the new SOX 404 rules so this, combined with our understanding of our radical reality and our risk profile drove our desired outcome: “All financial transactions contributing to the general ledger must have authenticity, accuracy, availability, and integrity—to within 1% of value.”

Not your typical “security objective,” right? But it worked—because it translated controls into business language, that was relevant and pertinent to our business situation.

Once we know exactly where we stand, and where we need to be (the outcomes), then I ask the question that guides everything:

What would it take, from a security standpoint, to be able to confidently assert that all financial transactions contributing to the general ledger would have authenticity, accuracy, availability, and integrity to within 1% of value? (Confidentiality was not in scope for SOX.)

At a first principles level, it meant that we needed to ensure there was no unauthorized access anywhere in our system from the MTAs to the back office. It meant that we had resilience and business continuity for our revenue-producing systems. It meant that we had to get all our systems and processes to a provably known clean state, validate them through documentation and testing, and keep them there.

We had 10 months to do this.

Choosing our strategic “north star” to guide the program was critical. It had to be defensible to the auditors and potentially to litigators. It had to be clear so that it could be communicated to everyone on the implementation team. It had to be tailored to our specific business model and technology environment. Most importantly, it had to be streamlined down to a program that could be delivered in time for the pre-acquisition audit. If we missed the deadline, it wouldn’t matter how defensible or clear or tailored it was. There was a $41B cash acquisition on the line.

In case you’re wondering we built a custom control design to meet our declared outcomes using CObIT, ISO 27001, and ITIL because they would meet the criteria of defensible. A lot of very smart people worked a very long time to create those standards, and while they set a high bar, they are 100% defensible when used properly.

The proof of our approach was that we delivered a control environment that passed all of the Big Four audits in just 10 months with zero deficiencies. Everyone pulled together, and the senior leadership team gave us crucial “air cover” to get the job done.
It was a once-in-a-lifetime greenfield opportunity, incredibly stressful, and ultimately successful, and it proved an important point: choosing a North Star strategy works.

Why Empathy is Essential

Here’s something I’ve observed—both in corporate life and during my years as a chaplain:

We all dream of a better world.

A better life.
A better job.
A better team.
A better future for our kids.
A better, more humane approach to innovation.
A world where cybercrime isn’t the 3rd largest economy on the planet…

We imagine something brighter… and then we do something strange.

We hit ourselves over the head with the sledgehammer of safety.

We say,

“Nah. That’s not possible.”
“It’s too risky.”
“What if I fail?”

Believe me, I understand what it feels like to have an absolutely audacious goal and go for it, without any guarantee of success. It's terrifying.

Why do we do this to ourselves?

Because it’s vulnerable to imagine greatness.

It opens us up to hope, and nothing exposes us faster than hope.
We are afraid of failure. We are afraid of ridicule and living with the shame we imagine comes from trying and failing.

So we play it safe.

We focus on the obstacles and tell ourselves that our dream is ridiculous and impossible.

We rewrite the story so we’re off the hook.
We settle for what we’ve been handed.

And if someone else steps up to do the job that we dreamed of? We critique them.
We stay in the cheap seats of the Arena and jeer at the one facing the fight of his life.
Or we shower them with SYMPATHY which effectively says, "It SUCKS to be YOU!"

Teddy Roosevelt warned us about this over a century ago in his Man in the Arena speech.

But it’s still safer to be the critic than the one face-down in the dust, fighting for the dream.

Now imagine this:

A future where your organization’s AI strategy is admired, not only for its innovation, but for its humanity:
Where a company’s North Star includes not just profit, but human impact.
Where your team wakes up excited to work on something that matters.
Where your systems aren’t just fast or efficient, but trustworthy and ethical.

Hold that vision in your mind’s eye.

And now ask yourself:

That question—that’s the bridge from radical reality to realizing the dream.

And it’s where we’re headed next as we examine our present radical reality with AI.

Reality Check: The Technology-Human Relationship Today is in Trouble

Before we cross the bridge from today to the realizing the dream of a compelling future, we have to know where we’re starting. Our radical reality.

The truth is, we’re starting in a world that has never been more fractured.

We live in what philosopher Martin Buber called an "I-It" world—where people are treated as means to ends: transactions over relationships. Efficiency over empathy.

Buber contrasted that with "I-Thou" relationships—genuine, mutual, human connections.

That was 1923. A HUNDRED YEARS ago. Fast forward 60 years.

In 1981, philosopher Alasdair MacIntyre wrote in After Virtue that:

“The manager treats ends as given... his concern is with technique, with effectiveness.”

That’s what we’ve done with cybersecurity.

We optimize for technique. Controls. Frameworks. Policies.

We rarely ask: “Is this humane? Is this RIGHT?” We don’t design for people. In fact, many of us are known to refer to human factors in IT as "the weakest link." Personally, I dislike that very much. It was Phil Bandy, one of my Houston colleagues at SRI International who opened my eyes to looking at the human side of computer security very differently.

In 1985, Robert Bellah told us that meaning comes through connection and narrative, not isolated self-creation.

But over the last 40 years, we have kept elevating the “I” and shrinking the “we.”

When Sherry Turkle wrote Alone Together in 2011, she said: “Technology doesn’t just do things for us. It does things to us… changing who we are.”

We connect more than ever, digitally.
And yet we feel more unheard, unseen, and undervalued than ever as human beings.

Reality Check: The AI Chasm

AI has our attention now - and we're looking for what's wrong.

AI isn’t on the horizon anymore – it’s embedded in our systems, from creative tools to our risk models to our code base.

It’s coming with power, promise and problems

On one side of this chasm is our present – and on the other is the future we all want to live in where we have digital connection, technology innovation, and human-centered design.

What’s in the Chasm?

• Hallucinations

• Bias

• Surveillance

• Deepfakes

• Privacy invasions

• Regulatory challenges

AI Legislation and Regulation is Problematic

In 2000, SRI International hosted the Information Security Summit. SRI International, formerly known as Stanford Research Institute, was known as the heartbeat of Silicon Valley for its innovation - like the birth of the Internet, the Mouse, SIRI, EMERALD (Event Monitoring Enabling Responses to Anomalous Live Disturbances), and Bot Hunters among others.

There were luminaries, including the Secretary General of Interpol, the chairman of Bank of America, the president of SRI, government advisors, and Fortune 50 CSOs.

Their message?

“If we collectively don’t get Internet security right, it’s going to be a mess.”

We knew then that we needed to balance the promise of new technology with guardrails to protect humanity.

Fast forward to today. Cybercrime is now the third-largest economy in the world.
We didn’t collectively get it right. The forces behind self-interest won.
We cannot afford to do that again. To avoid it, it will take a very special kind of leadership with a clear North Star strategy.

Between January and March 2025, over 700 state-level legislative proposals on AI were introduced in the US. That’s more than five times the number of privacy laws we’ve seen enacted in the last decade. The adverse impact on interstate commerce of the potential patchwork of State-level AI legislation cannot be underestimated.

The Big Beautiful Bill that is pending before the Senate after passing the House would put a 10-year moratorium on States’ enactment of AI legislation - its drastic and probably necessary at this point.

The Challenge of Ambivalent Self-Interest Complicates AI Governance

And here’s where it gets even trickier…

We’re not just facing a ham-handed regulation and legislation—we’re navigating something far more complex: ambivalent self-interest.”

What do I mean by that? It’s when the same stakeholder—whether it’s a company, a regulator, or even a department—wants two conflicting things at the same time.

Tech companies want the freedom to innovate and the credibility that comes from being seen as ethical.
They want public trust and proprietary dominance.
They want to avoid regulation and be protected from the consequences of bad actors.”

Even inside organizations, you see this.
Product wants speed.
Legal wants safety.
Risk wants proof.
And the board wants quarterly results and zero headlines.

That’s ambivalence. And it’s not malicious—it’s just real.

But here’s the problem: you can’t build truly human-centered technology if the human remains negotiable.

This isn’t just technical.
This is existential.

Choosing a North Star Strategy for AI

Let’s go to a scene you might remember—from Indiana Jones and the Last Crusade.

You are Indiana Jones.
You’ve made it past the blades, the riddles, the ancient traps.

Now you stand at the edge of a chasm.
Before you: fog.
No visible path.
Just… air.

Your organization’s future hangs in the balance.
You’ve been tasked with building an AI strategy that is innovative, resilient, and trusted.

And everything in you—the frameworks, the training, the risk instinct—says:

“Wait until the bridge is visible. Don’t move. Stay safe.”

But something deeper calls you.

Not what you can measure, but what you believe.

You take a breath.
Close your eyes.
Raise your foot…

And step.

Not into chaos or a vacuum

But onto something solid: a bridge that only reveals itself to those brave enough to lead with empathy.

