Two CISOs argue that security leaders waste resources chasing shiny tools instead of building long-term roadmaps. They say every technology purchase, from GRC to IAM, must tie to broader programs like zero-trust or data protection, with dedicated managers and governance. Without this structure, security teams burn out and miss their actual risk.
Chapters
I mean, cybersecurity is a long game. If you're just there to respond to what's happening, you're gonna lose, you're gonna burn out, you're gonna waste your resources, you're not going to last. Whereas when you have a roadmap here, that gives that strategy. What are we investment in? How is that tied to those risks? How are we going to perform and optimize moving forward? The only question I have for you, and my only criticism on this one, You know, it's require a roadmap. And again, if we're a technical CISO, we're looking at as a technical roadmap, right? These are the products I'm going to buy. Whereas I'm thinking it's not just what products you're going to buy, but what are the policies? What are the services? What are the business targets? What is the competitive advantage I'm bringing in? And that is part of the roadmap, not just the security toys and the shiny objects that you need budget for. Yeah.
I talk a lot about that too. I always say it's programs, not projects, right? Anything you need that's technology fits into a program of some kind, right? If you're buying a GRC tool, you should have a risk management program with program managers and people assigned to it. And if you're putting a DLP tool in place, you've got data protection people, you've got boards making decisions. There's all of this, it's all programmatic. And a lot of times that's what, That's what the roadmap items may be. Hey, we are updating our identity and access management system to this, but that's part of our larger program for zero trust that's happening, right? So that should all be tied back to programs. I'm right with you. No shiny, no chasing shiny.
