Cybersecurity has a branding problem.
We sell it as defense. We talk about protection, resilience, best practices, maturity models, and “doing the right thing.”
That’s the surface game. The deeper truth is simpler and more uncomfortable
Cyber is not primarily a technical discipline. Cyber is a power discipline.
And once you see that, you stop being surprised by outcomes that seem irrational on paper.
You stop asking why competence doesn’t always win.
You stop being shocked when the most secure solution doesn’t get funded, or when the most qualified team gets ignored, or when the organization repeats the same mistakes while insisting it’s “committed to security.”
Because you finally understand the game beneath the game.
The lie isn’t malicious. It’s just incomplete.
The lie is that cyber outcomes are determined by; technical competence, effort, intelligence, tools, frameworks, audits, policies, and compliance
Those matter. But they are not the main driver. In most environments, the deciding factor isn’t “What is secure?”
It’s; Who controls the decision? Who bears the consequences? Who benefits from delay Who owns the narrative?
Cyber is where power becomes visible, because cyber is where risk becomes real.
And real risk exposes who actually runs the system.
Power isn’t a loud person in a room.
Power is; what gets approved, what gets ignored, what gets delayed, what gets escalated, what gets buried, what gets framed as “not urgent”, what gets reframed as “not possible”, what gets outsourced to “next quarter”, and what gets treated as “someone else’s problem”
In cyber, the winners aren’t always the people who know the most.
They are the people who control:
If you want to understand why cyber is hard, stop looking at the technology.
Look at those three levers.
Cybersecurity is full of “should.”
We should patch faster. We should implement least privilege. We should reduce attack surface. We should invest in detection. We should segment networks. We should kill legacy.
But in most organizations, “should” loses to incentives. Because incentives determine behavior.
A few examples:
This is why cyber work often feels like pushing a boulder uphill. You’re not fighting technology.
You’re fighting the reward system.
Most cyber failures aren’t caused by lack of data. They’re caused by narrative failure.
A breach is not only an incident. It’s a story; what happened, why it happened, who warned, who delayed, what was funded, what was denied, what was “out of scope”, what was “too expensive”, what was “not urgent”
If you don’t control the narrative, your expertise becomes irrelevant.
Because the organization will do what it always does; simplify complexity, compress nuance, assign blame, protect reputations, preserve power structures, and call it “lessons learned”
In cyber, the person who can explain reality clearly, without emotion, without drama becomes the most dangerous person in the room.
Not because they’re loud. Because they’re undeniable.
Here’s the dirty secret of governance. Most cyber policies are not policies.
They’re wishes.
A policy without enforcement is a suggestion. A suggestion without consequences is a joke.
Organizations love to publish standards. They rarely love to enforce them.
Because enforcement creates friction. And friction creates conflict. And conflict reveals power.
So cyber becomes this strange theater, where everyone agrees security matters, while silently training the system to ignore it.
If you want to predict outcomes, don’t look at what the policy says. Look at what happens when someone violates it.
That’s the real rule.
Once you accept cyber as a power game, certain patterns become obvious.
Vague ownership is not an accident.
When ownership is unclear; accountability dissolves, timelines slip, blame becomes optional, “alignment” becomes endless
Ambiguity is not confusion. Ambiguity is leverage.
Cyber can be stalled forever using; procurement, legal review, “architecture approval”, committees, risk acceptance loops, endless meetings, and “let’s revisit next quarter”
Process is supposed to enable execution. But in power games, process is used to prevent execution.
Some systems are kept insecure because insecurity is useful.
So the system remains fragile, because fragility protects someone’s relevance.
Cyber is full of authority signals; titles, certifications, vendor badges, frameworks, maturity scores, and glossy reports
Authority signals can be valuable.
But they can also be used as camouflage, optics instead of outcomes.
The most common cyber attack inside an organization is not ransomware.
It’s; scope creep, last-minute urgency, rework, endless “alignment”, and priority whiplash
Competent people get punished because they fill gaps.
That’s not just inefficient. It’s structural exploitation.
If you don’t see cyber as power, a predictable thing happens.
You become the organization’s shock absorber.
You absorb; anxiety, urgency, risk, blame, emotional load, impossible timelines, and political fallout
And you keep absorbing it because you’re competent.
Competence is not always rewarded. Sometimes competence is exploited.
That’s why the best people burn out. Not because cyber is hard.
Because the system is designed to offload cost onto the responsible.
Seeing power doesn’t mean becoming cynical. It means becoming effective.
Here are the rules that separate security professionals who survive from those who get consumed:
If it matters, it must be:
If someone wants vagueness, it costs more:
Without risk acceptance and funding approval, our recovery time is four days, not four hours!
Arguments don’t change systems. Leverage does.
Leverage looks like:
Emotion is human. Procedure is power.
In cyber, you don’t win by being right. You win by being documented.
This is the highest form of authority. Not “look how smart I am.”
But; “Here is the structure that will make you succeed.” The best cyber leaders are not mascots. They are architects.
Not because security is unimportant, but because control determines what gets enforced.
If you want to understand cyber outcomes, stop asking:
“What is the secure thing to do?”
Start asking:
Cyber is where power becomes measurable.
Because once you see the game beneath the game, you stop begging for alignment. You start enforcing reality.
*Disclaimer*: *Views expressed are personal and do not represent any employer*