Three Types of Leaders

Generally, I find there are three types of leaders…

In more than two decades of working in security, I’ve noticed that organizations generally come to us in one of three ways:

1. The Reactive Leader:

Something has happened. An infiltration of data. Active shooter threat. Threat of ICE. Unauthorized access. A concerning situation involving an employee, leader, or community member. International travel risk. Board members making requests that cause teams to choose between security and board desires. There is urgency, and often fear. The question is: “How do we fix this NOW?”

The immediate problem needs to be addressed, but reactive security has a limitation: you are responding to what you can see. Without understanding the larger ecosystem, organizations can become trapped in a cycle: Incident → Response.

Even when individual problems are resolved, leadership may never truly feel secure because they don’t know what else may exist beneath the surface.

2. The Proactive Leader:

The proactive leader asks a different question: “I know we have risks. How do we understand what they are?”

This is where a comprehensive security assessment becomes so valuable. Instead of examining one problem, we examine the ecosystem: people, technology, physical environments, operations, leadership, relationships, community, and the vulnerabilities connecting them. Now leadership has something incredibly important: Visibility.

The Proactive Leader can determine what requires immediate attention, what can wait, where resources should go, and what risks need to be addressed. Visibility creates something organizations often underestimate: Peace of mind. You don’t have to solve everything today, however, you should know where you are, what matters most, and where to begin.

3. The Long-Term Thinking Leader

These are often our most successful civil society and nonprofit leaders. They understand: Security is not a project you finish. It is an organizational capability you build. They use the assessment as the beginning not the end.

✨What needs attention now?

✨What happens next year?

✨What is the threat landscape over the next three years?

✨How do we protect our people, data, operations, communities, partners, and mission?

These organizations begin building security into their strategy and budget rather than finding money every time something goes wrong. Security moves from an unexpected expense to an intentional investment.

Security Maturity Is a Journey:

There is nothing inherently wrong with beginning reactively. For many organizations, an incident is what makes security real. The question is: Do you stay there?

Eventually, the question changes from:

“What security problem do we need to fix?”

to:

“What do we need to build today so our people and organization can be more secure tomorrow?”

That is the shift from responding to security to building a culture of security.