It’s not made of algorithms.
It’s made of moral imagination.
Responsibility.
Human dignity.

And every step forward reveals more of the way.

That, my friends, is what this moment demands.

It’s not a product roadmap.
It’s a leap of faith, with leadership built with empathy.

Leading with Empathy

Here’s five kinds of empathy leaders need right now:

1. Empathy as Moral Imagination

• Envisioning how our decisions affect people we may never meet.

• How will this system impact a family in Mumbai, a teacher in Iowa, or a refugee in Greece?

2. Empathy as Listening

• Creating structures to hear from those unlike ourselves. Not just collecting data about them, but hearing from them.

3. Empathy as Covenant

• Seeing users not as data points, but as full human beings.

• Covenant is not just a philosophy. It’s remembering that every user is someone’s child, partner, and someone who matters."

• Not just personas—persons.

4. Empathy as Responsibility

• Focusing not on what we can build, but on what we should build.

• What serves, not just sells.

5. Empathy as Ethical Limits

• Having the courage to say:

• “We could… but we shouldn’t.”

So what kind of leader takes that step?

Not just a technologist. Not just a policymaker. A leader who sees empathy as a strategic advantage.

Because empathy isn’t soft.
It’s how we translate risk into reality, and innovation into impact by bringing the entire set of stakeholders WITH us because they are seen, heard, and valued.

Human Dignity is the Outcome We Desire

Imagine this:

A world where every technological innovation begins with the question:

“How will this honor and enhance human dignity?”

Rabbi Jonathan Sacks—of blessed memory—warned us about the drift from “we” to “I.” In his final book, Morality: Restoring the Common Good in Divided Times, he wrote:

“A society is strong when we care for the vulnerable.
It becomes weak when we only care for ourselves.”

We’re not trying to blend everyone into beige.
We want technology that honors human uniqueness—our color, our complexity, our character.

Now—a word of caution.

Empathy is powerful. But like any power, it can be misapplied.

Psychologist Gad Saad calls it "suicidal empathy."

It’s when our emotional instinct is manipulated—or misdirected.
When we focus on what feels good instead of what does good.

Examples?

• Prioritizing AI ethics theater over meaningful safeguards.

• Designing hyper-protective systems that limit human agency.

• Mistaking AI for something sentient and worthy of moral status.

Empathy must be wise, grounded, and directed at human flourishing; otherwise, we build systems that feel good but do harm.

Let’s get specific.

It will take:

• Technologists who write empathy into every line of code.

• Business models that reward human-centered design.

• Regulatory frameworks that guide without suffocating.

• Education that builds technical fluency and moral imagination not just for designers and users, but also legislators and regulators..

• Diverse teams that reflect the lives they aim to serve.

• Consumers and citizens who demand tech that respects their dignity—and vote with their wallets.

And above all, it will take leaders like you, who can stand at the edge of that chasm and choose empathy, not fear.

Let me leave you with this:

Empathy is not a compliance requirement.
It’s not a “soft skill.”
It is the invisible bridge between innovation today and impact tomorrow.

Every time you ask,

“What will it take for this to be true?”

And deeply listen for the answer, you are building that bridge.

So I leave you with one question: When you go back to your teams, your boards, your build sprints…

Will you be the one who asks: “How will this honor human dignity? What would it take for that to be true?”

Will you step forward, even if the path isn’t fully visible?

Will you lead, not because it’s safe, but because it’s right?

Because this isn’t just talk.

This is your permission slip to leave the cheap seats, step into the Arena, begin building bridges

And lead with empathy.

Note: This speech is an original work in which AI augmented human creativity in ideation, structure, content and editing.
Images generated with Adobe Firefly via Adobe Stock:
1476634070 by chokdeelaw
1096844924 by withun

I was standing in the oncology center at Virginia Mason hospital in Seattle with my sister, recently diagnosed with stage IV NSCLC, when I got the call from my new supervisor at a global investment firm. He told me my Director of Security and Privacy position was being eliminated in a senior management reorganization. It was rotten timing, but not a surprise—he had been dropping obvious hints for months. The entire IT function was being outsourced to an MSP, and several leaders had already lost their jobs—mine was just the next to fall.

I won’t pretend I was the easiest person to get along with either. There should be recognition and respect for "standing your ground" in cybersecurity roles. But often, there isn’t. And this is where the mental load of a CISO begins.

You see the risk and the exposure tot he company. You know what will happen if data protection problems aren’t addressed appropriately. Yet the business moves on, seemingly oblivious to the risks, focused instead on customer acquisition, growth, and revenue. Wall Street and investors reward these goals, not unseen security risks. If something bad happens after months (or years) of your warnings going unheeded, you’ll be blamed. What’s worse than the blame is the feeling that you failed.

After the layoff, I took time off to care for my mom in her final days. I assumed I would return to my next CISO role afterward. But as months passed, it wasn’t that I couldn’t find a job—it was that I couldn’t even bring myself to consider going back. It felt unbearable. While I wouldn’t call it "burnout," something held me back from even thinking about another CISO role.

Ultimately, a major life change happened. After my 90 year old mother died, instead of returning to cyber, I took a completely different path. I completed 2,000 supervised clinical hours, earned another master’s degree, and eventually served as a Palliative Care Fellow at the VA hospital in Portland, Oregon.

It was here I learned about the moral injury faced by veterans from Operation Iraqi Freedom and Operation Enduring Freedom. The cognitive dissonance between what one is obligated to do and what one believes is right often results in moral injury. Though I don’t pretend to know what it’s like to be a soldier, my experience with veterans facing life-limiting diagnoses revealed something crucial: moral injury also exists in cybersecurity. Guilt, shame, and emotional trauma accumulate, and since we rarely discuss it, we remain silent. This silence adds to the heavy mental load.

I returned to cybersecurity because of this revelation. In hindsight, I saw the strange career diversion into chaplaincy as purposeful. In the chaplain service, there’s a principle called “proximity.” Chaplains don’t wait for soldiers to make an appointment; they sit in the foxhole with them. Cybersecurity, I realized, is my foxhole.

If this resonates with you, know you’re not alone. CISOs often come to me after I speak on handling adversity, starting conversations with: “Thank you. I’ve never told anyone this, but I need to get it off my chest...” Confidentiality agreements and professional integrity keep many of us isolated, silently suffering under the weight of guilt and self-condemnation.

Here’s what I’ve learned:

1. Choices Do Not Define You. The choices you make in a moral dilemma do not define you. You are not "the person who should have done X differently." Most of us, in compromised positions, do the best we can to lead the teams that rely on us.

2. Adversity is the Best Teacher. Tough choices offer clarity with the benefit of hindsight. Reframe past decisions as lessons. Celebrate the wisdom gained, rather than mourning the choices made under duress. As Joseph Campbell's hero's journey illustrates, every obstacle prepares us for what's ahead.

3. Complexity Prevents Total Clarity. We live in volatile, uncertain, complex, and ambiguous (VUCA) times. We make decisions with the best available information, and hindsight often clouds our perspective. Don’t Monday-morning quarterback your decisions—or anyone else’s.

4. Embrace Hope. Hope comes from learning what works and what doesn’t. As Thomas Edison famously said, "I didn't fail. I found 10,000 ways that didn't work."

5. A Diversion is Not an Ending. If you feel the need to step away, do it. It’s not the end; it's the next stage in your journey. It’s part of your "brutiful" adventure (credit to Glennon Doyle for that word).

When I returned to cyber after five years in chaplaincy, I tackled two major issues: why women were leaving the tech community in droves, and cyber professional burnout. This led to the creation of two programs: MOJO Maker for Womxn in Tech and Flameproof®. Both have helped many cyber and software professionals.

Today, my sister is thriving—no evidence of disease. And 99% of the time, I can put what were excruciating moments as a CISO into perspective.

I’d love to hear your experiences, in confidence. You can reach out to me at karen@wriskgroupllc.com

.

Ransomware is not the problem.

It is just one symptom of the problem.

Why is it so important to make this distinction?

Keith Cunningham, author of The Road Less Stupid: Advice from the Chairman of the Board quotes Peter Drucker: “Most serious mistakes are not being made as a result of wrong answers.  The truly dangerous thing is asking the wrong question.”  Have we been chasing the wrong problem in cybersecurity?   I think so.  In this post, I hope to show that by distinguishing symptoms from root problems, business leaders can take meaningful and effective steps to strengthen their organizations' cyber resilience and minimize losses from ransomware.

We must urgently understand the root cause of our insecurity

It is essential that we, as business and cyber leaders, understand the true problem we are facing before we invest time and hundreds of thousands, if not millions, of dollars chasing solutions that won’t help us get where we need to be. When we focus on ransomware as the problem instead of understanding it as the symptom, we overlook the foundation of cyber-hygiene and secure software development practices hoping for a silver-bullet solution to cybercrime. As installing a steel door on a grass shack fails to address the structure's fundamental weakness, investing in advanced cybersecurity solutions without addressing underlying technical debt is ultimately ineffective. 

