• Anthropic says the attacks in its September cases were familiar, but AI changed what those attacks cost to run by letting models handle reconnaissance, exploitation, tool development and data processing in parallel.

• Google separately observed a mass credential-harvesting campaign planned, built and executed in under six hours.

• Any accepted risk that depends on an attacker finding the work too manual, too specific to your environment or not valuable enough to pursue deserves another look.

Some risks on your register are accepted because the control is good enough. Others are accepted because the attacker would have to work too hard. We rarely write that second sentence down.

Anthropic’s September 10 threat-intelligence report gives us a reason to write it down now. The attacks it investigated were mostly familiar: stolen credentials, unpatched internet-facing devices, exposed services, SQL injection and phishing. No new magic trick was required. What changed was the cost of running the campaign.

Anthropic reports breaches completed in two to three hours and dozens of victims handled in parallel by individual operators. It describes AI models taking over parts of reconnaissance, exploitation, tool development and stolen-data processing inside automated attack tooling. One actor used an AI-assisted workflow that automatically rebuilt and redeployed tooling after security products detected it.

Google reported a different case two days earlier. In one Q2 case, a financially motivated actor compromised a cloud resource, then used multiple AI agents working together to plan, build and execute a mass credential-harvesting campaign in under six hours. The system handled scanning, troubleshooting and changing network addresses with much less human intervention than a traditional attack would require.

The Attacks Didn’t Have to Get Exotic

Security programs slow attackers down in more ways than we usually count. Recon takes time. Figuring out an unusual environment takes time. Chaining several ordinary weaknesses takes time. Rebuilding tooling after detection takes time. Sorting a pile of stolen data until someone knows what is worth selling or extorting takes time.

None of those delays is a formal security control by itself. They still affect which targets attackers choose and how long they’re willing to keep working on one.

Attackers have budgets too: people, access, compute, attention and hours in the day. A system can be technically exploitable and still be unattractive because the path is too manual, too weird or not valuable enough to justify specialist attention. That has always been part of the math, even when the risk register hid it inside a word like “unlikely.”

Human Labor Was Hiding Inside “Low Likelihood”

Look through enough risk-acceptance records and the notes explaining why the remaining risk is considered acceptable, and you’ll find versions of the same assumptions.

Exploitation requires substantial manual effort. The environment is unusual enough that broad targeting is unlikely. An attacker would have to chain too many weaknesses. Detection will force them to retool. The asset is not valuable enough to justify that much work.

Those can be rational reasons to rank one risk below another. They are also assumptions about attacker cost.

In May, I wrote about a narrower version of this in The Day the Clock Broke. That piece was about the economics of finding and weaponizing a logic flaw that requires understanding what the software is supposed to do. The September evidence is broader because discovery is not the only part getting cheaper.

Recon can run in parallel. Tooling can be adapted by a model. Errors can be retried without a human babysitting each step. Stolen data can be organized faster than one person could process it manually. The tooling can remember what it has already tried across sessions while other parts of the campaign keep running. The risk record may still say “requires a skilled attacker.” That may still be true, but the amount of skilled human time behind it may be much smaller.

The Attacker’s Cost Changed

Anthropic frames this in terms of attacker unit economics: how much it costs to run a campaign compared with what the attacker might gain. The potential payoff from stealing a customer database didn’t suddenly increase because AI entered the workflow. The cost of getting that payoff fell. A campaign can require less human labor, less specialist effort for some tasks and less elapsed time because more work can happen in parallel. That makes more targets worth the effort.

That doesn’t make every small company a priority target or every obscure system instantly exploitable. It means some targets that once required more effort than they were worth can become attractive without anything about the target itself changing.

The same logic applies to controls that slow an attacker down without stopping the attack outright. Detection still matters. Blocking still matters. Forcing an attacker to change tools still matters. But if part of a control’s value came from making a person spend hours diagnosing a failure, rewriting code and redeploying it, the control may consume less attacker time than it did when you designed it.

Anthropic saw exactly that loop in one case: security products detected the attacker’s tooling, then the AI-assisted workflow modified those tools and redeployed them. The detection still created work. The difference is that the operator no longer had to do all of it by hand.

Google’s under-six-hour credential campaign gives us a separate example. The attacker turned one compromised cloud resource into infrastructure for the campaign. The AI agents handled much of the scanning and troubleshooting, then the campaign collected credentials across a large number of targets.

Don’t Mistake Case Studies for the Norm

There is an important limit here. Anthropic says the cases in its report are notable and novel examples, not a picture of typical misuse across all cybercrime. Google says it hasn’t yet observed fully autonomous exploitation pipelines being used against real-world targets. Humans still make important decisions around target selection, monetization and review.

