Security teams need to hear a public service announcement. "Believe in yourself. Have confidence. You can do it!"

It may sound corny, but it's true. I've spoken to more than 600 organizations -- from mature businesses to entry-level startups. What I’m noticing is that many of these cybersecurity teams -- from Singapore to Silicon Valley - do not have good self-esteem right now.

Believing

Progressive security teams are advancing largely because they “believe.” They believe they can improve their postures; believe they can achieve some form of resiliency; and look at their battlefield with an engineering mindset. Other security teams aren't faring so well. Too many practitioners give others too much credit and not enough to themselves.

I see and hear low self-esteem all the time:

"Oh, but our team isn't advanced."
 "Yes, but we're not software engineers."
"Our budget isn't as big as theirs."
 "We're already overwhelmed with AV alerts." 

While I understand why these teams think they cannot change their own status-quo, they are wrong. They simply don't realize what they're capable of. They give up at being transformative or at moving to a higher maturity level -- often without much of a fight.

Wasting Time

A lack of cybersecurity self-esteem leads to wasted "security time." We've already said we don't have enough people, so why do we fail to optimize how our teams spend their time?

We should be looking at getting the greatest return-on-investment from security time. Does your team do any of these things:

I see all of these way too often. Security teams are often not able to use their time most effectively. And so we fail. The adversary goes undetected. Tools aren't configured properly. Valid alerts get lost in the noise, or the hunt to find that evasive intrusion never happens. Then the annual security reports come out reflecting detection and response times in months rather than minutes. This has to change.

Building Up Our Confidence

The silver lining here is that we can build up our confidence. There are success stories. There are teams with 100,000 computers and only two FTEs that are finding and eradicating evil, and doing it in more and more automated ways.

There are companies that send their employees with little more than a laptop into countries where cyber hygiene hasn't yet become a trend, and these teams are able to find threat signals. There are teams of one or two people at banks that are continuously improving their posture so much that the red-teams are frustrated.

None of these teams are perfect, but they are progressing and raising the bar for their adversaries. Here are four things I’ve seen confident teams do successfully to help build their cybersecurity self-esteem:

There's a huge "can't do" attitude that’s plaguing security teams. This attitude arises because security leaders and practitioners have hit too many walls, often made of human flesh. It's time to stand up and say: “No. This is our environment. We are going to protect it.”

We may never be perfect, but we can do better. By increasing our cybersecurity self-esteem, we can truly make a difference in raising our collective cybersecurity resiliency.