Is technical debt the root cause?

The steel door analogy extends across technology, not just to cybercrime.  In “Technical Debt Might be Hindering Your Digital Transformation” (MITSloan Management Review Fall 2018) the authors note that “the entire C-suite, including the CEO, now recognizes technical debt as not just a technical problem but an obstacle to progress on many fronts.”  Some of those fronts noted include severe limitations on IT’s ability to innovate, limitations on migration to new technologies, and restricted responsiveness to changes in the marketplace.

All of those limitations also have direct impacts on companies’ ability to keep pace with the exploding economy of cybercrime, projected by Cybercrime magazine to reach $10.5T in 2025 - the third largest economy in the world and a major source of wealth transfer to forces with a vested interest in undermining Western society.  One might argue that the accumulation of technical debt has become our greatest security weakness - our Problem #1 -  and it shows up in two ways: unpatched vulnerabilities in enterprise software, and vulnerabilities in poor cyber hygiene.

To illustrate, let’s touch on several of the significant cybersecurity incidents over the last five years:

Equifax Data Breach (2017) - an exploit of CVE-2017-5638 affecting Apache Struts resulted in the exposure of highly sensitive information of 148M customers in the US and Canada.  The vulnerability was disclosed with a patch in March 2017, but this server remained unpatched.  See analysis here.  The breach exposed highly sensitive personal information of close to 148M individuals.

Marriott International (2018) - this breach began at Starwood in 2014 as an installation of malware in the Starwood reservation system (serving hotel brands like W, Westin and Sheraton) and was ongoing, undetected, for years until after the Marriott acquisition when it was disclosed by Marriott.  It compromised data of 500M customers, including 5.25 million unencrypted passport numbers and thousands of unencrypted credit card numbers.  The duration and  impact of the breach is attributed to “poor data management policies at Starwood and Marriott.”  Costs related to this breach reached $72M.

Solarwinds (2020) - the Solarwinds breach by Nobelium is the subject of a pending SEC enforcement action.  In its amended complaint, the SEC alleges that internal controls within Solarwinds were known to be inadequate in several areas and the company’s records reflect that the decision was made not to remediate those deficiencies (as measured against the NIST Cybersecurity Framework), even while the company led customers and investors to believe otherwise. The costs resulting from the attack are estimated at $100B and affected approximately 18,000 government and Fortune 500 customers

Kaseya (2021) - Kaseya was attacked through a zero-day vulnerability,  CVE 2021-30116, within Kaseya VSA IT management servers.  The attack impacted up to 1,500 businesses globally across diverse sectors including finance, travel and leisure.  Ransomware demand: $70M.

Colonial Pipeline (2021) - the hack began through credential stuffing, using a previously compromised account name and password for VPN access.  This led to the shutdown of the largest fuel pipeline in the US and resulted in a ransomware payment of $4.4M.

Microsoft Exchange Server (2021) - four zero day exploits that had been the Exchange code base for nearly a decade were exploited.  An estimated 250,000 Exchange servers were affected.

MOVEIt File Transfer Exploitation (2023) - the MOVEIt attack was the result of a zero-day software vulnerability within the MOVEit Transfer software and allowed the cybercriminals access to sensitive information of an estimated 94M individuals that were transferred using the software.  This was then the basis of extortion against the more than 2,700 companies that were custodians of the sensitive information that had been breached.  The financial impact of this cascading supply chain breach is difficult to calculate, although using the IBM cost of a breach method of $165 per record, one vendor suggests the cost is well over $15B.

23andMe Data Breach (2023) - 23andMe has stated that the breach resulted from credential stuffing - effectively users who re-used passwords and account names on their multiple accounts, some of which had been compromised previously.   

MGM (2023)—According to recent reports, the attack against MGM was a social engineering attack involving a phone call to the help desk for a credential reset on an account that belonged to a super-admin with elevated access “across MGM systems.”

Microsoft (2024) - a password spray attack against a legacy test tenant account was successful, followed by identifying and compromising a legacy test OAuth application with elevated access to the Microsoft production environment.  A series of steps by the attackers (Nobelium) eventually gained privileged access to corporate email servers allowing access to the content of executive emails.

The root of our insecurity: ineffective cybersecurity risk management

From this cursory overview, software flaws, some decades old, and poor control design/maintenance are the two fundamental vulnerabilities in our digital footprint.  I’m suggesting that we stop speaking of nation-state actors and ransomware as the fundamental problem and focus on the root problem, the fix for which is within our control: failure to manage cyber risk to a reasonable level, which includes, but is not limited to, retirement and prevention of technical debt.

This is an entrenched but solvable problem: executive accountability and governance of the security of the digital footprint, whether public or private sector, must be done to balance the cost of cybersecurity controls against the harm that others experience due to the lack of proper controls.  In other words, we need security that incorporates duty of care, is right-sized for the business, and is governed by the executive team that has both the accountability and authority to make sure they can demonstrate due diligence to a defensible standard of care.  Resources may need to be diverted over some time to do so.

Reasonable is the term that came into common usage in cybersecurity policies to provide a legitimized form of risk acceptance when management deemed controls out of alignment with business objectives.  It became the means for software executives to “ship first and see what breaks”.  It became the means for executives whose software is critical in our supply chain to defer remediation of serious control deficiencies.  It also served executives who wished to accept risk instead of ensuring resources were allocated to security. It served the business, even when the resulting lack of control left the company vulnerable to attacks that could harm millions.

The technical debt MITSloan referred to above is used for the control gaps left in place in software and infrastructure when deployments leave “should have fixed” controls on the table because management accepted the risk.

Technical debt is what naturally occurs at the speed of business.  The demands of competitiveness and the drive to meet rapidly evolving customer desires often come at the expense of tending to technical details.  The intention to address technical debt at some future point is generally replaced by a desire to implement bright, shiny new features when that future point comes.  The accumulation of technical debt includes deferred maintenance on vulnerability management, hardware upgrades, routine maintenance, operating system updates, software bugs, technical contract reviews to ensure services meet business needs, and refreshed operating procedures.

Of the incidents described above, most, if not all, are the result of technical debt.

When is technical debt unreasonable from a risk management perspective?

At what point does technical debt become an unreasonable burden on a company's cyber security controls?

The failure to address technical debt and the security vulnerabilities it creates arguably becomes negligent at the point where the burden to address the control is less than the harm that the exploitation of that control would cause to interested parties such as supply chain partners, individuals, investors, and shareholders. See The Sedona Conference Commentary on a Reasonable Security Test (22 Sedona conf. J. 345 (2021).

This holds software vendors who supply software upon which millions of people and thousands of companies rely and have billions of dollars in reserve to a very high bar of what constitutes “reasonable.” On the other end of the spectrum, small and medium-sized businesses are held to a different bar because their resource capabilities for security are less by orders of magnitude.

Goldilocks Security

Reasonable security is Goldilocks Security - where the controls are just the right balance between too much burden on the company and too little protection for the company and all its interested parties.  Not too much, not too little - it is just right.

This year will be the year of Reasonable Security. Companies that can describe their cyber risk management regarding reasonable security in their 10-K will fare better than those that cannot. The real work doesn’t end there, though—the real work ensures that the statements in the 10-K are not aspirational but backed by auditable evidence that the controls are necessary and sufficient and are effective 100% of the time. The time to understand and implement this security strategy was yesterday.

What Can Companies Do Now?

The SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rule is a gift.  It sets forth expectations for SEC registrants to embrace cyber risk management as any other form.  It cannot be delegated to a CISO, who often has accountability and no authority; the buck stops with the CEO.  The expectation of board-level oversight should result in boards allocating more attention to cybersecurity and technology risk management and in learning to ask the important questions to hold executive management accountable.

The role of the CISO must change.  CISOs who are ready for the seat at the table of the C-suite will be valued advisors and strategists as the executive team assumes their accountability for ensuring cyber security is right-sized for the company and that the strategy of reasonable risk is implemented.  CISOs who rose to the job through technical ranks will need to shift their mindset from incident detection and response to demonstrating due diligence to a defensible standard of care (of which incident detection and response and threat hunting are a part).

Companies can take steps to have a facilitated tabletop to help them understand and refocus on what it means to demonstrate due diligence to a defensible standard of care in their risk management.

Understand the duty of care in cyber risk management by incorporating the DOCRA standard into risk management practices.  (See docra.org).

It is long past due to bring cyber risk management to a defensible standard of “reasonable” and handle it like other areas of risk management. The benefits of doing so are numerous. Smart leaders will get ahead of the curve on cyber risk management best practices now.

Words matter.

