Take Accountability, Not Just Responsibility
Leadership is tested when things don’t go as planned.
One thing I have noticed as I move through my cybersecurity leadership journey is that taking responsibility and being accountable are not quite the same.
We often take responsibility for projects, security controls, vulnerability remediation, incidents and team deliverables. We make sure things move forward and that commitments are met.
But what happens when something goes wrong?
A critical vulnerability remains unpatched. An incident escalates despite the controls in place. A project misses its deadline. An audit identifies a gap that everyone thought was already addressed.
There will always be explanations. Perhaps the team was short of resources, the application owner did not respond, the vendor delayed a fix, or the process itself was not working as expected.
These may all be valid reasons. But a security leader cannot stop at explaining why something went wrong. Someone has to take ownership of what happens next.
It Is Easy to Point Fingers
In cybersecurity, most failures rarely happen because of one person’s mistake. There may be gaps in processes, unclear ownership, delayed decisions or a lack of visibility.
Take vulnerability management, for example. When a critical vulnerability is exploited, it is easy to point towards the infrastructure team for not patching the system. But was the asset identified correctly? Was the risk communicated? Was the remediation deadline agreed upon? Was the issue escalated when it remained unresolved?
Looking at the entire chain often reveals much more than blaming the last person involved.
That is where leadership makes a difference.
Accountability Does Not Mean Taking the Blame for Everything
Being accountable does not mean accepting blame for every failure. It means being willing to understand what happened, explain your part in it and make sure the necessary action follows.
A leader should be able to stand before management and explain the situation honestly, even when the update is uncomfortable.
Hiding a problem, shifting responsibility or presenting a misleading picture may protect someone temporarily, but it damages trust in the long run.
People should also feel comfortable raising problems without worrying that every mistake will turn into a blame exercise. Otherwise, issues will surface only when they become serious.
What You Do After a Failure Matters
I believe this is where the real difference between managing and leading becomes visible.
When something fails, don’t spend all your energy explaining why it happened. Understand the reasons, identify what needs to change and follow through.
If a security control is not effective, improve it. If ownership is unclear, establish it. If a risk was not escalated in time, examine the escalation process.
And most importantly, make sure the corrective actions actually happen.
Closing an incident or audit finding is not the same as fixing the weakness that caused it.
Start Practising It Today
You don’t have to wait until you become a CISO to develop this quality.
If a project under your ownership is delayed, be open about it. If a recommendation does not work, acknowledge it. If your team misses an expected outcome, understand what went wrong and help them get back on track.
Give credit to the people who deliver the work. But when things go wrong, don’t distance yourself from the team.
That is how trust is built.
The CISO Perspective
A CISO cannot personally control every system, every employee or every business decision. But the role carries the responsibility of ensuring that security risks are visible, ownership is clear and the organisation responds when things go wrong.
Leadership is not about presenting a perfect security dashboard or having an answer for every difficult question.
It is about being honest when things go wrong, having the confidence to face difficult conversations and making sure the organisation learns from its mistakes.
Taking responsibility means accepting the task. Taking accountability means standing behind the outcome and making things better, even when they don’t go as planned.
That is another important step in the CISO journey.
