From experience: if you create culture inside an org where you acknowledge security breaches happen, and place protecting customers and society at the heart of discussions, you will by proxy protect org from reputation damage, and employees, as everybody wants to do best thing.
There are always trade offs - but if you nail the culture, lead by CEO, intentions start from a good place.
Cybersecurity effectiveness isn’t just playing with technical toys. If you get culture wrong, outcomes are bad.
Culture is the most important.
I will never forget the short term position I had, where I was participating in the response to an audit.
In the elevator up to the meeting room, my boss turned to me and simply said.
“These are (security) auditors. Do not speak unless they directly ask you a question. If they ask you a question, do not say anything that could be bad or make us fail. If you say anything that comes back on us, this will go badly for you”
Suffice to say, I never got out of the elevator for that meeting.
Kevin Beaumont
Gabe The Engineer
Bex Markwick
SensibleOtter
Mike Spooner