It seems so obvious to say that; it should go without saying.

Even in the ancient Wisdom texts: God said... and there was.  There is no more powerful statement of the energy with which words are imbued.  Reality is created by the power of word.  Societies are governed by the power of word.  Our understanding is limited by our lack of vocabulary and expanded by learning new words.  We can even manage our emotional state by the words we use that reflect whether we are a victim or empowered, whether the glass is half-full or half-empty.

Individual words by themselves carry energy:

• holocaust, annihilation, terror

• fraud, embezzle, crime

• sparkle, delight, joy

• smear, defile, malign

This energy gets compounded when we put words together in certain ways convey story. Story is the most influential means of communication between humans for as long as we've existed.  Story is the conveyance of oral tradition, meaning, belief, and values.  More than the conveyance of "how", story is the conveyance of "why". I was struck by this recently as I read one person's account of an event that read:

"As the two leaders sat together, one proudly showed the other a copy of a message where a speaker declined an invitation to speak."

Another version of the same event, more neutral:

"As the two leaders sat together, one showed the other a copy of a message where a speaker declined an invitation to speak."

And a third version:

"As the two leaders sat together, one sadly showed the other a copy of a message where a speaker declined an invitation to speak."

One adverb changes everything in the meaning and story around this snippet of information.

In this digital world, communications now have the capacity to spread subjective opinion, disinformation, and damaging gossip around the world "before the truth has a chance to put its boots on".

Back in the late 1990s an esteemed colleague of mine at SRI International investigated the underlying reasons why phishing campaigns always work.  Phil Bandy found that humans are hard-wired to respond to urgency and problems.  Put the two together and you have the recipe of every phishing email every constructed.  It is the reason that malware is so difficult to combat.

Motive adds another dimension.  When human ego is in charge of meaning making, the motive behind the story becomes a part of the story itself.  It's always tricky when ego takes charge of the stories we tell.  Ego drives motive - to create story for the purpose of self is to create stories with a purpose of financial or social gain, even at the expense of the status and well-being of other people.

We've all encountered the co-worker who erroneously tries to build their own image by diminishing the image of others.  This is the destructive work of ego.

Ego is the "I" or self.  It is the source of our self-importance.  It is "the part of the mind that mediates between the conscious and the unconscious and is responsible for reality testing and a sense of personal identity".  (Oxford Dictionary).

When ego is dominant it is called egocentrism.  Egocentrism refers to someone's inability to understand that another person's view or opinion may be different than their own. A recent Forbes article   describes the difficulty of such a co-worker:

"When you are working with someone who is egocentric, they live in a bubble of belief that their ideas and paths are the best, because they think they are the best. Any challenges to their ideas threaten their self-perspective, and it is difficult to get them to be open and listen to other viewpoints. They lack a willingness to even brainstorm ideas outside of their own. The bottom line is that they are unwilling to listen to others."

"Egocentrism represents a cognitive bias, in that someone would assume that others share the same perspective as they do, unable to imagine that other people would have a perception of their own".

This cognitive bias is capable of producing very believable, but false, narratives. Our online world seems to be overflowing with them and the destructive potential of such narratives is immense, ranging from the anti-semitic blood libels that have persisted for millennia, to cybercrime whaling campaigns, fraudulent investment schemes, to defamation and character assassination.

The astute individual will always be on the lookout for communications that appear to be driven by ego.

Based on personal observations, here are five indicators to watch for in every form of electronic communication:

1. Is there an appeal to your sympathy - an emotional hook to pull you into the narrative?

2. Is it urgent?  Is this represented as a matter that requires your immediate attention?

3. Is there a "villain" in the form of an institution, circumstance, or person?  Is there a victim?

4. Are you being asked to help solve the sender's  problem in some way?

5. Is there the potential of a false dichotomy as the narrative is presented?

Today, ego is automated in the form of trolls and bots adding to the volume and complexity of online discourse.

Whether human or artificial, communication based on ego is never in the best interest of anyone except the sender's.  Be on the watch for it and exercise healthy skepticism.  Don't be manipulated to engage at any level, and never click on a link provided in such a communication.

I'd love to hear your feedback.

Be well

Karen

Queue: The Clash

Should I stay or should I go?  It’s a question for CISOs and, to be honest, for cyber professionals at various levels of the organization.  

Taryn Plumb wrote for SDX Central last May, "The Great CISO Resignation: Why Security Leaders are Quitting in Droves.". Her article cited a lack of work-life balance and too much firefighting as contributing factors.

The pressure of new legal and regulatory expectations and the unfortunate process of "pillorying, humiliating, and terminating" any CISO that experiences a major security breach or disclosure on their watch isn't making it any easier.  The indictment and conviction of Joe Sullivan, the decision to become a federal whistleblower by Peter "Mudge" Zatko,  and the recent SEC action against Tim Brown have the industry reeling.

CISOs are playing an increasingly high-stakes game; apparently, many are not sure it's worth it.

Hopefully, I'm taking an accurate pulse of the industry as I touch on two aspects of the evolving role of the CISO and what they mean for CISOs’ well-being.    Those two aspects are victimhood and happiness.  They are very much related.

Agency, Cynicism, and Victimhood Mentality

It's reasonable for security pros to take stock of the career expectations and the risk-reward equation - as long as they recognize they retain agency to decide what makes sense personally and professionally.  

Why agency?  When we believe we have the power to make a difference, we have a powerful antidote against one of the most insidious elements of burnout: cynicism.  According to Arthur Brooks, we have hope when we combine that power with motivation.  He writes, “In one study, researchers defining hope as “having the will and finding the way” found that high-hope employees are 28 percent more likely to be successful at work and 44 percent more likely to enjoy good health and well-being.”(1)

The absence of hope leads to cynicism.  The seeds of cynicism are planted as an adaptation to past disappointments - it is the defensive play of having low expectations of others so you won’t get disappointed. It is a response to a victim mentality.  Cynicism becomes an irrational belief that others are not up to the task, don’t know what they are doing, and are only in the game for themselves.

However, according to the Center for Ethical Leadership, cynicism harms your career in two ways:  it has a measurable drag on compensation and affects your trajectory of success.

So not only do you feel worse, it will impact your career.

What does this have to do with CISOs at victims?  Just as agency is the belief and motivation that one can make a positive difference, cynicism is the tendency to have an external locus of control.  From a career perspective, that translates into the belief that one’s career is “entirely under the control of forces outside one’s self, such as fate, luck, or the mercy of other people.”(2)

As a CISO, it is incredibly important for you to bring that locus of control back inside and do whatever is necessary to reinforce your belief in your agency.  It may be useful to work with a trusted advisor or coach who can help with objectivity as you sort out your beliefs about your current situation at work.  Check your cynicism.  If that’s a problem for you, the first step is to recognize it is a problem.  Cynicism is a mind virus - not only will it affect you, but it will affect everyone around you. It is a killer of innovation and creativity.  Make a plan to challenge yourself when it comes to your negative thoughts.  More than likely, your negative thoughts come out in your language.  Find someone you trust to help you become aware of how your beliefs are expressed in your chosen words.  Choose positivity.  

I’ve used a fantastic book in my coaching programs by Shirzad Chamine: Positive Intelligence: Why Only 20% of Teams and Individuals Achieve Their True Potential and How You Can Achieve Yours.  It dives into the emotional intelligence we all need with some very practical applications to interrupt the inner stories that keep cynics locked in a downward spiral.  TL;DR, his TedX Talk is here

So, if I tackle cynicism and agency, will I be happy?  Is CISO Happiness an actual thing for readers of CISO SOS?

The Happiness Formula:  Enjoyment, Satisfaction and Meaning

This is where Arthur Brook’s work will help.  I first encountered him on the DOAC podcast with Steven Bartlett.  There are three fundamentals, according to Brooks, for happiness.  They are Enjoyment, Satisfaction, and Meaning.  From my perspective as a serial CISO, I’ll give my take on this, although it is just scratching the surface, so I encourage you to read his books and listen to his material to make your own strategy:

Enjoyment is not the same as pleasure.  Pleasure is simply the tapping of our limbic system for a dopamine hit. It’s addictive and something that happens to you, according to Brooks.  Enjoyment is elective, takes effort, and involves creating memories and other people (which is NOT your audience on Discord, Instagram, TikTok…).  We get enjoyment from our community, from connection with co-workers and friends in the workplace, and, at cons, from long talks over shared meals and from fun shared experiences.  

Satisfaction is that sense we have after we successfully complete a project after a struggle.  Happiness requires struggle and even a certain amount of suffering.  Those ridiculously tough demands for compliance with SEC rules?  The sense of satisfaction from figuring that problem out for your company, in collaboration with others, and seeing a massive project to completion that you thought was impossible is a requirement for happiness.

