Leadership in the Cyberworld
“The greatest enemy of knowledge is not ignorance; it is the illusion of knowledge.”
- Stephen Hawking
For as long as I can remember, experience has been one of the greatest advantages of leadership. You spent years learning your profession, making mistakes, finding answers, and eventually you found your rhythm as a leader. Experience didn't guarantee you had all the answers, but it usually gave you a pretty good idea of where to start looking.
Technology is changing that advantage.
There might not be a better example than cybersecurity. The threats facing organizations are evolving so quickly that yesterday's expertise can become outdated before tomorrow's threat is even developed. Artificial intelligence has accelerated both sides of the battle. Software weaknesses can be adversely affected faster. Third-party vendors have expanded the number of potential entry points into an organization. Employees can unknowingly introduce risks through technology leadership may not even realize they are using. The 2026 Verizon Data Breach Investigations Report found third-party involvement in 38 percent of breaches and a non-intentional human element in 62 percent. Cybersecurity is no longer simply about protecting computers. It requires protecting an organization whose technology, employees, vendors, customers, information, and reputation are increasingly connected.
That creates a leadership challenge that extends far beyond cybersecurity. What happens when the person responsible for leading an organization cannot possibly be the expert on every problem facing it? The answer is not for leaders to pretend to know more. The answer is to develop a different understanding of what leadership requires when expertise becomes too broad for any single person to possess.
Trust Yourself Enough to Admit What You Don't Know
Too often we confuse confidence with competence. There is a myth that strong leaders are expected to have answers and that the higher someone climbs within an organization, the greater their responsibility becomes to provide them. Eventually, leaders can begin to believe that admitting they don't know something diminishes their authority. Instead of asking questions, they make statements. Instead of searching for smarter people, they cover their asses by trying to sound smarter than they are.
I have always believed the opposite. The greatest confidence a leader can possess is complete trust in themselves. That doesn't mean believing you know everything. It means knowing exactly what you do well, and knowing what your weaknesses are, and never feeling threatened when someone else's strengths take off from there. A leader who trusts themselves doesn't lose authority by saying, "I don't know." They gain the opportunity to ask the much more important question: "Who does?"
I spent my career working around incredibly specialized people. Team physicians understood medicine better than I did. Athletic trainers understood rehabilitation. Position coaches understood the technical aspects of their positions, so I didn't need to master them. Nutritionists possessed expertise that came through years of education in their field. My responsibility wasn't to walk into every meeting and prove that being the Head Strength and Conditioning Coach meant I knew more than everyone sitting around the table. My responsibility was to understand my area, recognize that I was the smartest person in my area, ask great questions to help me understand how their knowledge affected our athletes, and bring those different areas together toward a common objective.
Cybersecurity leaders operate in an environment where that ability becomes even more important. A CEO is unlikely to understand network architecture better than the people hired to protect it. A cybersecurity executive may possess extraordinary technical knowledge while needing people around them who better understand finance, communication, human behavior, legal exposure, artificial intelligence, or organizational strategy. The complexity of the problem makes pretending to have all the answers much more dangerous, because decisions made to protect one part of the organization can have consequences elsewhere.
The more complicated the problem becomes, the less valuable it is for leaders to prove they have all the answers. Their value comes from having enough confidence in themselves to find the people who do.
Surround Yourself With People Who Make You Smarter
One of the worst hiring mistakes leaders can make is surrounding themselves with people who make them feel smarter. It is comfortable to have people around you who think like you, approach problems like you, and reinforce ideas you already believe. It is also one of the easiest ways to create an organization filled with clones of the boss.
Great leaders should deliberately hire people who can fill in their weaknesses. If I am exceptional in speed dynamics and weak in plyometric progressions, I don't need another version of myself sitting beside me. I need someone whose knowledge begins where mine ends. I want someone who sees problems I don't see, asks questions I haven't considered, and occasionally makes me uncomfortable because their expertise challenges something I believed to be true. If they eventually become considerably better than I am in that area, we have not created a leadership problem. We have created a stronger organization.
Cybersecurity makes this necessity impossible to ignore because there is no longer one front to defend. Organizations face software vulnerabilities, social engineering, identity theft, ransomware, third-party exposure, artificial intelligence, cloud systems, mobile devices, and the continuing reality of human error. Cybersecurity has therefore become much more than a responsibility assigned to the IT department. A serious cyber incident can interrupt operations, create financial losses, expose customers, damage an organization's reputation, and force leadership to make difficult decisions long after the original technical problem has been contained.
No one person can master every part of that environment, which makes the composition of the team one of leadership's greatest responsibilities. The question shouldn't be whether the leader is the smartest person sitting at the table. The question should be whether the leader can manage the assembled talent so that different kinds of intelligence at that table can hear the voice and see the mission ahead of them.
One of the most useful questions I learned to ask during my career was, "Who knows more about this than I do?" Then I went looking for that person with a strong understanding of plyometric progression; I didn’t limit my targets to a pile of resumes. I didn’t let my ego get in the way, so I protected my position by demonstrating what I know. Confidence allows leaders to strengthen their position by finding people who know what they don't. I found that person on the track team, a Ukrainian triple-jumper who had come through the Soviet training system. I didn’t care that the “great mind" was a woman’s mind, and I didn’t care what their degree was in. I needed someone who knew more than I did. And Tatyana Obukova had that in spades.
A leader should never be threatened because somebody at the table knows more. The concern should begin when nobody does.
Make Bad News Travel Faster Than Good News
Cybersecurity exposes another leadership problem that has very little to do with technology. People make mistakes. An employee opens the wrong attachment. Someone responds to a convincing message. A password gets reused. Information is accidentally sent somewhere it shouldn't have gone. A new piece of technology is adopted without anyone understanding the risks connected to it. Organizations can build extraordinary technological defenses and still have those defenses tested by ordinary human behavior.
