Security advice has to survive real constraints

I sometimes think the cybersecurity industry does itself a disservice.

We spend a lot of time talking about what good looks like and not nearly enough time talking about what reality looks like.

Reality is a healthcare organization trying to modernize while keeping clinical systems running, a manufacturer carrying a piece of software nobody would buy today but everybody depends on, or an IT leader who knows exactly what should be fixed first but is also being asked to support growth initiatives, reduce costs, improve user experience, adopt AI, and somehow make risk disappear at the same time.

Most organizations aren’t struggling because they don’t know what the frameworks say. They’re struggling because there are more good ideas than there is time, budget, and capacity to execute them.

That’s why I’ve become less interested in maturity scores and more interested in judgement.

The best security leaders I meet are rarely the ones with the most tools, the most certifications, or the most polished presentations. They’re the ones who understand their environment, know where the real risks are, and can explain why they’re doing one thing now and something else six months from now because they understand that every decision comes with tradeoffs.

One of the most effective security leaders I know once told me that every roadmap is really an exercise in deciding what not to do. That has stuck with me because most organizations aren’t suffering from a lack of ideas. They’re suffering from a lack of capacity to execute all of them at once.

Security doesn’t happen in a lab, on a conference stage, or in a vendor slide deck. It happens inside real organizations with real constraints, real people, competing priorities, and leaders who are constantly balancing risk against everything else the business is trying to achieve.

Sometimes I think we’d make more progress as an industry if we spent less time asking whether an organization has implemented every best practice and more time asking whether they’re making sound decisions with the resources they actually have.

Curious if others see the same thing.

Are the biggest security gaps you encounter really technology gaps, or do they more often come down to prioritization, ownership, and execution?

Depending on your answer, if willing, huge kudos to you if you could share one or two real life examples?