Meaningful work - work that helps us grow and contributes to the greater good is the third element required for CISO happiness.  Most of us are in this game to make a difference and shift the status quo against cybercrime.  We have the opportunity for huge meaning and purpose in our cyber roles.  

If this is the formula, why aren’t we happy, and why do we want to leave?

The Struggle is Real - and That’s Where the Happy Is

Let’s say you are in your cyber leadership role; you really want to stay there, but you’re not sure you can make it work.  Try this unscientific self-assessment by measuring the following on a scale of 1-10 (with 10 being high).  There’s no right or wrong answer, this is just a set of questions to help you get in touch with your reality:

1. What is your agency - what is your belief that you can figure it out and make it work?

2. What is your victim mentality as evidenced by the thoughts in the words you use?

3. Do you have more opportunities or more problems?

4. What do you enjoy and do you have the opportunity for enjoyment?

5. What gives you satisfaction in your work?

6. How would you assess the meaningfulness of your work?

As you look over your responses, get curious about why you answered the way you did.  I’d be interested in what aha moments, if any, this created for you.

The good news is this: the process of the struggle is part of what makes us happy.  If you see things you need to change, consider evaluating what it is in your value system that tells you they need to change.  Commit to aligning what you do with what you believe and strive for consistency.  That, according to Brooks, is another contributor to your happiness.

Should I stay or should I go?

Finally - there does come a time when moving on makes the most sense.  Steven Bartlett’s book The Diary of a CEO gave me a framework in the model of “five buckets.” He writes: 

“When you’re seeking employment, selecting the next book you want to read or deciding what dream to pursue, you must be aware of how full your buckets are. 

1. What you know (your knowledge) 

2. What you can do (your skills) 

3. Who you know (your network) 

4. What you have (your resources) 

5. What the world thinks of you (your reputation)”(3)

He suggests that our goal should be to have these buckets full so that we can maximize our contribution to the world.

Considering your current position, how does it contribute to these five buckets?  I submit to you that our professional work in cybersecurity, whether we are a cyber strategist, CISO, or aspiring CISO, should allow us to pour into all five significantly.  

When a position only contributes to one bucket, say resources, but not to the other four in a meaningful way, try to fix the imbalance.  If that imbalance is persistent, it should indicate that it is time to move on.  Don’t let yourself be handcuffed in a way that holds you back from making your contribution. That’s my metric - your mileage may vary.

Ultimately, my hope for all of you who pour so much of yourselves into the cybersecurity community is that you will find happiness, your five buckets will be full, and you’ll be a positive influence in your organization, your social circle, friends/family, and community.

The changes in regulatory and threat landscapes, the global geopolitical dynamics, the business climate - all of these things make our role extremely challenging.  We need you “in the game” more than ever.   With these insights, I hope you are encouraged to find your agency and your happiness, get out there, and figure it out.  #noVictimCISOs

(1) Brooks, Arthur C.; Winfrey, Oprah. Build the Life You Want (p. 64). Penguin Publishing Group. Kindle Edition.

(2) “Unraveling the Mindset of Victimhood” in SA Mind Vol. 31 No. 5 (September 2020), p. 14 and online https://www.scientificamerican.com/article/unraveling-the-mindset-of-victimhood/

(3) Bartlett, Steven. The Diary of a CEO (p. 9). Penguin Publishing Group. Kindle Edition.

"As a little visitor told me the other day, ‘Now I am going to tell you something.’   

Do you remember when I was at your house, you had a broad-leafed plant with red flowers in the yard that you called Day Lily (I have learned since it is a Canna)?  Well, I saved seed of it and planted them eight years ago last Spring, but like many others they refused to grow.

Soon after followed years of my ill health and the flower bed was neglected until the native grafts took possession [of the shrubs].  My poor struggling rose bushes looked forlorn after almost everything else had been chocked to death.  So, last Spring, John said he was going to plow it up.  We dug out and reset what was left.  He plowed it deep and then cut it with a disk harrow until it was fine enough for hash.  Several weeks after, looking over the ground, imagine my surprise to find two nice little Canna plants.  I gave one away, the other I have in the house.  It has bloomed and it's the same as yours!  Just think, it took eight years to sprout, and not only it, but lots of other flowers that we had not had for years sent up nice seedlings.

I have been comparing the old flower bed to some of us poor human specimens, who sometimes need something awful to overtake us, something that will upset all our plans and cut us to pieces, generally, to bring out the best there is in us.  The same process that killed the weeds and burs brought to the surface the flowers that no one dreamed was there.

My flower bed now is a single row running around three sides of the yard and I still have my 1/2 circle north of the house.  It was full to overflowing all last summer.  I took over 60 plants in the house this Fall.

"

I loved that Great-Great Aunt Samantha found a metaphor for life in her garden and that I had the honor of being the recipient of boxes of old family letters, including this one from 128 years ago, so I could read it in her own handwriting.

It resonated with me because I've written a lot about burnout in the past and have both hosted and been a guest on multiple podcasts on the topic.  We have dreams and aspirations and it does seem that, like those Canna Lily seeds, they just get buried without any sign of flowering into reality.  It would be fair after years to assume that they aren't ever going to bear fruit and to give up.  That's exactly what many people do.

Now I'm going to tell you something.  Just when it gets dark is not the time to give up. It is never time to give up.

The incredible advantage I have when reading and transcribing all these letters from as long ago as the Civil War is that I have the benefit of hindsight.  I can see the flowering of the efforts of the pioneers, the tinkerers, the soldiers and their widows, and the farmers who often had nothing but hope to keep them going.  They believed then that hard work would matter, if not tomorrow, then someday.   They could not have dreamed of what would accrue to their grandchildren and great-grandchildren in just twelve decades.

As Steve Jobs would say, I can look back and "connect the dots".  I am filled with admiration for the hard-scrabble life of immigrants (some here by choice, some by necessity, and some by force) and as well as indigenous people who were occupied with the necessities of existence and fortified by relationships of community, tribe, and family.  Life did not often go their way and yet, they persevered.

I'm able to sit comfortably in a centrally heated house while the Colorado temps dip below zero and step back into time as I read the newsy accounts of family letters and even letters to the editor.  One of those was particularly poignant, written in 1931 in response to then President Herbert Hoovers conference in Washington DC on housing were the words of my grandfather.

"I spent the early years of life getting an education to fit me for an independent career where I could do my own thinking and planning and succeed (as I thought) in proportion to how well that was accomplished.  For some years thereafter I struggled along with varying degrees of success but always with hope.  Hope that there were better things ahead, and when a competence for old age seemed almost within my grasp, and it suddenly vanished, I still fought on, spurred by the thought of how nearly I had succeeded and hoping next time would be better.

But today, I am just one of the multitude that has been forced by economic pressure to accept a position with a big corporation where my identity is completely lost and where the profits if any from extra mental effort, must accrue to the company.

It is not the work, but the fact that I am only a part of a monotonous process, with the only prospect to look forward to that of losing my job and being turned out with my family to suffer.  That is what takes the heart out of me.

If I should quit and go elsewhere to look for work it would only be to implore the favor of some other big corporation that would have no more concern for my welfare than this one."

How familiar does that sound to thousands of software engineers and security professionals experiencing layoffs in the Tech sector right now?

The greatest wisdom book of all time says this: "Hope deferred makes the heart sick."

Hope is the essential elemental difference between simply waiting and anticipation.  As the world came to a stand still during the COVID lockdown and pandemic, we experienced the loss of anticipation and it wasn't until I read this letter that I realized it was also the erosion of hope. As we waited - and waited - to reunite with loved ones, to travel, to experience celebration in community again, we were unable to anticipate when it would all come to an end.   There was a sense that we were being forced to give up hope.

At the end of the pandemic, we felt more burned out than ever.

Sources vary, but statistics indicate that anywhere between 66% and 87% of the workforce self-identifies as burned out since the pandemic.  That is even with the hybrid work accommodations that would seem to make things at least a little more flexible, particularly as services like day-care and schools opened up again.  So why are we still feeling such a burden?

Hope deferred makes the heart sick.

The WHO defines burnout as a syndrome that results from unmitigated workplace stress.  The elements of burnout include emotional and physical exhaustion, cynicism, and a sense of futility and meaninglessness.

There is certainly a significant element of that in our work but most of us aren't experiencing clinical Burnout.  As my grandfather wrote in the editorial, "it isn't the work.". We love our profession.

The problem is something else: we need to find hope again.

There is another evil twin to burnout and depression called Acedia.   That archaic word fell out of usage in the Oxford dictionary until recently.  Some think that the reintroduction of the word Acedia into common usage is a reflection of a social trend.  I think this calls for some curiosity and exploration.

