A CISO's biggest enemy isn't hackers but internal chaos. When organizations try to do everything at once and fail to deliver on most commitments, they can't reduce risk fast enough, and security falls apart.
A lot of times I say for CISOs, the biggest enemy outside of the threat actor is the lack of prioritization that often exists within cyber programs. And if you try to take on too much and you don't deliver on, you know, a fair portion of your commitments, then you're absolutely not reducing risk at the desired pace.
