Reflections for those who lead

“I am convinced that there are only two types of companies: those that have been hacked and those that will be.”

“Security is a process, not a product.”

“Plans are worthless, but planning is everything.”

“An Ounce of Prevention is worth a Pound of Cure.”

Security can't be delegated: it is led from the table where the budget is decided.

Risk doesn't distinguish between physical and digital. Neither should your security strategy.

Security doesn't start with a camera, a firewall or an antivirus. It starts with a human decision.

You can recognize a security culture when reporting a mistake is easier than hiding it.

Resilience isn't never falling. It's knowing how long your company can operate while it gets back up.

A wrong click costs less when someone reports it in time.

If the board doesn't ask about security, the message to the organization is that it doesn't matter.

Invest first in what protects your critical processes, not in what looks most modern.

Courtesy is a virtue; holding the door for a stranger is a risk.

Urgency is the scammer's favorite tool. Verification is yours.

Policies describe what should happen. Culture explains what actually happens.

Every new system is a new door. Ask who holds the key.

Innovating without managing risk isn't boldness: it's gambling with someone else's business.

Digital transformation also transforms the attack surface.

The best time to design your crisis plan is on a quiet Tuesday.

A CEO doesn't need to know how to configure a firewall; they need to know what to ask.

What isn't inventoried can't be protected.

A badge isn't an accessory: it's the simplest way to say “I know who is here.”

Multi-factor authentication is your email's seat belt.

Nobody protects what they don't understand. Training is the first line of defense.

Well-managed security doesn't slow the business down: it lets it accelerate with confidence.

A backup that has never been restored is just a hope.

Reputation is built over years and tested in the first hours of an incident.

The supplier that connects to your network is also part of your perimeter.

If you were expecting the email, verify. If you weren't, verify twice.

A clean desk at the end of the day is a security control that costs nothing.

Habit beats memory: what is practiced is repeated under pressure.

Artificial intelligence speeds up work… and social engineering too.

The security budget is a conversation about what you're willing to lose.

Prevent, respond and recover: three verbs every organization must put into practice.

The information you share on social media is also read by those who want to harm you.

A shared password stops being a password.

The first alarm is an attentive person.

Security stops being a rule when it becomes a habit.

Measure what matters: time to detect, time to respond, time to recover.

Incidents don't wait until there's room on the board's agenda.

The cloud doesn't eliminate responsibility; it shares it. Read the contract.

The risk nobody wants to own is, by definition, the risk nobody manages.

A resilient organization rehearses the crisis before living it.

Ransomware doesn't kidnap files: it kidnaps the ability to operate.

Alertness isn't fear: it's judgment applied at the right moment.

Reward the person who reports. Silence is the attacker's best ally.

Automating an insecure process only makes it insecure faster.

Security is a board issue because its consequences are too.

A call asking you to skip a procedure is, in itself, a warning sign.

Patching on time is boring. That's why it works.

Your company's perimeter extends to every employee's phone.

Start with the basics done well before buying the advanced.

An employee who asks “is this normal?” is worth more than any tool.

Continuity is knowing who decides when the system, the site or the key person isn't available.

Adopting AI responsibly starts with knowing what data you're giving it.

The leader's example is the most-read security policy in the company.

Trust, authority, urgency, curiosity, courtesy and distraction: the six buttons an attacker tries to press.

Verifying isn't distrusting people: it's protecting everyone.

CEO fraud doesn't need to hack systems; hacking trust is enough.

There is a path from awareness to resilience: belief, thinking, alertness, action, habit and culture.

A poorly communicated incident becomes two incidents.

Integrated security is cheaper than the sum of its failures.

Ask your team: what would we do tomorrow if we lost access to our data?

Every privileged access should have a name, a reason and an expiration date.