When Deep Expertise Was Being Mistaken for Industry Commentary

The executive had spent years working at the intersection of cybersecurity, risk and organisational decision-making. Inside the industry, that experience was obvious. Outside their immediate network, it wasn't.

As he tells it, he used to read a certain kind of client hesitation as budget resistance: security requests kept slipping down the list, and he assumed the money simply wasn't there. It took him longer than he'd like to admit to see the real pattern. It was never about money. It was that nobody in the room was willing to own the decision once the money was spent.

The Problem

A version of this played out, by his account, during a year-end budget cycle at a large, regulated organisation. Weeks of vendor evaluation. Board sign-off. The room agreed on the technology. Nobody agreed on who owned the business response if a major incident happened anyway.

As he remembers it, someone near the end of the meeting finally asked: "Who's actually responsible if this doesn't work?"

The room went quiet for a moment. Then it moved on.

The Diagnosis

In engagements like this, security failures have rarely come down to a lack of technology. More often, they come down to organisations never making a clear decision about who owns the risk.

Saying that publicly wasn't neutral for him. It pushed against an industry narrative that better tools solve security problems, and it meant contradicting an earlier version of his own public voice, back when he talked more about capability than governance.

The Work

The material got separated into three threads: what the industry was already saying, what he had actually watched happen in rooms like that one, and what he believed other leaders were getting wrong but rarely said out loud.

Industry developments became evidence, not subject. The unanswered question from that boardroom kept surfacing in the writing.

What Changed

The work moved from:

"Here is what is happening in cybersecurity."

to:

"Here is what experienced operators should understand about why this keeps happening."

If the problem isn't your expertise, but what people understand your expertise to mean: