Risk management professionals are the architects of organizational stability. They spend their careers mastering the art of quantifying exposure, stress-testing assumptions, and crafting elaborate playbooks for "black swan" events—the incidents they fervently hope will never occur. Within the high-stakes world of cybersecurity and enterprise risk, these leaders operate under a foundational tenet: the absence of a security alert is not synonymous with safety. They understand, intellectually, that true resilience is born of preparedness and that the efficacy of any strategy is ultimately limited by the people tasked with executing it.
However, when the risk shifts from the faceless digital perimeter of a corporation to the intimate, biological reality of one’s own body, those professional concepts—resilience, preparedness, and risk appetite—take on a profound, visceral weight.
Receiving the Diagnosis: The Unexpected Audit
The author’s journey began not with a sophisticated threat intelligence feed or a suspicious network anomaly, but with a routine physical examination. Among the standard panels was a Prostate-Specific Antigen (PSA) blood test. There were no symptoms, no red flags, and absolutely no family history to signal danger. The result, however, was an anomaly that demanded immediate investigation.
What followed was a diagnostic whirlwind that culminated in a stage-three prostate cancer diagnosis. This account is not a clinical advisory, nor is it a mandate for specific health choices. Instead, it serves as a critical case study for a profession that prides itself on analytical rigor but often neglects the human vessel responsible for maintaining that rigor. When the "asset" being protected is oneself, the perspective on risk undergoes a fundamental, often jarring, transformation.
Risk Appetite Changes When the Asset is You
In the professional sphere, leaders are trained to be models of stoic objectivity. They dissect security controls, debate risk tolerances, and justify complex trade-offs to boards of directors with a detachment that is both expected and admired. They are, by definition, managing the enterprise—a construct that, while composed of people, is often treated as a logical system of assets and vulnerabilities.
Yet, risk management is rarely as clinical as the slide decks suggest. It is, at its core, decision-making under duress, frequently performed with incomplete information and high-pressure stakes. Leaders who fail to acknowledge the human element—the anxiety, the cognitive biases, and the emotional toll—are poorly prepared for the moments when the pressure moves from the boardroom to their own lives.
The Parallel with Cyber Governance
The analogy between a personal health crisis and cyber governance requires nuance, but the parallels are undeniable. In both domains, the danger of accepting "defaults" is high. A security leader who accepts a supplier’s assurance statement without independent verification is failing their duty of care. Similarly, a patient who feels they cannot question their medical team is relinquishing their agency.
In both settings, empowerment stems from information. Psychological safety—the ability to ask "help me understand the assumptions behind this plan"—is the ultimate security control. Whether navigating a complex treatment protocol or a multi-year cloud migration, the ability to challenge the status quo is what separates a managed risk from a catastrophic failure.
Resilience: A Function of Preparation, Not Performance
In the weeks leading up to radiotherapy, the author adopted a methodology familiar to any seasoned risk manager: deliberate, structural preparation. The strategy focused on fitness, diet, sleep, and meditation. This was not mere self-care; it was a tactical recalibration. By reframing a grueling 37-week treatment schedule as a "tournament"—a series of manageable, daily "games"—the author regained a sense of agency in a situation where the body felt like a system under siege.
The Myth of the Always-On Leader
This experience highlighted a dangerous trope in the cybersecurity industry: the normalization of exhaustion. Cyber teams are frequently lauded for pulling all-nighters, staying permanently "on-call," and equating professional commitment with availability. This is a design flaw in the organizational architecture.
A security function cannot be resilient if its people have no capacity for recovery. Personal resilience is not a personal productivity hack; it is a capability reinforced by clear boundaries, support systems, and a culture that views rest as a critical component of sustained performance. Just as a server needs a reboot to clear memory leaks, a human professional requires downtime to maintain the cognitive capacity necessary for high-level risk management.
Transparency as a Strategic Control
Cancer, much like a severe data breach, carries a stigma in senior leadership circles where invulnerability is often mistaken for strength. When the author chose to disclose the diagnosis, the response was, as expected, mixed. While many offered support, others were paralyzed by the uncertainty of how to react to a leader admitting to a physical vulnerability.
This dynamic is pervasive in corporate culture. Organizations often preach the importance of "reporting early" and "transparency," yet they build cultures that punish the very vulnerability they claim to desire. If a leader cannot safely admit to a health crisis or a burnout-induced error, how can they expect a junior analyst to report a potential security breach?
Redefining Strength
Transparency is not a liability; it is a control. By modeling a form of strength that acknowledges human limitations, leaders can create an environment where accountability and humanity coexist. Holding space for colleagues without pretending to be invincible is not a sign of weakness—it is the hallmark of a secure, mature leadership style. Employers who integrate flexible hours, adjusted responsibilities, and genuine check-ins into their support models are not just being "nice"; they are investing in the long-term resilience of their human capital.
Implications for the Future of Risk Leadership
While a PSA result is not a vulnerability scan and radiation therapy is not incident response, the underlying habits of success are identical. Curiosity, rigorous preparation, the leveraging of trusted expertise, and the ability to adapt when the original plan fails are universal constants.
The challenge for the next generation of risk leaders is not to become more alarmed by the threats they face, but to become more attuned to the "weak signals"—the early warning signs of illness, the silent burnout of a team member, or the cracks in a culture of forced invincibility.
A Call to Action
The profession must move toward a more human model of risk leadership. This involves:
- Normalizing Dialogue: Breaking the stigma around health, particularly prostate health, by fostering open, blunt conversations about personal risk.
- Institutionalizing Recovery: Moving away from the "always-on" culture and treating human recovery as a foundational pillar of operational resilience.
- Questioning the Status Quo: Encouraging a culture of inquiry where asking for clarification is seen as a sign of diligence, not confrontation.
Cybersecurity leaders are experts at asking, "Are we prepared for a digital catastrophe?" It is time they asked an even more difficult question: "Are we creating an environment where our people can safely face their own risks, ask for help when they need it, and recover without compromising their dignity?"
Ultimately, the most sophisticated security system in the world is useless if the people running it are not supported, healthy, and empowered to bring their whole selves to the challenge. Resilience, after all, is not just about the code—it is about the human heart beating behind the screen.
Disclaimer: This article is a personal account and reflection on professional practices. It is not intended as medical advice. Readers concerned about their health should consult with qualified healthcare professionals regarding their personal risk factors and the appropriate use of diagnostic testing.
