Relationships matter. As a security leader, you need to be seen by customers, colleagues, C-level execs, and the cybersecurity community as helpful, trustworthy, fair, and with a good dose of empathy.
Recently, I had the honor of speaking with the latest cybersecurity cohort at a local program for underprivileged, underserved students. I shared my journey, and while I could have spent my time talking about the latest threats, cloud, AI, or any number of more “technical” subjects, I instead focused on the necessity and importance of communication, collaboration, and leadership skills. I also touched on some of the things that can undermine their success; those, too, had a nontechnical angle, such as toxic leadership or bad communication.
Toxic leadership and poor or inadequate communication can fuel frustration, confusion, burnout, a lack of trust, ineffective projects, dysfunctional teams, and increased risk — the very things that we are trying to mitigate.
I would argue that, in many cases, strong relationships, good communication, and trust do more to support and protect the organization and reduce risk (all kinds of risk) than any tool, solution, platform, budget increase, headcount, or certification. That’s a pretty bold statement, I know, but I have seen firsthand repeatedly as a security leader and through my Forrester clients how deeply impactful these issues can be. This is why this isn’t the first time I’ve written about leadership, influence, or the importance of relationships and networking, and based on my ongoing observations, it won’t be the last.
Toxic Leadership
The damage that a bad leader can inflict could easily fill a blog — perhaps two — on its own. Some of the biggest impacts include:
- Damaging relationships and their team’s reputation even to the point of getting sidelined by the business. This alone, setting all else aside, is a showstopper and is why and how security, even today, can get a bad reputation and be seen as difficult, uncooperative, and an impediment to businesses’ success.
- Accelerating and exasperating burnout, if not, in some instances, directly causing it.
- Driving good team members out of the org or to different departments.
- Paralyzing their team via micromanagement, resulting in a highly inefficient organization that is slow to respond and unable to make decisions, thereby impacting other teams and the organization as a whole.
Poor Communication
Sometimes we forget that the most basic things matter and set the foundation or tone for success. Skills like influence and storytelling are key here. As mentioned in a prior blog, always being able to answer the “What’s in it for me?” question and seeing issues and requests from the other person’s/team’s point of view go a long way toward facilitating good conversations and gaining trust.
Conversely, poor communication degrades relationships, impairs progress, and leads to alienation and misunderstandings. Simple things like timely email response, even if it’s just to acknowledge receipt and that you will follow up, make a difference. Similarly, following up and following through helps build that solid foundation for good and impactful relationships.
Don’t throw another team member, employee, or peer under the bus, even if you believe you’re justified. Certainly, don’t do this in meetings or broad forums. There is a time and place for those discussions. Generally speaking, that place is behind closed doors as a 1:1 conversation. When you do have those conversations, being accusatory/pointing fingers won’t be beneficial either. I’ve seen it happen many times in my past and more than once in my role here. Nothing good comes of it, and it ultimately makes the offending leader look bad. Now you may be thinking, “Didn’t you say that using/publishing dashboards and metrics to drive things like vulnerability management can be a good technique?” Indeed, I did; the difference is using fact-based team performance to drive motivation and a competitive environment, versus a personal or team attack.
Being frustrated or irritated happens. At times, it can come through unintentionally in communication. I’ll insert a shameless plug for our Executive Partner (EP) services via our Forrester Decisions VIP Program here. One of the more valuable things I’ve done for my clients is review and suggest edits to presentations. EPs bring an independent third-eye view to the material, which makes it easy to spot issues like the aforementioned frustration and irritation coming through. In these cases, we tweak the wording to convey the same point(s) but from a neutral or, preferably, a positive message. It’s not uncommon that the client doesn’t realize how negative or heavy-handed their wording was until they see the suggested edits.
External influences can be a factor relative to relationships and culture, as well. For example, throwing in a bad economy makes career moves more difficult, trapping good people in bad situations. Shrinking budgets put even more strain on already stretched teams and can amplify all of the issues outlined here.
The good news is that these issues can be worked on and improved. We all make mistakes. The key is to be self-aware and learn from them. There are lots of good resources from a leadership and communications perspective that you can take advantage of, including mentoring and peer support.
For additional insights on culture, see Jinan Budge’s great blog published last July on Forrester.com on the impacts of toxic culture within security teams, Security Team Culture Matters, and be on the lookout for upcoming groundbreaking research on burnout.
