In Cybersecurity, Speed Is No Longer a Luxury
In this era where artificial intelligence is simultaneously reshaping the business world and the threat landscape, expectations for cybersecurity teams have fundamentally changed. It's no longer enough to simply "be secure"; speed is also essential. The advantage for defenders lies not in technical expertise, but in their ability to adapt to change.
Google and Goldman Sachs are among the organizations where Phil Venables served as CISO. His analysis offers practical insights for executive leadership. The fundamental question is: How is speed gained — and is the discourse of speed truly applicable?
Why Now? The Strategic Importance of Speed
Cyberattacks are no longer the work of individual hackers; they are the work of organized and industrial attack infrastructures powered by artificial intelligence tools. The time between these groups identifying and exploiting a vulnerability and defense teams deploying a patch has dramatically shortened.
The OODA cycle (Observe, Direct, Decide, Act) used in Venables' analysis originates from military strategy, but it's a framework perfectly suited for enterprise cybersecurity. It's a widely accepted fact that if the defender's cycle operates faster than the attacker's, the organization will often have the upper hand. What senior management needs to understand is this: This isn't a technology race, it's a race for speed of decision-making.
Stewart Brand's Pace Layers framework offers a valuable conceptual tool at this point: Every system contains both fast layers (technology, tools, trends) and slow layers (culture, governance, infrastructure). Fast layers drive innovation, while slow layers ensure stability. Increasing speed in cybersecurity means intelligently managing the tension between these two layers.
Critical Areas of Action for Senior Management
Venables identifies eleven concrete areas for increasing enterprise speed. While all of these involve technical details, four of them carry particular strategic weight from the perspective of senior management:
1. Accelerating Decision Cycles
One of the biggest obstacles facing change enforcement teams is corporate bureaucratic processes. But this is not an unchangeable fate. Leading institutions in highly regulated sectors such as banking and energy have radically streamlined their change approval processes over the past decade. Many changes now go through automated approvals, with actual human oversight only coming into play for high-impact interventions.
The lesson for senior management is this: Change approval boards should not be defended on the grounds that aggressors will always be more agile because they lack bureaucratic constraints. Rather, these boards should be deliberately redesigned. The goal should be "move fast and fix things," not "move fast and break things"; a controlled, measured agility should be built.
2. The Role of the Board of Directors: From Passive Control to Active Acceleration Catalyst
It is no longer sufficient for boards of directors to assess cybersecurity solely in annual reports. How the board operates directly impacts how quickly management can act. Risk thresholds and limits (high-speed exception handling), scenario analysis (rapid probabilistic planning), and post-incident learning cycles can become mechanisms that actually strengthen the board's security program.
The critical point here is that the board needs to become a supportive and accelerating structure for the CISO, rather than acting as a passive auditor. The deeper the board's expertise in cybersecurity, the faster and more confidently executive decisions can be made.
3. Autonomous Security Operations: Beyond Automation
Many organizations assume they've solved their security problems once they've automated their processes. However, there's a crucial difference between automation and autonomy. An automated environment is a system that operates with human guidance but at an accelerated pace. An autonomous environment, on the other hand, is a self-protecting system that responds proactively to threats on its own.
Google's approach in this area — which Venables explicitly refers to — proposes building the defense architecture from the ground up on the principle of autonomy. This is not just a technology investment; it is also an architectural philosophy decision. Senior management should reflect this transformation as a strategic priority in budget and resource allocation.
4. Risk Convergence: The Way Out of Plurality
Organizations often manage cybersecurity, privacy, operational reliability, and compliance risks in isolated silos. This approach leads to both wasted resources and slowed progress. Risk convergence makes it possible to reuse and adapt existing mechanisms by identifying the common goals and infrastructure of these controls.
While this approach seems highly attractive in theory, it presents significant institutional and political challenges in practice. Redefining risk ownership among multiple entities disrupts power dynamics and encounters cultural resistance. Senior management must bear this reality in mind; they should position risk convergence not as a one-off project, but as a long-term transformation program.
A Critical Assessment: What's Right, What's Missing?
Venables' analysis is well-founded, stemming from the perspective of an experienced practitioner. All of the proposed frameworks are real and reliable: the OODA cycle, Velocity Layers, autonomous safety operations — these are all concepts that have counterparts in the literature and in practice.
However, senior management needs to be cautious in some areas:
• The claim that "it's not about talent, it's about willpower," while motivational, can be unrealistic. Many organizations face structural obstacles such as budget constraints, legacy debts, and a lack of talent. Attributing these obstacles to "lack of willpower" makes it difficult to find concrete solutions.
• The claim that "defenders have a structural advantage in the use of AI" is debatable. Attackers also benefit from AI; moreover, they are exempt from constraints such as compliance obligations, change management, and accountability. While this advantage is real, exaggerating it can make defenders dangerously overconfident.
• Deception technologies and moving target defense are presented optimistically in the text. However, these technologies have historically faced limited adoption and mixed results. Their maturity levels and implementation costs should be carefully evaluated before investing in them as a strategic speed tier.
• Control reliability engineering (SRE for Controls) is conceptually valuable, but it is not yet a fully mature discipline. Top management should embrace it not as a recipe for a solution, but as a principle worth exploring.
Three Priority Steps for Senior Management
To put this analysis into practice, three steps are suggested that senior management can take today:
• Measure the speed of decision-making. Track the time between the detection of a vulnerability and the deployment of a patch. Compare this time to industry benchmarks. What cannot be measured cannot be improved.
• Increase the frequency of the board's cyber agenda. Create a structured cybersecurity agenda for each quarter, not just annually or semi-annually. Pre-determining risk thresholds significantly increases decision-making speed in times of crisis.
• Prioritize investment in platform-based security. Instead of adding security layer by layer, transitioning to platforms where security is built-in by default provides both speed and cost advantages in the long run. This is not a single project; it's a multi-year architectural transformation program.
Conclusion: Speed is not a technical detail, it's a strategic choice.
In cybersecurity, speed is no longer just an internal matter for security teams. Software delivery speed, board decision frequency, convergence of risk management frameworks — all of these are areas shaped directly by top management decisions.
Venables' framework, while acknowledging that not all its proposals are equally weighted and that some are far more difficult to implement than anticipated, points in the right direction: moving quickly does not mean losing control. On the contrary, when speed and discipline are built together, defenders can gain a structural advantage over attackers.
The message for senior management is clear: Cybersecurity speed starts with a leadership choice, not a technology choice.
First published: LinkedIn, 2026-03-10 13:26. Original article: https://www.linkedin.com/pulse/siber-g%C3%BCvenlikte-h%C4%B1z-art%C4%B1k-bir-l%C3%BCks-de%C4%9Fil-melih-%C3%B6zhan-xe40f
Comments