English is my third language. Early in my career, I’d walk into meetings knowing the technology and still struggle to get my point across. Over time, I realized language wasn’t the real obstacle. Tension was.
What helped was learning to relax and practicing before I needed to speak. I shared that experience in my TEDx talk, “How to Overcome Accent Anxiety.”
The same lesson applies to cybersecurity leadership: knowing what to do and being able to do it under pressure are not the same thing.
At the October 5 Cyber Resilience & Leadership Summit in Toronto, I led a workshop called “Calm Is a Control: How Cyber Leaders Stay Sharp When Everything Breaks.”
When something goes wrong, security leaders need to figure out what happened, decide on the next steps, keep the team working together, and update the execs. And through it all, they have to admit what they’re still unsure about.
Knowing the technical side is always important. But that alone doesn’t mean we’ll communicate clearly or make the best decisions.
That’s why I treat calm as a practical tool. It’s about how leaders show up in tough moments—not just about technical fixes. Staying calm lets us put our training to work, stick to our plans, and make thoughtful calls when it matters most.
Incident exercises aren’t just about checking boxes. They should push us to ask:
When someone says, “We’ve contained the incident,” the next question should be: what evidence supports that? Asking isn’t a lack of confidence. It’s how we check that our confidence is justified.
It’s tough to expect teams to keep their cool if they’re not sure the tools they’re counting on are actually working.
Preparation is all about cutting down on surprises before an incident hits. Are your protections really set up the way you think? Has anything changed recently? Where are the real gaps that need attention?
At Discern, we help teams answer those questions through continuous control validation, configuration drift detection, contextual prioritization, and tracked remediation, including verification that fixes worked.
This isn’t a substitute for digging into incidents or using your judgment. What it does is give teams a solid place to start—and real data to guide their next steps, not just vague reassurances.
As you think about Cybersecurity Awareness Month, don’t just focus on what people should know—think about what actually helps them do their best work when it counts.
Have those tough conversations ahead of time. Be upfront about what you know and what you’re still figuring out. Bring that same approach to your security setup—double-check your controls, fix what matters, and make sure everything’s actually working.
Public speaking taught me that knowing my subject was only half the preparation. Cybersecurity leadership deserves the same attention.
This Cybersecurity Awareness Month, check the controls you’re counting on.
Discern helps security teams spot what’s changed, focus on what matters most, and make sure fixes really stick. Want to see it in action?
