Promotability & Performance -- If Only It Were That Simple

Every security team has one: the analyst who triages faster than anyone else, the engineer who reads a packet capture like a second language, the threat hunter whose instincts catch what the tooling misses. When a leadership slot opens up, that person is the obvious pick. They're the strongest performer on the team.

They are also, disproportionately, a bad bet for the management role, a specific kind of risk most security organizations aren't measuring. The reason is more precise than "not everyone is management material." Performance and potential are different psychological constructs, predicting different outcomes, and most security talent pipelines quietly collapse them into one.

Here are five key points for you to remember in your review of performance v. potential.

First point: climbing is not the same skill set as performing.

Advancing in an organization and performing at higher/management levels draw on overlapping but distinct profiles. The people who get noticed for leadership roles tend to be confident, visible, ambitious, socially fluent -- they are "ready." The people who actually deliver once they're in a broader, more ambiguous role tend to be diligent, outcome-focused, and able to operate with less structure and less certainty than the role they came from. Those are not the same profiles.

Many organizations make the problem worse by creating (not making this up) "baseball cards" of their leadership bench, reducing their potential leadership promotee benches to two-dimensional sketches.

In security settings specifically, "climbing" signals get read straight off performance data: fastest MTTR, most vulnerabilities found, most reliable detection engineering. Those are legitimate signals of execution. They are not evidence that someone can run a team, absorb ambiguity for a living, deal with other people's problems, or deliver in a role two levels removed from the one they've mastered. 

Treating strong current-role performance as a proxy for future leadership readiness is where security succession planning most often goes wrong.

Second point: potential is a risky bet.

It's worth separating two things that get flattened into a single "high potential" label: being designated high-potential and later actualizing that potential. Actualizing is validating the original potential risk bet through exceptional performance, stretch capability, and sustained effectiveness across promotions and unfamiliar terrain.

Most high performance (HiPo) candidate systems stop at designation. They identify who looks promising right now and never test whether the person can actually scale. That gap matters more in security than in most functions because the cost of a wrong bet isn't just a disappointing quarter, it's a strained team during the next incident, run by someone still finding their footing, resulting in a disclosure filing.

A second complication: the characteristics that predict success change by level. What differentiates incumbents at the team-lead or manager tier is delivering results, taking on stretch assignments, and collaborating well -- much of which resembles strong individual contributor behavior. At the leader/executive-and-above tier where the job is enterprise risk posture, board communication, and talent strategy, the differentiators shift toward strategic thinking, organizational acumen, and the ability to inspire and develop others. A model that correctly identifies strong SOC managers will not reliably identify future CISOs and vice-versa. "Potential for what role, at what level" is not a rhetorical question, it changes the assessment entirely.

Third point: ability alone doesn't settle the risk management leadership question.

A century of research across multiple independent teams shows cognitive ability is the strongest single predictor of capacity to learn and apply new material. This is a large part of why it matters for job performance. Ability tells you whether someone can handle the complexity of a broader role but it says very little if anything about how they'll execute the role -- their interpersonal style under pressure, their tolerance for ambiguity, what motivates them, where they're likely to derail. This distinction is known as can-do v. will-do. 

Motivation to lead matters, but it's not one thing. Wanting to lead, including genuinely enjoying it and seeing leadership as part of one's identity, is a real and useful signal associated with better leadership emergence and effectiveness down the line. But motivation driven by social expectation ("I should want this") or a sense of obligation is a different, weaker signal. The desire to move into leadership is evidence worth gathering. It is not, by itself, evidence of readiness.

Fourth point: the right human capital risk management question is not "have they delivered here" but "can they deliver there?"

For a security analyst being considered for a leadership track, the useful question isn't whether they closed the most tickets last quarter. It's two things:

a. how they reason, prioritize, and influence when the problem doesn't look like anything in their playbook;

b. what they gravitate toward as a leader -- governance, detection, strategy, resolution, etc. 

Not every leader is good at all aspects of leading, and that's OK. Really it is. Sometimes you need a diplomat and sometimes you need a warrior. 

A "high potential" cohort is rarely one thing. Cluster people who've been designated HiPo and you typically find meaningfully different subgroups hiding under a single label -- MBAs, cyber-gurus, people with charisma, etc. Treating your HiPo list as a uniform group misses exactly the variation that predicts who scales and who doesn't.

Fifth point: what this means for a security leadership pipeline

All leaders need to be technically proficient to be credible, but promoting on technical proficiency alone without vetting for the talents that predict leadership success is a human capital risk.

That's the gap the Pythia Cyber Cybersecurity Talent Stack Assessment is built to close. It's built specifically to capture a candidate's capacity to lead a cybersecurity function. It minimizes your leadership talent pool risk by indicating what aspect of leadership they gravitate toward. We align the assessment relative to the NIST CSF framework. That way you know how this person wants to lead. Then it's up to you to decide whether the candidate's talent and experience are going to minimize risk in your environment.

Ask us how we can help you create a 3-D promotion pathway for excellence.