Can you be agile in decision-making and take fast action in cybersecurity? Is agility compatible with reducing risk? Can we manage the myth of security’s complexity so it stops being an excuse to the business? It’s a challenge without a single answer, but it requires cybersecurity teams to step, in many cases, outside their comfort zone. How?

Cybersecurity can’t stay outside the practices that dominate companies today in the era of digital transformation: concepts like “Thin,” “Agile” and “Lean” need to be present in how we execute cybersecurity strategy.

Setting aside the “rigid” (in some ways legacy) requirements of hyper-regulated environments, how do you put the “make the hard easy” idea into practice?

By running lighter, less rigid risk analyses, focused on the outcome and the action plan rather than methodological perfection. By applying more intensive protection levels to an organization’s most critical assets, and lighter or more basic levels to low-criticality assets. By focusing on a handful of use cases that could turn into incidents requiring immediate detection. By making sure the most critical incident-recovery scenarios are covered, with special attention to scenarios that are new or have grown more important in today’s context (for example, cloud environments or remote work).

It’s obvious this approach is far more viable for newer, typically mid-sized organizations that were born in the digital era with a “cloud-first” strategy from day one. Large companies that have been decisively adopting this strategy for years already need to navigate this journey alongside the legacy world, and need to balance their decisions even more carefully to manage that duality with the right cost-risk balance.

Another key decision is the security technology adoption strategy: choosing what’s right-sized and sufficient for the nature of the company and its business. As an alternative to the best-of-breed approach large companies tend to follow, with higher acquisition, maintenance and integration costs, adopting security platforms, with sufficient functionality at a lower cost, is gaining ground for the vast majority of companies.

Of course, you can’t oversimplify the complexity of securing a large organization in the middle of transformation, but you still have to try to “make the hard easy.”