Chapter 13 of 14 · Month 6 and every month after
What Security Is Not Good At
- Why do other teams avoid the security team?
- Do we have too many policies?
- Why doesn't leadership seem impressed by our reports?
Every function has habits that do not serve it. Security has three that come up again and again. Naming them is the first step to not repeating them.
1. Saying no too often
A security team that says no to everything gets routed around. People stop asking, and then you do not know what they are doing. That is worse than a yes with conditions.
Try "yes, if" instead. Yes, you can use that tool, if customer data stays out of it. Yes, you can ship, if this owner accepts the risk in writing and we fix it next sprint. You keep influence by staying in the conversation.
The question you might not ask out loud
Isn't saying no part of the job?
Sometimes. Some things are genuinely unacceptable, and you should say so clearly. But if no is your default answer, people will treat you as an obstacle, and obstacles get bypassed. Save the hard no for when it matters, so it carries weight.
2. Too much policy
Policies feel like progress. They are easy to write and look good to auditors. But a policy nobody reads changes nothing, and a stack of them hides the few rules that matter.
- Can a new starter find and read the rules that apply to them in ten minutes?
- Does each policy say who checks it and how?
- When did someone last change their behaviour because of it?
Fewer, shorter policies that are actually followed beat a full library that is not.
3. Reporting activity, not outcomes
"We blocked a large number of attacks" says the team was busy. It does not say the company is safer. Leaders learn to tune out activity reports, and then they tune out the team. Report what changed: risk down, a gap closed, recovery tested and proven.
| Activity (less useful) | Outcome (more useful) |
|---|---|
| Phishing emails blocked | Admin accounts that can no longer be taken over with a stolen password |
| Vulnerability scans run | Time to fix critical internet-facing flaws |
| Policies published | Teams that changed how they work |
None of these habits come from bad intent. They come from a team that feels responsible for everything and in control of little. The fix is not to care less. It is to share ownership of risk with the people who make the decisions, and to judge your own team by what changed rather than by how hard it worked.
Rule of thumb:Rule of thumb: if your report would read the same in a bad month and a good month, it is reporting activity.