1/n Okay, we need to stop for a moment and consider cybersecurity from a CEO's point of view. It's easy to laugh at them, as in the following tweet, but that's not going to change things until we understand their perspective.
2/ The only thing more broken than how CEOs view cybersecurity is how cybersecurity experts view cybersecurity. We have this flawed view that cybersecurity is a moral imperative, that it's an aim by itself. We are convince that people are wrong for not taking security seriously.
3/ Rather than experts dispensing unbiased advice, we've become advocates/activists, trying to convince people that they need to do more to secure things. This activism has destroyed our credibility in the boardroom, nobody thinks we are honest.
4/ CEOs view cybersecurity the same way they view everything else about building the business, from investment in office buildings, to capital equipment, to HR policies, to marketing programs, to .....
5/ Business is divided up into two parts.
The first is the part they do well, the thing they are experts at, the things that define who they are as a company, their competitive advantage.
The second is everything else, the things they don't understand.
The first is the part they do well, the thing they are experts at, the things that define who they are as a company, their competitive advantage.
The second is everything else, the things they don't understand.
6/ For the second things, they just want to be average in their industry, or at best, slightly above average. They want their manufacturing costs to be about average. They want the salaries paid to employees to be about average. Everything outside of core competency is average.
7/ I can't express this enough: if it's not their core competency, then they don't want to excel at it. Excelling at a thing comes with a price. You have to pay people more. You have to find the leaders with proven track records at excelling at it.
8/ This goes all the way to the top. If it's something the company is going to excel at, then the leader at the top has to have enough expertise themselves to understand who the best leaders to can accomplish this goal.
9/ All this is a tradeoff. It means a focus of business attention on the thing that can't be focused on all the other parts of the business. If your company excels at cybersecurity, it means not exceling at some other parts of the business.
10/ So unless you are a company like Google, whose cybersecurity is a competitive advantage, you don't want to excel in cybersecurity. You want to be average, or at most, slightly above average. You want to do exactly what your peers are doing.
11/ This is where Gartner comes in. They send analysts to talk to you and your competitors to figure out what all of you are doing, then write up reports about what your industry average is. Yes, yes, it's all phrased as "best" practices, but it's really "average" practices.
12/ When things hit the news, like this Twitter hack, CEOs want to know "what are our peers doing?". In other words, let's ask Gartner what our peers are doing.
13/ Yes, this often comes down to "what pill can I take to make this rash go away", because CEOs are simpletons. But whatever answer you think of, like "security is a process, not a product", is really no better. Process isn't a quick fix here, either.
14/ The problem I see in such companies is not that they fail to excel at cybersecurity, but that they fail to even be mediocre. This "being average, no better than our peers" has really entrenched bad habits and outdated processes/products.
15/ CEOs have entrenched the use of outhouses when modern plumbing is cheap and widely available (an analogy my father often used). 
16/ I loathe and despise Gartner, because of my history as a product vendor, so this thread isn't intended to be supportive of them. Instead, I'm trying to empower security people in companies to be able to communicate with leadership, to understand their point of view.
17/ For any C-level executives reading this thread, do listen to your people more. Yes, yes, they are annoying at times, but buried within your organization is more expertise than what Gartner can ever give you ... unless you are an exceptionally bad leader of people.
18/ BTW, this thread is picking on Gartner here, but it's really all Big Consulting. The theory is Big Consulting is also hired by our industry peers, so understand Average Practices. In reality, they tend to perpetuate Worst Practices.
19/ In my experience, boutique consultants and just listening to your own damn people is the best way to get marginal improvements -- if only you had a way of getting around internal corporate politics to be able to communicate with your own people.