The ancients recognized a pattern of behavior that they named Acedia as a level of disengagement from life, from joy, from gratitude - from anticipation of a better day.  It was such a concern that they considered it to be one of the seven deadly sins - right behind #1 which was avarice. It is as if your soul's song goes silent.  The great psychoanalyst Carl Jung spoke of it as soul death.

Could it really be that the plague affecting all of us is not so much the job as it is the loss of hope?  If so, the good news is that it should be within our personal control to regain and rebuild hope - it certainly isn't going to be handed to us from anyone else.

And now, I'm going to tell you a story.

As a chaplain trainee working in a regional medical center, I was called to the medical floor for an octogenarian who was experiencing uncontrolled pain even though she was on the maximum dosage of pain management therapies.  She had been admitted for a fractured hip and although it was healing, her pain was unremitting and unexplainable.  The attending physician requested a chaplain since the severe pain seemed to have no physical cause.

I sat beside and let her talk.

As a five year old in eastern Europe, she had witnessed her mother being gassed in one of the killing vans.  She somehow survived incarceration in various concentration camps and was a teenager during the forced marched when the Soviet army advanced towards liberation of the camps.  She survived a brutal rape when the Soviet soldiers found the young girls in the woods. She remembered hiding in the basement during the bombing of Dresden.  She was in Nuremberg when she met and married a US soldier.  They had one child.  Her PTSD was so severe that when she heard noises at night she would snatch her infant daughter from the crib and hide together under the bed.

And she had never told anyone.

Her extreme pain was price she paid for shame she carried that grew in silence.  She had internalized the rage and brutality of a savage genocide and war from the perspective of a child.

Slowly, over the course of days, we documented her narrative.  I brought in the local holocaust studies team who assured her that her message would help so many others who had experienced similar trauma.  She reframed her shame into a mission.  To the relief of us all, her pain level reduced, she was taken off her prescription pain treatment that kept her hospitalized and she was discharged to a care facility where she recuperated.  I treasure the picture of the day we held her birthday party and she beamed with joy.  She talked of her plans for the future with the new friends she had made at the long term care facility.  She was no longer simply existing; she was anticipating, and she was blooming.

Rose found hope again.

Is your hope growing dim or even extinguished?

When we are living in a world that is aflame, and when our vocation is affected by uncertainty, we have to recognize the impact that has on hope.  You may be affected if you find yourself wondering if all the effort of living is worth it or you find yourself with cynical thoughts.

In a world that competes for our attention aggressively, and says "care about this and this and THIS" we have to pull our hand back, put it over our heart, and say, "I will care about THIS."

There is a huge sign on one wall of my office quoting Pablo Casals:

"The child must know that he is a miracle, that since the beginning of the world there hasn’t been, and until the end of the world will not be, another child like him.”

You don't have the benefit of hindsight for all that it swirling about you right now.  But I believe that Casals' wise words tell us that every life has a mission and a sacred purpose.  Like the seeds of a Canna Lily plowed under in a field in Kansas, there will be a blooming, but first that hard dry seed has to fall apart, alone, in the dark.

Hal Elrod's book, Miracle Morning was a huge inspiration for me at a particularly lonely and dark time.  I had to take action in order to bring hope back after a devastating loss that pretty much changed the landscape of my life.

This is what I did: I started the day to nurture my soul (even if my mind protested).  We live within a mile of open space here in Colorado that affords a 360 degree view of the eastern Plains and the Colorado Rockies.   With my favorite soul-affirming tunes on my phone, my earbuds, and my walking shoes, I set out to meet the sunrise at 6500 ft on top of the mesa.  Breath, movement, connection to the Divine, and immersion in beauty is soul food - like water is to seeds.  When I returned, my body was energized, my spirits were lifted, I was able to start anticipating a new future with a new understanding of how my world worked.  I had metaphorically put some dry seeds of a new path with a commitment to care about making my future the best it could be.

I'm still waiting for the day when I get to look back and connect all the dots.  In the meantime, I find meaning and purpose in sharing experiences and perspective with my colleagues who are feeling the loneliness and the darkness of these times.  I can recognize the benefit of sharing all I know, and what I do with people who are facing daunting challenges in the cybersecurity risk management space.  I have goals for the areas of my life that matter, including giving voice to all those ancestors on whose shoulders we stand while making memories with grandchildren.

Life is a cycle of sprouting, growing, blooming, fading, and starting again.  We just have to remember that its a cycle and we're not hopelessly stuck.

Here's to your blooming.

Warmly,

Karen

Liberty but No Boats.

"My mama always said life was like a box of chocolates.  You never know what you're going to get.". Forrest Gump

That's putting a positive spin on things for sure.  It is one reason we all love Forrest Gump.

Most, if not all of us, have other quotes and memes we use that reflects something less harmonious when we encounter obstacles and losses, particularly when we attribute those barriers to someone else.  I can always tell when one of those fleeting thoughts crosses my mind (thankfully they are fleeting) because my WHOOP band reflects it accurately as a stress response.

If my WHOOP could talk: "Karen, your stress spiked for 23 minutes for no apparent reason. Oh, wait, that's the time you wanted to reach out an TOUCH someone".

But when we have those moments, fleeting or not, and they occur with regularity, they take a toll.  And in cybersecurity as a CISO, we can live in such a near constant state of increased stress response that we normalize it.  Award-winning actor Brendan Fraser likened it to the way we tune out faulty smoke detectors.  It becomes baseline.  And that's when the trouble affecting CISO well-being can really start.

Over the past two years, we have had three seismic-level events in cyber when it comes to the personal well-being of CISOs.  Peter ("Mudge") Zatko, formerly CISO of Twitter resorted to federal whistleblower status to call out the alleged security problems at Twitter.  Joe Sullivan, former CSO at Uber was charged and convicted for felony obstructions and misprision regarding a massive security breach at Uber in 2016.  In late 2023, the Securities and Exchange Commission filed litigation against Tim Brown of Solar Winds with numerous allegations surrounding his role at the company leading up to the distribution of malware via their IT monitoring and management platform affecting tens of thousands of customers.

At the regulatory level, the SEC's new rules affecting cybersecurity risk management, governance, strategy and incident disclosure have introduced a high level of uncertainty about the role and accountability of the CISO which will likely continue throughout the year until the majority of SEC registrants get clarity on what is expected of them.

Just writing about it is anxiety producing!

My Navy Fighter Pilot father, whom I will most likely refer to on numerous occasions throughout this CISOSOS series had a phrase he used all the time to describe what it was to be accountable without authority.

"Liberty with no boats."

At the beginning of 2024, most CISOs of SEC registrants have liberty but no boats.  They have their neck in the noose with no real ability to extract themselves from an untenable situation.  We've seen it again and - back in 2017 at Equifax and more recently at Clorox, after a security breach, the CISO gets the blame and the boot.  It is quite understandable that CISOs are not looking at 2024 as the surprise in a box of chocolates.  It looks more like the light at the end of the tunnel, when the light is a train.

Personally, my style is one to get clear about the brutal reality of a situation so I can try to fix it.  Here's the brutal truth: 2024 is going to be a rocky year with CISOs' justifiable anxiety about personal and career well-being, coupled with a very challenging year for SEC registrants to be ready for their 10-K disclosures on material cyber risk.

Nothing is so simple as just a list of things you need to know in this world, but for the sake of readability and because everyone LOVES lists, here are some survival strategies if you are the CISO, CSO, or Chief Trust officer of an SEC registrant:

1. The anxiety of the devil you know is better than anxiety about the devil you don't know.  While it isn't reasonable to expect every CISO to know everything and keep up with all the statutory, industry and regulatory expectations as well as the latest threat landscape, security architectures, emerging technology (hello AI), and business drivers in an increasingly competitive landscape you do need to know who you can go to and trust to get you answers when. you need them. Write down a framework for the things you need to manage.  Focus on priority projects that will help you meet your objectives (both business and personal), group them by affinity, identify the actions that will move the needle forward. List the gaps in your experience or knowledge so you can utilize your network to find the answers and resources you need.  If you find you have a natural resistance to a particular area of work or necessary skill set, that can be a great use of a coach to help you overcome that barrier.

2. Don't let other people's lack of organization and/or direction muddle your clarity on what's important for YOU to achieve.  Death by Meeting (great book by Patrick Lencioni) addresses one of the most ubiquitous problems in business today.  The classic of quadrant two time management put forth by Stephen Covey is worth incorporating into your plan.  You can still be a team player and keep your focus by using concepts in books like these with your colleagues.