So I wouldn’t turn either report into “most attacks are agentic now.” The evidence doesn’t support that, and it doesn’t need to.

If you accepted a risk because exploitation looked too expensive to do repeatedly, you don’t need most attackers to adopt these workflows before the assumption deserves review. You need enough evidence that the time and skill required to run the attack have fallen. These two reports are enough to revisit a risk acceptance that depended on high attacker effort.

Reprice the Risks Built on “Not Worth It”

Instead of rebuilding every threat model around “AI attacks,” pull the accepted risks where the logic was basically “too tedious, too specific to our environment or not worth the attacker’s time.” Revisit those first.

Look for language like:

• exploitation requires substantial manual effort

• the environment is too unusual to attract broad targeting

• an attacker probably will not spend enough time chaining these weaknesses

• repeated detection and retooling will make the campaign uneconomic

• the asset is not valuable enough to justify specialist attention

Examples: an old admin interface that’s reachable but unusual, several medium-severity weaknesses that only become dangerous when combined, or a detection control that forces an attacker to rebuild their tools every time.

Then ask what part of the likelihood rating depends on a person doing the work one target at a time.

Don’t automatically raise the impact score. The data, business process or system may be exactly as valuable as it was last quarter. Revisit the likelihood assumptions and any controls you counted on mainly because they slow the attacker down.

Start with the accepted risks that would hurt most if they happened. For each one, mark which attacker tasks you assumed a person would have to do, which controls mainly slow the attack rather than stop it and which systems you considered safer because they were obscure or unusual. You don’t need to reopen the entire risk register. Start with the risks you accepted partly because attacking them looked like too much work.

That’s also why I wouldn’t make this an “AI security” side exercise owned by the AI team. The affected risks may sit in identity, legacy infrastructure, SaaS, cloud, internet-facing systems or ordinary web applications. AI is changing the attacker’s cost, not the category of system being attacked.

Pick one accepted risk this week and read why you accepted it, not just its severity score. If the logic depends on the attacker deciding the work isn’t worth it, rerun the math.

The vulnerability may be exactly the same. The price is not.

Leave a comment

Resources

• Anthropic, “Detecting and countering misuse of AI: September 2026,” September 10, 2026: https://www.anthropic.com/threat-intelligence-report-september-2026

• Google Threat Intelligence Group, “GTIG AI Threat Tracker: From Prompting to Autonomy - The Evolution of Adversarial AI,” September 8, 2026: https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai

Source note: Anthropic explicitly says the cases in its report are notable and novel examples rather than typical misuse. Google says it has not yet observed fully autonomous exploitation pipelines operating against targets in the wild. This article treats the reports as evidence that attacker capability and operating cost are changing, not as a prevalence estimate for all cybercrime.

Analytical note: the argument that some accepted cyber risk embeds assumptions about attacker labor cost is my interpretation of the evidence above. Neither Anthropic nor Google audited enterprise risk registers or measured how often labor assumptions drive formal risk acceptance.

• In McKinsey’s August 25 survey, 40% of respondents at companies with more than $1 billion in annual revenue said their organizations were scaling AI agents, up from 27% last year. In Deloitte’s separate 2026 survey, only 21% of respondents said their organizations had mature governance for those agents.

• Agent identity, action logs and policy checks while the agent is running matter. Those controls still can’t decide how much an agent may discount, refund or pay, or what it may promise.

• The business owner sets the decision boundary. Security and engineering make it enforceable.

Imagine a sales agent with legitimate access to the CRM, the company’s approved prices and discounts, and email.

A customer asks for a 12% discount. The agent sees that it may automatically approve discounts up to 15%, sends the revised quote and promises delivery by the end of the month. No security alert fires. Nobody stole a credential. The agent did exactly what the company’s rules allowed.

The harder question isn’t whether the agent had access to the pricing system.

Who decided the agent could approve a 15% discount without asking a person? Who decided it could promise a delivery date too?

I think a lot of companies are about to encounter that governance problem after their security controls work exactly as designed.

Subscribe now

McKinsey’s August 25 global survey found that 40% of respondents at companies with more than $1 billion in annual revenue said their organizations were scaling AI agents, up from 27% last year. In a separate Deloitte survey of 3,235 business and IT leaders across 24 countries, only 21% said their organizations had mature governance for those agents.

Those are different surveys with different samples, so I wouldn’t subtract one number from the other and call the difference a governance gap. But together they show the order in which many companies are moving: agents are entering real workflows before the companies deploying them have finished deciding what those agents should be allowed to do.

