That is a leadership and management requirement, not something structural separation can solve on its own.
Cybersecurity may be undermanaged, not just underfunded
Security spending tells a similar story.
Cybersecurity investment has risen substantially over the past decade, and some organisations undoubtedly still require more resources.
But persistent weaknesses after years of increasing expenditure should lead executives to ask whether funding is always the central issue.
Money can buy technology, people and expertise. It can finance transformation and accelerate remediation.
What it cannot automatically do is establish strategic priorities, create clear accountability, resolve organisational politics, force collaboration or ensure transformation programmes achieve their objectives.
Again, those outcomes depend on leadership and management.
Cybersecurity can be underfunded, but quite often it is also undermanaged.
The distinction matters because it changes the executive conversation from “How much more do we need to spend?” to “Are we converting the investment we already make into sustainable capability?”
Compliance is necessary, but it cannot substitute for management
The expansion of regulation and certification schemes has created genuine benefits. It can establish minimum standards, impose accountability and force cybersecurity onto executive agendas.
But compliance has inherent limitations.
An organisation can satisfy formal requirements while carrying substantial structural weaknesses. An audit finding can be closed without addressing the management problem behind it. Certification can demonstrate that processes exist without proving that an organisation will behave effectively during a serious incident.
When showing activity becomes more important than building sustainable capabilities, compliance runs the risk of providing reassurance without necessarily delivering protection.
Board awareness was only the first step
Over the past decade, cybersecurity has also achieved something the industry demanded for years: It has reached the boardroom.
That matters, but board visibility does not automatically produce effective governance.
Many organizations are totally technology-dependent and their boards already understand the importance of cyber protection and resilience
The old argument that CISOs need to convince boards of the importance of cybersecurity and the need to invest in it, is increasingly outdated.
The more important issue is what boards do next.
Boards should challenge whether strategic priorities are clear, whether executive accountability is effective, whether transformation is progressing and whether investment is creating sustainable capability.
They also need to understand whether assumptions about resilience have been tested.
Board awareness was necessary. Board responsibility is the more important issue now.
Breaking the cybersecurity spiral of failure
These management weaknesses help explain why cybersecurity transformation repeatedly loses momentum.
A serious incident creates urgency. Urgency releases funding. Remediation accelerates and visible progress is made.
Eventually, the pressure declines. Executive attention moves elsewhere. Longer-term structural problems become harder to prioritise. Transformation slows down. Then another incident restarts the process.
I have described this as the Cybersecurity Spiral of Failure.
Organisations can spend substantial amounts during every cycle and make genuine technical improvements while leaving intact the management conditions that created the weaknesses in the first place.
Poor accountability remains. Governance struggles with difficult decisions. Priorities change. Corporate or geographical silos inhibit execution. Short-term pressures displace long-term transformation.
Breaking that cycle requires management discipline and strategic continuity — not simply another security programme.
Cybersecurity cannot remain the CISO’s problem
Perhaps the most important lesson is that cybersecurity cannot become sustainable while organisations continue treating it primarily as the CISO’s responsibility.
The CISO has an essential role in providing expertise, strategic direction, coordination and challenge.
But the organisation must execute.
The CIO needs to ensure technology architectures and services are secure and resilient. Business executives need to accept accountability for the processes and applications they own. Corporate functions must discharge the security responsibilities attached to their authority. Executive management must resolve competing priorities. The board must provide oversight and strategic continuity.
The CISO cannot substitute for those responsibilities.
The principle should be straightforward: Accountability must follow authority.
The objective is not to turn every executive into a cybersecurity specialist. It is to make cybersecurity part of normal management.
The technology will change. The management principles won’t
There will always be another technology wave.
AI will continue to transform business practices. Quantum computing may force major cryptographic transformation. Cloud architectures will continue evolving. Digital ecosystems will become even more interconnected.
The security industry will respond with new products, frameworks and methodologies.
But organisations need management principles capable of surviving those technology cycles: Clear priorities. Accountability aligned with authority. Governance capable of turning disagreement into decisions. Strong CIO-CISO collaboration. Genuine business ownership. Sustained board oversight. And disciplined execution.
That brings us back to the question we started with: Why do cybersecurity observations from 2015 still sound so contemporary?
Because many of the hardest cybersecurity problems were never primarily technological.
They concern leadership, accountability, governance, organisational politics, short-termism and execution. They cannot be patched, outsourced or solved simply by moving the CISO to another reporting line.
They have to be managed.
Cybersecurity has become a core business protection capability. It is fundamentally a management challenge supported by technology — not a technology challenge that management somehow needs to accommodate.
