Most organisations don’t struggle with cybersecurity strategy anymore. The documents are in place, aligned to global frameworks, mapped to regulatory expectations, and often backed by significant investments in tools. On paper, everything looks strong.
Yet, when incidents happen, the same gaps keep surfacing.
In my experience, the issue is rarely the strategy itself. It is the operating model—the way security actually runs on a day-to-day basis.
Who takes a call when something suspicious is detected?
Who owns the response?
At what point does it get escalated, and to whom?
And perhaps most importantly—who is accountable if something is missed?
If these questions do not have clear answers, even the best strategy begins to unravel quietly.
I have seen environments with advanced tooling—SIEM, SOAR, endpoint controls, network security layers—where everything is technically “in place.” But during a real incident, there is hesitation. The IT team assumes the CISO team will take the lead. The CISO team expects IT to act first. Escalations happen late, sometimes after the situation has already expanded. The tools are working. The system is not.
That is the difference between having controls and having control.
A sound operating model brings a few things into sharp focus.
First, clarity in decision-making. During an incident, there is no time for debate. Ownership must be predefined—who can isolate a system, who can block access, who can accept risk.
Second, alignment between teams. The first line and the second line must work as a system, not in silos. Oversight without visibility is ineffective, and execution without governance leads to inconsistency.
Third, structured escalation. Incidents do not manage themselves. Clear thresholds, defined paths, and time-bound actions make all the difference when minutes matter.
And finally, accountability that is real, not implied. Security cannot sit only with the CISO’s office. It has to be embedded across technology and business functions, with the CISO ensuring it is actually working.
The organisations that do this well treat their operating model as something that evolves. They test it, stress it, and refine it—especially as their technology landscape changes.
Because in the end, cybersecurity is not about what is written in the strategy deck. It is about what happens in the moment when something goes wrong.
And that moment does not test your strategy. It tests your operating model.