The Business Decision Comes Before the Permission

NIST is already working on the technical identity side. Its February concept paper separates four questions: Which agent is acting? What is it allowed to do? Can its actions be audited? Can the company later prove that the action came from that agent? OWASP’s Agent Control Standard, released September 1, adds checkpoints where agent platforms can inspect an action and enforce policy while the agent is running.

Those are useful controls. They don’t tell a sales leader whether 15% is the right discount ceiling.

They shouldn’t.

A policy engine can block a discount above 15%. It can’t decide whether 15% is commercially acceptable. The same problem applies to refund limits, payment thresholds, customer-policy exceptions and promises that consume real delivery capacity.

Security can ask whether the rule exists, whether the agent can bypass it and whether the action really stops when human approval is required. The business owner still has to set the number.

Somebody Has to Fill In the Question Mark

I wrote about the human version of this in The Delegation Illusion. Real delegation gives another person more than a task. It defines which decisions they may make without asking, the limits on those decisions and what they should do when an unexpected case appears.

Agents need the same clarity in a form software can enforce.

With a person, missing criteria often surface as a question. “Can I go to 12%?” “Can I issue the credit?” “Do you want me to commit to Friday?” The conversation itself exposes the missing boundary.

An agent can keep moving.

Eventually somebody has to fill in a very boring line of configuration:

max_discount_percent = ?

The question mark isn’t an engineering problem.

Automated transactions aren’t entirely new legal territory. Massachusetts law, for example, says electronic agents can form a contract even when no person was aware of or reviewed their actions or the resulting terms. The statute also says the contract remains governed by the applicable substantive law, meaning the ordinary legal rules for that contract still apply.

That doesn’t mean every message from a modern AI agent creates an enforceable obligation for every company. These laws use “electronic agent” as an older term for automated software, and the legal effect of a particular action still depends on the facts and applicable law. But the rule removes one comforting assumption: a company can’t assume there was no commitment merely because no person reviewed the action.

Modern agents make that limit harder to define and enforce. They can interpret a broad goal, choose which tools to use and write the quote, email or contract language that communicates the decision outside the company.

Payments Show How This Can Work

The Agent Payments Protocol, or AP2, separates the agent making a purchase from the permission that authorizes the purchase.

In AP2’s human-not-present mode, the user approves an “open mandate” that records the limits for a future purchase. The user can then leave. When the agent selects a specific purchase, it creates and signs a “closed mandate” for that transaction. The receiving system can compare the purchase with the limits the user approved earlier.

The important part for this article isn’t the cryptography. It’s the sequence.

The person decides the boundary first. The agent acts inside it later. The receiving system has something concrete to verify.

Visa’s Trusted Agent Protocol approaches AI-assisted shopping from a different direction. It lets a merchant verify the agent’s identity, confirm that it is acting for a particular user and check that the user authorized the shopping task. The merchant can then limit the agent to that task.

Neither protocol decides how much the user should be willing to spend. They let software record the user’s limit and check a later transaction against it.

Companies need to follow the same order: the business owner sets the limit, security and engineering encode it, then the agent acts inside it.

Security Shouldn’t Become the Business Owner

There’s a predictable failure mode here for CISOs.

The company deploys an agent that can send quotes, move money, approve exceptions or make commitments to customers. Security is asked to put guardrails around it. During implementation, someone turns to the security team and asks what the threshold should be.

That’s the moment to give the question back.

A CISO should be able to answer five technical questions. Does the agent have its own identity? Do its credentials allow only the access it needs? Are important actions checked while it is running? Are its logs stored somewhere the agent can’t quietly rewrite them? Can the company revoke its access quickly? Security should challenge any design that has no approval threshold or no way to enforce one.

The CISO shouldn’t quietly become the person who decides how much margin sales may give away or how much credit support can issue. The same goes for which new vendors procurement may add or which service promise operations can make without checking capacity.

The owner will vary by company. Sales may decide which discounts an agent can offer. Finance may decide how much credit it can issue or money it can move. Procurement or legal may decide which vendors it can add and which contract terms it can accept. Operations may decide which delivery promises it can make. The org chart doesn’t have to look the same everywhere. But each limit has to come from the person already accountable for the result.

Then security and engineering can turn that decision into something the agent can’t casually route around.

The Audit Trail Is Arriving First

Congress is already focusing on verification and action logs.

On September 3, Representatives Josh Gottheimer and Mike Lawler announced the bipartisan Stop Rogue AI Act. It’s a proposal, not enacted law. The bill would direct NIST to develop standards and best practices for deploying AI agents securely. Those standards would cover continuous checks of agent actions, security and reliability testing, tamper-proof action logs and an inventory that other software can read.