3. Understand what is important to you.  Tony Robbins taught me a method for creating the life I really wanted (hint: it is not all work).  It starts by taking stock, being very honest about the quality of your life in the key areas that are essential to us all:  emotional and physical health, relationships, time management, financial management, personal and professional growth, your mission and vocation (often this is Work), relationship with the Divine, meaningful contribution and celebration.  You deserve to have every one of those areas operating at an 8-10 level but most of us don't because we invest far too much energy and focus in just one area: Work. Ask yourself what a 10/10 would be in each of those areas, then rate yourself where you are today.  Set a juicy compelling goal for each area.  One that I used was "I am in the best emotional and physical shape of my life.". Yes, I have a ways to go on that, the point is, it is a goal I keep in front of me to work on every single week. By the end of the year, I'll be better than I was at the beginning.

4. Comparison is the path to burnout.  Jordan Petersons 12 Rules for Life includes this: Compare yourself to who you were yesterday, not who someone else is today.  When you know YOUR life, YOUR goals it doesn't really matter what someone else is, or is not, doing.  You are the only yardstick that really matters.  Drive comparison of yourself with others out of you thinking.

5. Make this the year for the basics: Hydration, Sleep, Movement, Breath, and Stress Reduction.  Your body is the consort to your soul.  They are inseparable.  One more glass of water, get enough sleep (we should do an entire session on this one), MOVE every hour, learn to get air into every cell of your body through breathing techniques, and become aware of your stress and how to reduce it.  I am a huge fan of the free information provided on the Andrew Huberman podcast.  If you are interested in improving these fundamentals of life, hit me up for a list of the best of podcasts.

With these five 2024 survival strategies under your belt, you can be very successful in what is sure to be a challenging year.  Years that have the greatest challenges and personal risk in them are also the years for the greatest achievement and personal growth.  Remember the words of Mae West: "I never said it would be easy, I only said it would be worth it."

That is precisely what the team at AT&T Wireless was told back in 2002.  Zero deficiencies in the information security audit under the new Sarbanes-Oxley rules were a vital part of the terms and conditions of what was to be the largest cash acquisition in US History at that time: $41B cash for AT&T Wireless to be merged with Cingular Wireless.

No one had any suggestions, and we were on our own to figure out a strategy and a plan.

Today, it’s similar to the situation for SEC registrants.  The new SEC CRMGSID (cyber risk management, governance, strategy, and incident disclosure) rules have two major components: filing an 8-K within four days of determining a material security incident has occurred and filing a 10-K annually in which the company must attest to the strength of its cyber risk management, governance, and strategy.

Most of the focus for the last several months has centered around the determination of the materiality of a cyber incident and the challenges of reporting without under or over-reporting.  We’ll get to that in this series soon.

It’s the readiness for 10-K filing and reporting on cyber risk management, strategy, and governance that we should be focused on because this is a much larger effort with significant beneficial payback if done properly.  Lessons learned from Sarbanes-Oxley can help.

There are a few key realities that companies need to know now

The SEC is in no mood to receive 10-K language around cyber risk that is generalized and vague.

The purpose of the new 10-K reporting requirement is very similar to Sarbanes Oxley's purpose.  SOX was intended to restore confidence in corporate financial reporting.  CRMGSID is intended to restore confidence in corporate attention and management of cybersecurity risk.  

It isn’t necessary to over-disclose details about cyber risk management that should be confidential.  A statement that is unequivocal and auditable about the company approach to minimizing material cyber risk is what investors and shareholders need.  

When the SEC filed suit against Solar Winds and their security architect/CISO it was a clear signal that the statements about cyber risk in the 10-K must align with reality. Companies must have processes in place from the board to the c-suite and throughout the organization to ensure the necessary and sufficient controls are designed, in place, operational, and documented in such a way that an independent auditor can validate that the statements made in the 10-K are true. 

Companies are expected to have board-level oversight of cyber risk management by the C-Suite.

While it isn’t required for cybersecurity experts to be board members, the board must have sufficient understanding of the company’s cyber risk to be able to both support and challenge the executive team.  This is likely to require boards to hire consultants on retainer to assist them, and we can expect to see a proliferation of board training programs in the next year.

The CRMGSID cyber risk management rule is all about the control environment, just as it was with Sarbanes-Oxley, except the scope is significantly bigger.

Sarbane-Oxley scope included all business processes and systems that contributed to the general ledger.  CRMGSID includes all business processes and 100% of the digital footprint that can provide a vector for a cyber incident (See a starter list in the first article of this series called It’s Time.)

In addition to a larger scope, the control environment must be designed in such a way that SEC registrants can attest that those controls are the necessary and sufficient set for the company and that they are operational and effective 100% of the time.  This is the same as Sarbanes-Oxley; however, it will not be one-size-fits-all because it must be tailored to the company’s specific business, an understanding of its threat landscape, and consideration of the risk appetite of both the company AND the company’s interested parties.  

Controls design must be defensible (in other words, it makes sense to an outside auditor), documented, validated through regular testing (for effectiveness), and auditable.  

Those who do SOX well will have a headstart.  Those who struggle with SOX may want to re-evaluate their approach to internal controls.

There is a silver lining. 

For the effort involved in putting the right controls in place in a way that reliably operates as intended 100% of the time, companies can expect to see improved operations that will result in cost savings and a tangible reduction in their exposure to cybercrime.  After all, that’s the point of the new CRMGSID rule.

Build your strategy around shared business objectives

The foundation of having governance, accountability, and roles and responsibilities in place is the first step as I wrote about in CISO SOS #2.

With that in place, the next step is building consensus around the company's risk management objectives.  It is the process of clarifying the cyber risk management objectives for the business and its interested parties.

Note: I had a boss once who informed me that as the CISO it was my performance objective to ensure zero hacks and zero leaks for our company - which was the second largest target on the planet behind the US Department of Defense.  This is not a reasonable approach to establishing cyber risk management objectives!

In the case of AT&T Wireless, under the first year of filing under SOX, our management objective was to ensure that we protected the integrity, authenticity, and availability of any transaction that rolled up to the general ledger to within 1%. 

A general objective that will apply to most companies under the CRMGSID will be:

Ensure that exposure to attack vectors from third-party connections is minimized.

Given that objective, now what?

I suggest using a visionary approach that allows for a zero-base plan of a “to-be” state.  Once the objective is agreed to by the leadership team, the next question to ask is:

What would it take for this to be true?

Brainstorming the necessary (not ideal) state that the company can reasonably defend under both the duty of loyalty and duty of care sets the target objective.  This is best done with a cross-functional effort from senior leadership and their teams, including the CISO, CIO, General Counsel, CFO, and Chief Audit Executive, as well as leaders of company P&Ls.  A clear description of the target state sets the stage for the next step: Gap Analysis.

Where are we now?

 Armed with the target state and the scope of processes and systems it would affect, the project team begins to determine what the gap is between the target state and the current reality.

We had some very interesting lessons to learn in this process.  Establishing the target state was relatively easy using internationally recognized standards as a reference (ISO 27000 series, CobiT, and ITIL).  What was difficult was getting people OK with uncovering the brutal reality of the actual state.  People are understandably reluctant to share with management that they are operating under conditions they know aren’t ideal and haven’t told anyone - or maybe they’ve tried telling people and have been dismissed.  In any case, getting to the truth of the radical reality is necessary.

Unmitigated RISK = difference between where you need to be and where you are

This process gives you the ability to clearly identify the level of effort necessary to close the gap (some might call this a risk gap).  The cost (expense, capital, labor, time) to close the gap can be compared to a cyber incident's potential exposure (business loss, litigation, goodwill).

Wash. Rinse. Repeat

This process is one that needs to be repeated to get an accurate understanding of the state of cybersecurity.  It’s a top-down approach that saves time, links cybersecurity directly to business operations, and is quantifiable.

It’s how we made it happen in ten very intensive months at AT&T Wireless, from a state of very deferred maintenance, WAREZ sites in our data center, and an IT environment that suffered severity-911 outages on a daily basis to a zero deficiency security audit. In addition to ensuring the integrity, availability, and authenticity of our financial reporting, we started deploying defect-free code, break-fix went away, our developers got their lives back, and we built an incident detection and response capability that was so reliable and repeatable that it was the subject of a Six-Sigma case study (among many other cost-saving benefits).

Is it different than what most cyber professionals are used to doing?  Yes - and that may be exactly what we need right now because what the industry is doing today just isn’t working.

Let me know your thoughts and questions and I’ll incorporate those into future articles. Next week I’ll share more on success with CRMGSID and the first installment on navigating CISO Well-being.

Best,

Karen

This is more true in changing the trajectory of cybersecurity than in any other area of business.  Today’s post focuses on the critical success factor of culture and governance of cybersecurity and what needs to change this year in order for SEC registrants to be ready for their 10-K.

First, a historical perspective will be helpful.

