.webp)
Cybersecurity is often seen as a reactive field, constantly responding to threats as they emerge. But Helen Patton, Cybersecurity Executive Advisor at Cisco, argues that a well-defined cybersecurity strategy can shift the focus to a proactive approach—one that aligns security efforts with broader business objectives.
Strategy vs. Tactics
Cybersecurity without a strategy can quickly devolve into firefighting. “Having a strategy allows you to plan with big-picture goals in mind, rather than just reacting to today’s fire,” Helen explains. It provides a framework that connects security initiatives to the company’s mission and ensures progress is measured over months and years—not just incidents and responses.
Defining a Cybersecurity Strategy
A security strategy isn’t just about “not getting breached.” It should reflect the organization’s specific goals and operating environment. At Ohio State University, Helen aligned security with priorities like supporting research, student learning, and faculty operations.
"Your strategy should answer: What are we enabling with our security efforts? How does security support the mission?" she says. It’s about more than just defense—it’s about making security an asset, not an obstacle.
Balancing Flexibility with Structure
Cyber threats evolve rapidly, but a strategy shouldn’t be purely reactive. Instead, it should be broad enough to account for shifting risks without constantly being rewritten. Helen notes that strategic plans should typically cover a timeframe of one to three years—long enough to drive meaningful change but flexible enough to adapt as needed.
Engaging Stakeholders for Buy-in
A strategy can’t be developed in isolation. Helen stresses the importance of stakeholder engagement: “You have to make sure the business understands why security matters and how it contributes to overall success.” Security leaders should work with executive teams, IT, and business units to ensure alignment.
Moving Beyond the 'Department of No'
Security has long been perceived as an obstacle to innovation, but Helen believes a strong strategy helps shift that narrative. “Instead of saying no, security should focus on managing risk and guiding informed decision-making,” she says. A strategy provides a framework to evaluate new initiatives, ensuring they align with long-term goals without introducing unnecessary risk.
Where to Start
For those looking to develop a cybersecurity strategy, Helen recommends leveraging existing frameworks, learning from peers, and networking with other security leaders. “Find out what’s working in your industry, but always critically evaluate whether it makes sense for your organization.”
Listen to the CyberWatch podcast on Spotify and Apple Podcasts, or watch the episode on YouTube.
