Chapter 10 of 14 · Months 4–6
Growing Your Toolbox: Be T-Shaped
- I came from one specialty. How do I cover everything else?
- How much technical depth does a CISO still need?
- When do I find time to learn?
Every CISO arrives from somewhere: operations, audit, engineering, consulting, the military, a different industry. You are deep in one area and thin in others. That is normal. The job does not ask you to be an expert in everything. It asks you to know enough to ask the right questions and to notice when an answer does not hold up.
What T-shaped means here
The vertical bar of the T is your depth: the area where you can check the work yourself. The horizontal bar is breadth: enough understanding of the other areas to have a useful conversation with the specialists who run them.
| Area | Breadth looks like |
|---|---|
| Incident response | You can run the first hour and know when to call outside help. |
| Cloud | You can read an architecture diagram and spot where the data and the keys are. |
| Governance and risk | You can write a risk acceptance that a lawyer and an engineer both understand. |
| Application security | You know how code gets to production and where checks can sit. |
| Finance | You can read a budget and argue for spend in money terms. |
The question you might not ask out loud
Will my team think less of me if I don't know their area?
Not if you are honest about it and curious. Specialists respect a leader who asks real questions and listens to the answers. They lose respect for a leader who pretends. Saying "teach me how this works" is a strength.
Finding time
- Pick one area per quarter to widen, not five at once.
- Spend an hour a week with the specialist who runs it. Ask them to walk you through a real problem.
- Practise decisions, not just reading. Exercises show you where your judgement is thin.
- Keep a short note of what you learned. Re-read it before the next board meeting.
Your depth still matters. In a crisis, people will look to you for judgement in your own area. Keep it current. Just do not let it become the only lens you look through.
Be careful with certifications as a shortcut. They can give you a useful structure for a new area, and some employers expect them. But a certificate shows you studied a subject, not that you can make a sound call in it under pressure. Practice and real conversations close that gap faster.
Rule of thumb:You do not need to be the smartest person in each room. You need to know which room to walk into.