The very early days of information security focused on setting policies for the appropriate use of computing resources and defining access privileges.  As computing evolved, the changes in “computing security” were often, if not always, seen as the domain of the IT organization.  Business CISOs emerged in the last 15 years or so as a way to bridge communications between business units and technology organizations. BISOs operate as an extension of the CISO. The role of Chief Information Security Officer (CISO) most often reports to the CIO because of this legacy perspective of technology.  As such, the CISO inherits the company values and attitudes toward IT - that is, business technology is something of a utility like water.  You turn it on, and it's just there when you need it. (I realize my first-world cultural upbringing is showing here and that I’m privileged to be among the 3% of the world’s population with reliable access to clean water).

Today, we are confronted with multiple reasons to reconsider the corporate culture around information security (I prefer the term “information security” to cyber security as it puts the focus squarely on data and data processing assets but use these terms interchangeably).  Many of my colleagues focus on the reporting structure of the CISO.  I will propose something here that I learned from Chris Corrado when he was the CIO at AT&T Wireless that was foundational to our ability to succeed at information security risk management in the first year of Sarbanes-Oxley:

The accountability for technology and the secure use of that technology for protecting corporate assets rests squarely on the leadership of the business units and must not be delegated to the CIO or the CISO as if the business units are not ultimately accountable.

Put another way: if a business unit requires technology to deliver a product or service as an essential objective of the company, then that business unit is accountable for ensuring the technology is managed and secured properly in accordance with the risk management philosophy of the enterprise.

It would be fair for a CISO reading this to ask, “What about me?”

Business leaders are accountable for the choices they make for every aspect of product and service delivery, including the risk management decisions for the use of the full stack of technology.  In this scenario, the role of the CISO is to focus as a strategic advisor and business partner.  The business leader, then, is accountable for ensuring adequate resources are applied for acquiring/building/securing business logic, for vetting the appropriateness and security of third parties, for knowing what their assets are and ensuring they are suitable for the intended business purpose, and so forth.

The good news for CISOs is that when the business unit leadership, such as a P&L owner, is accountable for their business use of technology, the CISO’s neck comes out of the noose.  I’ve been told more than once as a CISO that my career is on the line if the company experiences a security breach. There is no “passing the buck” or blaming the network administrator who “failed” to patch an Apache server because the buck stops with the P&L owner.  

CISOs’ roles will likely remain fluid and broadly defined over the coming year and will continue to differ depending on the company.  For those who are interested in getting ahead of the new SEC rules for cyber risk management, I recommend the following: rather than try to define the accountability and governance of information security from the perspective of the CISO, adopt an information security governance and risk management culture from the C-suite first.  Utilize the updated COSO ERM Integrating Strategy with Performance and refer to guidance on governance and culture:

Principle 1: The board of directors provides oversight of the risk management strategy and carries out governance responsibilities to support management in achieving strategy and business objectives.

Boards will require expertise in order to provide adequate oversight of a cyber risk management strategy, know the right questions to ask of the management team and know when to challenge them on their approach.

Principle 2:  The organization establishes operating structures in pursuit of the strategy and business objectives.  In the particular area of information security risk management, this requires understanding business objectives surrounding confidentiality, integrity, availability, and authenticity of data assets, considering all business, legal, regulatory, and statutory requirements.  Here is where the rubber meets the road - this cannot be delegated to a CISO alone.  Every business unit in this new regulatory landscape is part of the security risk management operating structure with clear accountability, authority, roles, and responsibilities.

Put the accountability where it belongs and watch the culture around security transform.

Principle 3: The organization defines the desired behaviors that characterize the entity’s desired culture.  This is also known as “tone at the top.”  With the new emphasis on information security risk management from the SEC, registrants have a unique opportunity to clarify their risk appetite based not only on the duty of loyalty but also on their duty of care to their interested parties.  This is another foundational piece of work.

To use a Navy phrase I learned from my fighter pilot father, it isn’t fair to grant liberty when there are no boats. When the tone at the top is backed up with appropriate resources to carry out expectations, internal accountability, and meaningful reporting, the culture shifts because people can see that the “talk” also “walks.”

According to COSO ERM, “the culture of an organization affects how risk is identified, assessed, and responded to from the moment of setting strategy through execution and performance.”

Your company’s success in 10-K readiness depends on the foundation of governance and culture.  Without it, you’ll be in thrash mode when it comes time to demonstrate due diligence to a defensible standard of care in your 10-K.

The time to start working on this was yesterday, but today is a great alternative.  If you need a copy of the 2017 COSO Enterprise Risk Management - Integrating with Strategy and Performance, you can purchase the e-book from IIA or AICPA.  Check out the link at: https://www.coso.org/guidance-erm.

If you are an SEC registrant I’d like to help you understand exactly what is expected of you and how to navigate the regulation successfully.

As a foundation, the SEC put the new rules into place in order to provide transparency of cybersecurity risk to investors and shareholders and improve their confidence in the internal controls preventing material cybersecurity loss. If you lived through the early days of Sarbanes-Oxley Act of 2002 (aka SOX) this should sound very similar. SOX was put into place to improve investor and shareholder confidence in the financial reporting of publicly traded companies. It took Enron Corporation, Tyco International PLC and Worldcom to push the SEC to give us SOX. It took cybercrime reaching the magnitude of the 3rd largest GDP in the world to give us the CRMGSID.

First of all, we need a better acronym.

Second - and more important - we need to take a pause from all the concerns around the requirement to disclose material incidents within four business days and think about what the attestation of cybersecurity risk management on the 10-K means for all SEC registrants.

The ultimate intention of SOX was design, implement, and maintain business process and technical internal controls to ensure the authenticity, availability, and integrity of any transaction contributing to the General Ledger. Depending on materiality, the accuracy of GL entries had to be within 1-4%. Further, the controls at every level had to be documented and tested such that the control could be considered to be in place and effective 100% of the time.

Here’s the headline for 2024

Under the new SEC rule for cybersecurity risk management, some major changes in the way cybersecurity controls are designed, implemented, validated, maintained, and tested are needed. It is essentially the same as Sarbanes Oxley, except that the scope is not limited to transactions that lead to entries on the GL. The cybersecurity rule scope applies to ALL business and technical processes that could contribute in any way to a technology failure or a cybersecurity incident that could materially affect the business.

Let’s break that down into some of what it includes, which is 100% of technology and associated business processes affecting:

• security policies and procedures

• authentication methods

• identity and access management systems and authorization processes

• access control functions

• network management

• asset inventory, both on-prem and cloud - wherever computing function exists

• connections with third party providers of any kind

• data management

• software development including CI/CD pipelines

• vendor management

• off-the-shelf software

• incident detection, response, resolution, mitigation

• configuration management

• change control

• security education

It sounds impossible

It would be fair for you at this point to mentally shut down and try to argue that this can’t possibly be what is intended, it is impossible, and to think you’d be better off waiting until the Big Four clarify what is expected of you.

It would be fair, but it will cost you.

Because, on the annual 10-K, an attestation of well-managed cyber risk should effectively be willing to be audited in such a way to demonstrate a well-designed control environment that minimizes the potential of material cyber risk to a level the business is able to defend. And the defense doesn’t just include duty of loyalty, it also includes duty of care to all interested parties (we’ll write more about this soon in a future post.)

The CFO may need to quantify the residual cyber risk with an accrual for cyberrisk as a liability on the balance sheet. For the first time, accurate quantification as well as qualification of cyber risk matters a great deal.

How do we know this approach to cyber risk management works?

My certainty in all this comes from the hard-won lessons in implementing a new cybersecurity control environment for AT&T Wireless during the first year of accelerated filing under SOX. I was the VP of IT Risk Management and CISO for AT&T Wireless, and we were absolutely on our own in determining what would be required for our control environment to pass the required audits so that the largest cash acquisition in US history (with Cingular) could take place. The terms of the deal required that our security audit pass with zero deficiencies. We had to make sure that we demonstrated we chose the right controls for the business, to optimize them in order to ensure that we could implement, document and test them in the 10 months we had for the project, and to test them in a way that proved they were both operational and effective 100% of the time.

If we had waited for the auditors to tell us what to do, the merger with Cingular would never have happened and the AT&T Wireless brand would have been lost.

It was a true team effort and we accomplished the project within 10 months.

I hope to share what our team did to pull off what seemed like a miracle. Moreover, the unanticipated business benefit that accrued as a result of having a security control environment working on a par with internationally accepted standards showed us all what well-designed controls can do.

We gave it a name: demonstrate due diligence to a defensible standard of care.

We can’t afford to do less

It brings to mind something my physical therapist told me: I didn’t tell you it would be easy. I told you it would be worth it.

The status of cybersecurity today is screaming for us to do something different that works. Cybersecurity Ventures anticipates that cybercrime worldwide will cost $9.5T in 2024.

The new SEC rule, if we embrace it to achieve the benefits we saw with a well-designed control environment under SOX, could be the very thing that finally turns the tides on cybercrime.

I’d like to be your guide to get there.

Until our next installment,

Best wishes for a sterling 2024.

Karen