Dispatch #050
A CISO I’ve worked with for years mentioned that most of the previous quarter had gone to turning other functions’ unclear problems into usable answers. Not security problems exactly, but problems with enough risk, adjacency, or unclear ownership to find their way to security. Finance wanted a view on fraud tooling. HR wanted help framing insider risk. Procurement wanted a vendor issue made coherent. Each request had a reasonable path to the CISO. Together, they had become a pattern. The organization had learned that when a problem was ambiguous, consequential, and hard to place, the CISO could make it coherent.
Competence does not just solve the work. It teaches the organization where the next unresolved thing can go.
3 Ideas From Me
1. The solver reflex is learned.
Many CISOs got the role by being the person who could figure out what nobody else could. They learned to manage uncertainty, act in low-signal situations, and keep the company moving when structure was incomplete. That instinct is not a flaw. It is often what made them credible. But when solving becomes identity, every adjacent problem starts to feel like another version of work the CISO can carry. Eventually, the habit that built trust starts teaching the company that ambiguity has a destination.
2. Every solution trains the routing.
Roles are not defined once. They are defined at the margin, by the requests the person in them agrees to take on. When the CISO takes a poorly owned question and returns clarity, the organization learns more than the answer. It learns the path. The mandate on paper does not change. The mandate in practice becomes whatever gets absorbed.
3. The work has to be named before it is solved.
The mistake is not helping. The mistake is solving before the company has named what kind of problem it is, who owns the decision, and what authority the answer would require. A CISO can contribute judgment without becoming the destination. The pause is small but material: what are we deciding, who owns it, and why is it here? That is not a refusal of the work. It is a refusal to let the act of solving quietly define the role.
2 Quotes to Reflect On
“The self-fulfilling prophecy is, in the beginning, a false definition of the situation, evoking a new behavior which makes the originally false conception come true.”
— Robert K. Merton
This is the uncomfortable part of the solver habit. The first handoff may be wrong. The CISO may not own the problem. But the answer they produce can make the routing look right in retrospect. The organization misnames the role, the CISO solves, and the next request arrives with evidence.
“When an individual plays a part he implicitly requests his observers to take seriously the impression that is fostered before them.”
— Erving Goffman
It is not only assigned from the outside; it is confirmed through performance. Every time the CISO turns ambiguity into a usable answer, peers learn not just what the CISO can do, but what the role can be used for. The performance becomes legible. Then expected.
1 Question For You
What has your competence taught the organization to send you?