We can have a risk framework, a clear policy and a dashboard full of measures, and still struggle to make a sound decision or follow through on it. The way we behave determines whether people bring us the facts, challenge an assumption and do what they said they would do.
That is why behavior belongs in the conversation about cyber risk management. The 18 behaviors in the accompanying graphic become useful when we connect them to the situations we face at work. Here is what that looks like in practice.
Let your actions establish the standard
Letting our actions speak, staying grounded in our values and leading by example start with consistency. If we ask people to disclose mistakes, we need to acknowledge our own. If we expect evidence before a risk is closed, we need to apply that standard when the finding is inconvenient for our own project.
Consider a control that has been implemented but never tested. A deadline does not make it effective. We should report what is complete, what remains unverified and what decision is needed. Making the status look better may ease one meeting while leaving the underlying problem untouched.
Managing our ego matters here too. When someone challenges an assessment, examine the evidence before defending the answer. A useful correction should improve the decision, regardless of who made it or what title they hold.
Stay curious when the answer seems obvious
Curiosity means asking how the work actually happens. Before calling a team resistant to a security requirement, find out whether the requirement fits its systems, responsibilities and operating conditions. We may discover a dependency or constraint that our assessment missed.
Adapting to change and learning from setbacks require the same discipline. If a rollout fails, examine the assumptions, handoffs and testing that led to it. Decide what needs to change, assign the work and check the result. Calling something a lesson learned achieves little if we repeat the same approach next time.
Make progress worth the time it takes
Activity, priorities and respect for time belong together. We can close many easy tickets while a consequential exposure remains unresolved. Before celebrating the volume, ask what changed for the business and what evidence supports that conclusion.
Prioritizing also means deciding what can wait. When everything is presented as urgent, we leave people to resolve the conflict themselves. Be explicit about the trade-offs and the work we are choosing to delay.
Respecting time is practical: arrive prepared, make the requested decision clear and bring the people who can help resolve it. Another meeting is useful when it removes a blocker. Repeating the same status without changing anything consumes time that could have gone into the work.
Build trust through follow-through and clear communication
Honor commitments by being specific about the outcome, owner and date. If a dependency puts delivery at risk, communicate early enough for others to act. Silence does not preserve confidence when people are planning around a promise we can no longer keep.
Give credit to the people doing the work, including those whose contribution is less visible. Listen before judging a missed deadline or an unexpected response. Empathy helps us understand the problem and agree on a realistic next step while keeping responsibility clear.
Communicate the issue, its consequence and the decision needed in language the audience can use. Feedback should identify the gap and help someone address it. Sarcasm and jargon can make a straightforward problem harder to discuss. Clarity and kindness make it easier for people to raise concerns before those concerns become larger problems.
Care about the work and the people doing it
Taking pride in our work includes checking whether it is useful, accurate and complete. It also means noticing when frustration or fatigue is affecting our judgment and making time to reset.
Celebrate progress with something concrete: a recovery test completed successfully, a difficult dependency resolved or a teammate who developed a new skill. Recognition helps people see what good work looks like.
Protecting personal energy requires more than telling people to rest. Make room for recovery, reasonable boundaries and life outside work, including our own. If the plan only works while everyone keeps sacrificing that time, we need to examine the plan.
Choose the outcome you can stand behind later
Long-term impact becomes tangible in small decisions. We can accept a temporary workaround when circumstances require it, but we should make the remaining exposure, ownership and review point explicit. Otherwise a quick win can become a permanent problem that nobody remembers choosing.
The same applies to ethics and credibility. Hiding uncertainty, taking someone else’s credit or overstating a result may make today easier. It makes the next honest conversation harder.
Start with one behavior you can change
Look at a recent decision, meeting or setback. Where did our behavior help? Where did it create delay, silence or unnecessary work? Choose one concrete change, such as reporting a delivery risk earlier or asking for contrary evidence before closing an assessment.
These behaviors need practice, especially when time is short and the answer is uncomfortable. Their value becomes visible in the decisions we improve, the commitments we keep and the way people can work with us.
The original one-page graphic below brings all 18 behaviors together as a reference.
By Carlos Morales, author of Cyber Risk Management in Practice.
Leave a Reply