Why organisations remain trapped in a spiral of failure—and what it really takes to build resilience in a “when, not if” world
For all the billions invested in cybersecurity over the past three decades, one uncomfortable truth remains: Breaches keep happening. Not occasionally, but consistently, across industries, geographies, and with a greater and greater impact.
In my experience, this is not a failure of technology. It is a failure of leadership.
What I have described over the years as the “cybersecurity spiral of failure” is still very much alive in many organisations today. And unless we fundamentally rethink how we approach cybersecurity—not as a technical discipline, but as a business protection imperative—this will not change.
The Anatomy of the Spiral of Failure
To understand where we are today, it helps to look back.
Cybersecurity, as a formal discipline, is barely 30 years old. The first CISO role, as such, only appeared in 1995. In its early years—and well into the 2000s—cyber risk was largely perceived by executive teams as a “low probability, low impact” issue. It sat somewhere in the background of enterprise risk, competing with countless other priorities.
At the time, discussions around cybersecurity typically revolved around a simple trade-off: compliance requirements, vs. cost, vs. risk appetite.
The result was predictable.
Projects focused on quick wins. Once the boxes were ticked, attention shifted elsewhere. Very little was approached strategically or holistically.
Over time, this created a pattern I have seen repeated in countless organisations.
CISOs, frustrated by a lack of progress, leave after a few years. Their successors arrive with new agendas, new tools, new consultants. Existing programmes are abandoned or partially implemented. Technology stacks become bloated—sometimes with dozens of overlapping tools—while operational processes grow increasingly complex and manual.
Meanwhile, technical debt accumulates.
Scaling becomes harder. Talent becomes scarcer. Costs increase. And cybersecurity gradually becomes seen not as a value driver, but as a burden.
Breaches continue to happen. Trust gets eroded between leadership and cybersecurity teams.
And the spiral continues.
Many organisations today are still trapped in this cycle.
From Risk to Certainty: The “When, Not If” Shift
If the first decade of the century was defined by complacency, the second decade brought a wake-up call.
The explosion of cloud computing, mobile technologies, and interconnected systems and supply chains dramatically expanded the attack surface. At the same time, cybercriminals became more sophisticated, organised, and relentless. The result has been the avalanche of cyber-attacks and data breaches we continue to see today.
In this context, a fundamental shift has taken place in many boardrooms: Cyber-attacks started to be seen as a matter of “when”, not “if”.
This “when, not if” paradigm changes everything.
Risk, by definition, deals with uncertainty—events that may or may not happen. But when cyber-attacks are seen as inevitable (“when”, not “if”), the conversation shifts from prevention alone to protection and resilience.
This is where many organisations still struggle.
Execution becomes the central challenge. As several CIOs told me: “I can put anything I like in the cybersecurity budget—but how am I going to deliver?”
After years of firefighting technical issues, many CISOs have not had the opportunity to develop the management capabilities, political acumen, and leadership presence required to drive large-scale, cross-functional transformation at enterprise level.
And yet, that is precisely what is now required.
Reversing the Culture: From Compliance to Resilience
Another structural issue lies in the way organisations respond to regulation.
Too often, compliance has been seen, over the years, as the driver of cybersecurity efforts. Controls are implemented to satisfy regulatory requirements, rather than to genuinely protect the business.
In my view, this needs to be reversed.
Operational resilience and business protection must become foundational elements of corporate culture—embedded at the leadership level and cascaded throughout the organisation. Compliance should be the outcome of strong protection practices, not the starting point.
This is not just a technical shift. It is a cultural one.
And culture, ultimately, is shaped at the top.
Elevating Ownership at the Executive Level
One of the most important developments I anticipate in the coming years is the emergence of broader executive roles focused on business protection—roles such as Chief Security officer, Chief Resilience Officer or Chief Trust Officer.
These positions would bring together cybersecurity, operational resilience, business continuity, data privacy, and compliance under a single leadership umbrella.
