Thread by @philvenables

Career longevity, setting expectations and the “don’t fire me chart”. A thread.

To fix anything sustainably requires long term action. This is especially true in technology risk and cybersecurity.

1/8

The trouble is this is also a space where there is often impatience to get results fast. Sometimes this is workable, many times it is not. The end result, in a number of organizations, is constant turnover in the C-ranks (CISO, CTO etc.). Let’s examine why.

2/8

1. Issues are going up, so they hire or assign you to fix them.

3/8

2. You hit the ground running and find a bunch of quick wins and start reducing the number of issues. So far so good.

4/8

3. Then you start digging deeper, improve monitoring, risk assessments and other instrumentation : as a result you start finding more issues that need fixing. At this point management wonders why you’ve made the situation worse and then decide they need someone new.

5/8

4. Then a new person turns up, applies the same method, typically reinventing/replacing what you did, and so the cycle continues. Often, given entropy / usual net increase in risk, the graph keeps trending up despite the occasional downward move.

6/8

5. However, if you get the support from leadership and get to push through then you will hit a sustained lower level of issues. Many organizations have done this.

7/8

Bottom line : when you are new to a role or assignment show people this last chart and remind them that things may start to look worse before they get better and that can be a sign of being on track. Show them the point where you don’t want to be fired.

8/8