Have the Courage to Decide
When waiting for more information becomes a risk of its own.
Today, during a conversation with my CISO, one piece of advice really made me think.
He said that you need the guts to take a decision. You cannot keep waiting for enough information before making a call.
It was a simple message, but it made me reflect on an important aspect of leadership.
As security professionals, we are trained to investigate, validate evidence and understand the problem before taking action. That discipline matters. But as we grow into leadership roles, we begin to realise that we will not always have all the answers when a decision needs to be made.
Sometimes, the real challenge is not finding more information. It is having the confidence to act on what we know, while being honest about what we don’t.
The Risk of Waiting
Consider a critical vulnerability being actively exploited in the wild. Your organisation uses the affected product, but the investigation has not yet confirmed whether your environment has been compromised.
Do you wait for complete confirmation before recommending action?
Not necessarily.
You can recommend proportionate containment based on the credible risk while the investigation continues. Waiting for certainty may expose the organisation to a greater risk than taking a controlled precaution.
The question is not simply what we know. It is what could happen if we wait.
Courage Is Not Recklessness
Taking a decision with incomplete information does not mean guessing or ignoring evidence. It means making the best possible judgement with what is available.
Before deciding, ask yourself:
- What do we know, and what remains unverified?
- What are the consequences of acting now versus waiting?
- Which option best protects the business?
- What safeguards can reduce the risk?
- What new information would make us reconsider the decision?
These questions bring structure to uncertainty. You do not need perfect information, but you do need a clear rationale.
Make the Decision. Own the Outcome.
A security leader must do more than identify a problem. They must recommend a course of action, explain the trade-offs and take responsibility for their recommendation.
Sometimes, new evidence will change your understanding. When that happens, revisit the decision.
Document your rationale, establish safeguards, define escalation boundaries and remain ready to adjust your approach.
A decision should be judged by the quality of the reasoning and the information available at the time—not merely by what becomes known afterwards.
Start Where You Are
You do not have to wait until you become a CISO to develop this capability.
In your next vulnerability review, incident discussion or risk assessment:
- Present a recommendation, not just the problem.
- Explain the risk of acting and the risk of waiting.
- State your assumptions and acknowledge what remains unknown.
- Define the decision required and who has the authority to make it.
This is how you move from reporting security problems to helping the organisation make decisions.
The CISO Perspective
A CISO cannot know everything, and complete information will not always arrive when it is needed.
What matters is the ability to assess the available evidence, understand the business consequences and make a defensible decision without unnecessary delay.
There is a difference between being cautious and becoming paralysed by uncertainty.
A CISO needs the judgement to act on what is known, the courage to own the decision, and the humility to change course when new facts emerge.
That is another important step in the CISO journey.