Why does this matter?
Because the scale and complexity of today’s threats require integrated thinking and enterprise-wide ownership.
Such roles would also provide the platform—and the visibility—for senior leaders to demonstrate their ability to manage complex, cross-functional challenges.
In many organisations, this evolution is overdue.
The CISO’s Leadership Imperative
Against this backdrop, the role of the CISO has fundamentally changed.
Yet many CISOs still approach the position as technologists.
This is, in my view, the single biggest mistake.
You are not hired to prove your technical competence. That is assumed. You are hired to lead.
And leadership in large organisations is inherently complex. Enterprises are political, siloed, and shaped by competing priorities and personalities. Cybersecurity, by its very nature, cuts across all of these dimensions.
To be effective, CISOs must embrace that complexity.
Their first 100 days are critical in this regard. This is the period during which you establish yourself—not as a technical expert, but as a business leader.
And it starts with one simple principle: Listening, listening and listening.
Listening to understand how the organisation really works. Listening to uncover pain points, constraints, and priorities. Listening to map the informal networks of influence and decision-making.
I often advise CISOs to ask a simple question when engaging with stakeholders: “How can I help you?”
It is a powerful question. Because when you embed the answers into your cybersecurity strategy, that strategy becomes shared. It becomes aligned with the business.
And that is how you build credibility.
Avoiding the Trap of Quick Wins
When entering a new job, the temptation to focus on quick wins to prove yourself is strong—particularly in the face of external pressure or high-profile incidents.
But this is a trap.
If you position yourself as a firefighter, you may become highly valued in that role. But firefighters are rarely invited to the strategy table.
Over time, this leads to frustration. It limits your ability to influence. It reinforces the perception of cybersecurity as a technical function.
And ultimately, it feeds back into the spiral of failure.
Resisting this requires discipline—and structure.
I often describe the early phase of a CISO’s tenure as a rhythm: six days to map the landscape, six weeks to co-construct the strategic narrative, six months to build the operating model.
This sequencing provides a framework to navigate complexity while maintaining strategic direction.
Bridging Vision and Execution
For organisations to succeed in a “when, not if” world, alignment between CEOs and CISOs is essential.
When the CISO establishes themselves as a trusted peer—when the cybersecurity narrative is co-constructed and understood—execution becomes far more effective.
Conversely, failure to achieve that alignment may accelerate the shift toward broader, elevated executive roles overseeing resilience (Chief Security officer, Chief Resilience Officer or Chief Trust Officer). In that scenario, the CISO risks being pushed back into the technical silo where they came from.
Making Cybersecurity a Corporate Responsibility
Ultimately, cybersecurity must become part of the organisation’s DNA.
This requires visible, credible, and consistent leadership from the top. Whether it is the CEO, the CISO, or a Chief Resilience Officer or other, someone must embody and champion the values of business protection at the top of the firm.
Because at its core, cybersecurity is not about technology.
It is about protecting value creation, protecting customers, employees, shareholders, and, in some cases, society at large in the case of critical national operators.
Breaking the Cycle
There is no silver bullet to break the spiral of failure.
But there is a starting point.
It begins with ownership at the top of the organisation. Clear, unambiguous accountability for business protection. Leadership that recognises cybersecurity not as a cost, but as a fundamental component of good leadership and good management.
Whether through an elevated CISO role or a broader resilience function, what matters is having the right leader—one capable of carrying that vision across the full depth and breadth of the modern enterprise.
Because until that happens, organisations will continue to invest heavily in cybersecurity—and continue to fall short where it matters most.
JC Gaillard
Founder & CEO
Corix Partners
Contact Corix Partners to find out more about developing a successful Cyber Security Practice for your business.
Corix Partners is a Boutique Management Consultancy Firm and Thought-Leadership Platform, focused on assisting CIOs and other C-level executives in resolving Cyber Security Strategy, Organisation & Governance challenges.