Change From Within: 3 Cybersecurity Transformation Traps for CISOs to Avoid

To make cybersecurity an organizationwide priority, CISOs must avoid these common input, empathy, and alignment obstacles.

Bernard Brantley, CISO, Corelight

October 20, 2023

4 Min Read
Colorful origami, indicating transformation
Source: Brain light via Alamy Stock Photo

Whether they're earned or not, there are certain stigmas associated with chief information security officers (CISOs): They work in isolation, with only a vague sense of how various departments contribute to the organization's greater good. They impose controls without considering business impact. They focus on highly technical metrics with unclear net positive value. They aren't good at listening. Or empathy.

Be honest. Does this describe you and your team — even just a bit? Or more so? If you concede that it does, that's a good thing. The first step toward a solution is acknowledging that a problem exists. Improvement requires change, which is sometimes uncomfortable, because change starts with you.

Accountability, then action. For CISOs and their teams, that means transforming into ubiquitous advocates for cybersecurity — and then leading the transformation for everyone in the enterprise into advocates for the same.

CISOs will thrive within this change by focusing on input, empathy, and alignment. This will enable lasting success for the shift by allowing CISOs to fully identify and understand information asymmetries throughout the organization and then remove them to clear the path to optimal communications and awareness.

However, there are several obstacles that hinder these efforts. Here are three and how to overcome their traps.

Assigning Tasks to the Wrong Subject Matter Expert (SME)

CISOs are responsible for an extremely wide scope and frequently deal with high stress — but are consistently biased toward taking action themselves. They lead the organization well, but at times miss opportunities to leverage SMEs' soft skills to optimize resolution. As leaders, it is necessary that CISOs remain cognizant of the balance between SMEs' skill sets, shared values between them and the target organization, and the true goal of this collaboration.

The solution requires raising engagement between security and the enterprise across the board, building relationships that ensure the right expert is assigned to the right issue to give the right support.

CISOs must rely on the people around them to truly know what is going on. They must create pathways so that the right information flows freely everywhere and that this knowledge is committed to organizational and institutional memory. By interfacing with external teams, CISOs create contacts that result in the effective ingestion of information and the proper application of personnel and responses to the information.

Failing to Tie Actions to Organizational and Business Goals

If CISOs don't connect their work to broader goals, it's pretty much impossible for non-IT managers and employees to appreciate the value of their actions. CISOs know why certain controls and responses to threats are needed. But they can never assume those outside their team do.

To overcome these potential credibility gaps, I've proactively communicated with my heads of finance, marketing, sales, and other key departments to learn about their roles. Because I've invested that time — to find out what they do every day, along with their strategic goals and challenges — I gain their trust in myself and my team. They are confident we will approach threats, risks, and remediation with an appreciation of business objectives.

Executing Without Making Broad Impact

I push my team members to constantly ask themselves: "Am I implementing a fix that benefits people outside our team? Or am I just trying to make my own life easier?" Obviously, we seek to achieve the former and avoid the latter. Simply stated, we need to think big. Our return on investment (ROI) growth is directly tied to our ability to sow seeds once and reap the fruits of our labor in multiple seasons to come. 

"Everyone has a plan," boxer Mike Tyson is credited with saying, "until they get punched in the mouth." If we work within security silos — isolated in our knowledge, dogmas, and execution — every security issue is like the first time in the ring, and we consistently take punches that we have little understanding of how to handle. 

But if we proactively pursue empathy and alignment as part of our core values, we gain a level of trust that builds pathways throughout the enterprise. Subsequently, we can remove those informational asymmetries, elevate the conversation across the organization, and lead strategically. And we will walk out of the ring with our arms raised — stronger and together.

About the Author(s)

Bernard Brantley

CISO, Corelight

Bernard Brantley is the Chief Information Security Officer (CISO) at San Francisco-based Corelight. He has previously managed threat hunting, threat intelligence, network security architecture and analytics for some of the most mission critical environments at both Amazon (Consumer Payments) and Microsoft (High Value Asset Environments). Bernard is an advisor at Seattle-based Tola Capital, and San Francisco-based Normalyze. He is a member of multiple CISO and leadership communities while also engaging with early and mid-career professionals as a mentor. Bernard spent three years at the United States Military Academy before taking an unconventional path to executive leadership. His background of diverse experiences cut through retail sales, construction and financial services prior to his first IT role as a datacenter support technician. "No matter who you are, what walk of life you come from, or what type of adversity you face; If you can see the prices, there is a path for you to it. 'Inveniam viam, aut faciam.'" Bernard lives in Seattle with his family.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights