Do you want to be a better manager? Here is the fourth piece of advice in an occasional series. Remember, these processes are usually free and have high ROI. Ready? OK: Keep a journal . Not what you expected, was it?  I know. You don't have time, can't actually be real, what is this the 16th century, etc. The goal of journaling in general is to offer the journaler a chance to be alone with their thoughts for a little bit. This is not about writing a novel or answering questions. It's time to process what happened, reflect on high points and low points, goals for the future, etc. The benefits of journaling include having a chance to work out your (negative) feelings about office events, relive your (positive) feelings about office events, a private opportunity to think through options, and keep positive details from your daily life in focus. Here is how Michael Phelps, Olympic multi-gold medalist swimmer, puts it: “As long as I’m doing something right or something positive t...

Do you want to be a better manager? Here is the third piece of advice in an occasional series. Remember, these processes are usually free and have high ROI. Ready? OK: Now discover your strengths and limitations . An inspection is not the time to be surprised, especially when you think something should be there and it's not.  Ask yourself, then: what do you expect when you review your logs, check your patches, or assess your system's functions?  Or, on the behavioral side, what about when you assess your candidates, review employee performance, or assess your team culture? If you have the same look as Mr. Alfozan in the picture above, you are like most managers and you probably have a talent issue -- both theirs and yours. Let's inspect the inspector. The four pillars of a successful cybersecurity team are hire for talent, build structure, create engagement, develop your people. Get those right and you're invincible. But too often managers are not invincible, despite k...

Do you want to be a better manager? Here is the second piece of advice in an occasional series. Remember, these processes are usually free and have high ROI. Ready? OK: Manage employee leave better . We have posted about the four pillars of an effective cyber-defense team : hire for talent, build structure, create engagement, develop your people. Managing employee leave is one way you create engagement and build structure. Research by Kossek et al. (2026, open access ) examined what happened when immediate supervisors learned to encourage employees to access, use, and value paid leave as a resource for managing nonwork time-off demands. The study was conducted at two universities, one of which was randomly assigned to manager training and the other to a wait-list. (Randomizing universities instead of managers keeps trained managers from passing the training along to colleagues in the control group.) The focus was managing leave-taking. You probably think that this is a "no-brainer...

  Do you want to be a better manager? If you want to be a better manager, you have to improve your management skills. It is highly likely that you were promoted or hired into a management/leader role based on technical skills or program management skills or financial management skills, that is, not based on your general management skills. Even if you were hired/promoted based on management talent the question remains: do you want to be a better manager? Don't avoid this improvement path by trying to over-achieve. You don't have to seek to be the "best" manager. You only need to work to be a better manager. Same advice if you think it's too hard or you claim you don't have time or you think it doesn't matter, or if no one else in your opinion cares or tries. The question is whether you want to be a better manager. Our work with clients shows that bad managers say "no" to this question for all the rationalizations we've mentioned -- busy, doe...

A wise salesman once said that fishing lures don't need to attract fish in order to be sold: they need to attract fishermen. As someone who grew up in a fishing family I can confirm that lures are often bought based on fisherman enthusiasm alone. Does this selection method lead to endless success in landing fish? No, it does not. I fear that there is a similar dynamic at work in the cybersecurity market: products tend to fall into one of two categories. The first category consists pieces of technology, marketed to technologists for use by technologist, which makes sense. The second category consists of management consulting services, marketed to executives but aimed at technologist procedures and processes, which doesn't really make sense. (If you want help with the technical side of cybersecurity, why not go to a specialist firm, such as Pythia Cyber or CI-Discern , instead of a general-purpose management consulting firm?) Why aren't management consulting firms selling you...

Human behavior is a huge part of cybersecurity, say I and everyone in the room nods sagely. But like Lake Woebegone, where all the children are above average, in Cybersecurity Culture we all seem to be immune to the foibles of the human psyche. What does that mean? An example will help. One of my buddies in college, JG, was an applied math major with a penchant for mechanical engineering courses. At a deep level these two fields are closely related. But they are not the same, especially with respect to the personality traits of the practitioners. This fact first came to my attention when JG joined other of my friends in taking a course entitled "Design Optimization and Failure." JG loved this course. He loved using Finite Element Analysis to figure out which part in a complex system would fail first, which set the standard that all the other parts would be held to. He loved the head-spinning math required to constantly re-assess as they tried to make a complex system a bit st...