What happens immediately after the mistake may be more important than the mistake itself. Imagine an employee realizes they may have clicked on something dangerous. In one organization, that employee immediately contacts the cybersecurity team because everyone has been taught that speed matters. They understand they made a mistake, but they also know reporting it quickly gives experts the greatest opportunity to identify what happened, isolate the problem, and limit the damage.
In another organization, the employee sits quietly. They remember what happened the last time someone admitted making a mistake. Maybe that person was humiliated in a meeting, publicly blamed, or became known throughout the company as the person who created the problem. So this employee waits. They convince themselves that maybe nothing happened and hope the problem disappears before anyone notices.
The technology protecting those two organizations could be identical. The leadership environment is completely different.
I saw the same principle throughout coaching. I never wanted an athlete hiding an injury because he was afraid of losing his position. I didn't want an assistant coach concealing a mistake because he believed admitting it would create a bigger problem than the mistake itself. When information was important to an athlete's health or the team's performance, I wanted it immediately. Problems rarely become easier because leadership learns about them later.
Cybersecurity requires the same environment. Accountability still matters. Repeated carelessness cannot simply be excused, and people have a responsibility to follow the procedures designed to protect the organization. But accountability and humiliation are not the same thing. If the leader's reaction to an honest mistake teaches everyone else to hide the next one, the leader may have created a vulnerability larger than the original mistake.
Great leaders create organizations where bad news travels fast because people understand that identifying a problem early gives everyone more time to solve it.
Great Leaders Find the Unplowed Ground
Most organizations become very good at solving problems they already understand. Policies are written after something goes wrong. Procedures change after a weakness is exposed. Training is created after someone makes a mistake. Resources are invested after leadership discovers something important was vulnerable. Those responses are necessary because responsible organizations learn from experience.
The problem is that experience always looks backward.
Great leaders also have to find the unplowed ground. They have to move beyond asking what happened and begin asking what could happen that nobody has experienced yet. That requires imagination, curiosity, and enough confidence to question systems that currently appear to be working perfectly well.
During my coaching career, studying an opponent was never simply about identifying what they had already done. Everybody had access to game film. Everybody could study formations, tendencies, personnel, and previous decisions. If all we prepared for was what appeared on film, we were preparing for the opponent we had already seen rather than the one that was about to walk onto the field.
The greater challenge was anticipating what might come next. Where might they attack us differently? What weakness had we exposed without realizing it? What would I do if I were standing on the other sideline studying our tendencies? Sometimes preparation meant trying to see our own team through the eyes of someone whose entire job was finding a way to beat us.
Cybersecurity requires exactly that kind of thinking. The person attempting to penetrate an organization has no obligation to attack the place leadership has spent the most money protecting. They are searching for another door. It might be a vendor. It might be an employee. It might be a piece of old software everyone forgot existed. It might be a new AI tool someone started using because it made their job easier. The organization's strongest defense becomes irrelevant if an attacker discovers an entrance nobody thought needed defending.
That is why the questions leaders ask become so important. What technology are our people already using that we don't know about? Which outside organizations have access to our information? What happens if our technology performs perfectly but someone convinces one employee to open the door? What information are we protecting because it was valuable five years ago while something more valuable has quietly appeared somewhere else?
Then comes the question I think every leader should occasionally ask, whether they work in cybersecurity or not: If I wanted to attack my own organization, where would I start?
That question forces leaders away from the areas everyone is already examining and toward the edges. It requires them to look at their organization from another perspective and search for assumptions that have gone unchallenged simply because nothing bad has happened yet.
The greatest opportunities and the greatest threats often exist in the same place.
On ground nobody has plowed yet.
CoachC Insight
Cybersecurity may be built on technology, but cybersecurity leadership is still built on people. The tools may be different from anything I encountered during my coaching career, but the leadership responsibilities are remarkably familiar. Trust yourself enough to admit when you don't know something. Surround yourself with people whose abilities fill the spaces in your own knowledge. Give those people enough freedom to challenge your thinking. Create an environment where mistakes and bad news reach leadership quickly enough to do something about them.
Then push the organization beyond the problems it already understands. Yesterday's experience should make us smarter, but it should never make us believe tomorrow is obligated to look the same. The best leaders learn from what happened, prepare for what they know can happen, and then spend time searching for what nobody has considered.
You don't have to be the greatest cybersecurity expert in the room to lead cybersecurity experts. You have to be secure enough to put exceptional minds around you, wise enough to listen when they see something you don't, and curious enough to keep asking them to look beyond what everyone else already sees.
The greatest threat may not be the vulnerability you haven't fixed. It may be the vulnerability nobody has imagined yet.
Teachable Reminders
Self-confidence allows leaders to admit when someone else knows more.
Hire into your weaknesses instead of continually duplicating your strengths.
Exceptional leaders surround themselves with people who challenge their thinking.
Bad news needs to reach leadership while there is still time to act on it.
Accountability should encourage people to report mistakes, not teach them to hide them.
Experience teaches us about yesterday. Curiosity forces us to think about tomorrow.
Great leaders continually search for the unplowed ground.
Application Questions
Are you confident enough as a leader to admit when you don't know?
· Have you deliberately hired people who are better than you in areas where you are weak?
· Can the smartest people in your organization disagree with you without worrying about your reaction?
· What happens when someone inside your organization admits making a serious mistake?
· Are you spending more time protecting against problems you already understand than searching for problems you haven't considered?
· If you wanted to attack your own organization, where would you look first?
· What unplowed ground should your team be exploring before someone else discovers it?
