Security leadership in the age of disruption

What will security look like in a year, and how would we measure its success? When asked this question a couple of months ago, I envisioned a period of chaos before an eventual return to “normal.” Or rather, a new normal that we can’t truly foresee right now, because we must still make our way through multiple, accelerating changes that together create compounding disruption.

We’re already in an “Era of Disruption,” and while AI may dominate conversation, it’s only one of multiple tracks of change, with advances in quantum computing, robotics, nanotechnology, synthetic biology and others accelerating alongside it; and we may end up with co-morbidities of disruption as tracks accelerate and changes happen more often. This new reality calls for leadership, not merely management and staid prescriptions. Enterprises can’t simply manage change well enough against an old set of success metrics. With disruption becoming more frequent and impactful, businesses can’t continue to do what they have always done.

Enterprises need leaders, not managers

There are as many opinions on “Management” and “Leadership” as there are grains of sand in an hourglass. For me, management is the skill of creating order and reliable processes to get results and reduce risk. My former CFO and dear friend, Russ Stein, used to say that a company is a machine for making money. Management is what makes that machine predictable.

Leadership is something else. For me, it’s about achieving results at scale. It’s about setting vision, inspiring people, and driving organizations to succeed. This could be on a small level in a start-up or on a massive societal scale. Management has limits at large scale, but leadership can drive a nation to the moon or bring down tyranny as we lead people (and, perhaps, AI) to achieve and strive and, especially, to handle change.

To move forward, we need to get good at leadership, providing guiding principles rather than getting stuck in the minutiae of management. The goal is not to make every decision, but to give people the guidance and confidence they need to make good choices themselves. It’s about empowering your team to turn guidance into action. That’s how you distribute decision-making and leadership at scale.

Leadership guides and drives management.

I use this approach with my own team, equipping them with a short list of “first principles/”. The principles themselves are simple: think critically, protect people, act lawfully and professionally, empower others, and strive for quality. The beauty is that they provide a framework for making good decisions during a crisis, without prescribing every decision.

Applying leadership principles to security 

All too often security is reduced to binary thinking: something is secure or not, safe or not, at risk or not. The notion of “acceptable risk for acceptable return” in an imperfect world is too often forgotten. 

We can’t know, for certain, what “next” will look like. This uncertainty is exactly why a set of guiding principles, like we have for leadership, are pragmatic. The goal is to shape disruption-resilient infrastructure that we can continually improve and strengthen over time.

So, what might those principles look like in practice? I'd start with six priorities for leading security in the Era of Disruption:

1. Runtime protection: Protect systems in the production environment with virtual patching, shielding and other security controls.
2. The “least” principle: Apply Zero Trust with least privilege, least visibility, least exposure, least reachability and least data sprawl to reduce the attack surface. 
3. Tech debt: Use periods of stability to simplify legacy environments wherever possible, including refactoring old code with better programming languages such as Rust, Go, Swift and C#.
4. Deception techniques: Use these to mislead and disrupt attackers, with AI creating new opportunities for you to strengthen your approach.
5. SecOps 2.0: Evolve security operations around better signal isolation, making it easier to identify and respond to meaningful threats.
6. Test and simulate: Strengthen resilience through better testing, disaster recovery, redundancy, red teaming and the like.

Of course, this list is not exhaustive. I am sure there are more priorities and principles we could add. But the aim is not to create an endless list. Rather, we’re looking to simplify our approach to disruption and uncertainty. With that in mind, I will leave you with a direct question:

Which single thing would you remove from your environment tomorrow, if you could, to make it simpler and more secure?

That instinct to simplify is exactly the right starting point. To see how the same first-principles thinking applies to the agentic AI wave now reshaping enterprise security, read The Agentic Wave: Why Our Newest Innovation Demands Our Oldest Discipline →