All useful.

A perfect log can still record an undefined policy perfectly.

If an agent issued a $700 refund, the log can tell you which agent did it, which credential it used and when the call executed. It can’t tell you whether $700 should have been inside the agent’s authority unless the company made that decision before the action.

Companies often start with monitoring because monitoring tools are tangible. They can buy them, configure them and put the results on a dashboard. But those tools can’t decide where the agent’s autonomy should stop. A business owner has to set that limit, accept responsibility for it and revisit it when the business changes.

Before the Next Agent Goes Live

Pick one agent your company is deploying. Before reviewing its prompt, look at what the agent can actually do.

List every action the agent can take that commits the company to another party or materially affects a customer, company finances, operations or legal obligations. For each action, name the business owner who can set the limit. Define the exact point where the agent must stop and ask a person for approval. Then identify which system enforces that stop and who can change or remove it.

If you can’t name the business owner, don’t ask security to invent the limit.

If the threshold is “whatever the agent decides is reasonable,” you haven’t delegated a decision. You have delegated the creation of the decision rule too.

AI agents are getting capable enough that “what can it access?” is no longer a complete governance question. Ask what the agent can commit the company to, then ask who authorized that kind of action.

Only after that answer exists should somebody turn it into code.

Resources

• McKinsey & Company, “The state of AI in 2026: On the road to ROI,” August 25, 2026: https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai

• Deloitte, “Business and IT leaders report AI agents are scaling faster than their guardrails,” April 24, 2026: https://www.deloitte.com/us/en/insights/topics/emerging-technologies/ai-agents-scaling-faster.html

• NIST NCCoE, “Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization,” February 5, 2026: https://csrc.nist.gov/pubs/other/2026/02/05/accelerating-the-adoption-of-software-and-ai-agent/ipd

• OWASP GenAI Security Project, “Agent Control Standard,” September 1, 2026: https://genai.owasp.org/resource/agent-control-standard-acs/

• Massachusetts General Laws, Chapter 110G, Section 14, “Automated transaction”: https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter110G/Section14

• Agent Payments Protocol, AP2 specification and autonomous mandate flow: https://ap2-protocol.org/ap2/specification/

• Visa, “Trusted Agent Protocol”: https://developer.visa.com/use-cases/trusted-agent-protocol

• Office of Congressman Mike Lawler, “Exclusive: New bill cracks down on AI agents after Hugging Face breach,” September 3, 2026: https://lawler.house.gov/news/documentsingle.aspx?DocumentID=6424

Legal note: the automated-transaction example above is illustrative, not legal advice. Whether a specific agent action creates an enforceable obligation depends on the applicable law, the facts and the authority surrounding that transaction.

Analytical note: the distinction between a business owner’s decision and the technical permission given to an agent is my interpretation of the sources above. NIST, OWASP, AP2 and Visa describe ways to identify agents, authorize actions, enforce rules while an agent is running and verify a user’s intent. They don’t decide who inside a company has authority to set the business limits.

Share

Leave a comment

• The White House declared a national emergency over certain foreign-produced equipment in the U.S. bulk-power system, including risks from remote access, software, firmware and maintenance dependencies.

• The order doesn’t prove hidden backdoors exist throughout the grid. It does show how hard remediation becomes after critical hardware is installed.

• Supply-chain security starts with knowing what you own, how it communicates and what replacing it would actually take.

On August 26, the White House declared a national emergency over the foreign supply of equipment used in the U.S. bulk-power system.

The phrase that got the attention was “digital backdoors.” The order says some foreign-produced equipment might contain them and could allow remote foreign access. It doesn’t say investigators proved that hidden backdoors exist throughout the U.S. grid.

That distinction matters because a credible risk isn’t the same thing as a confirmed compromise.

The more useful word appears later in the order: inventory.

The Department of Energy is directed to identify risky equipment and recommend ways to identify, inventory, isolate, monitor or replace it. For equipment that is already installed, the Secretary can impose conditions that include securing, disconnecting, replacing or removing it.

That sequence should look familiar to every security leader. Before you can contain something, you have to know it’s there.

The Hardware Is Already There

The new order covers much more than transformers. It reaches grid-connected inverters, battery energy-storage systems, generators, protective relays, industrial control systems, programmable logic controllers, intelligent electronic devices and associated software, firmware, remote-access capabilities and lifecycle maintenance mechanisms.

Some of that equipment will be installed after the order. Some of it is already operating.

The latter category is harder.

Before the government directs isolation, disconnection, replacement or removal of existing equipment, the order requires Energy to consider reliability, safety, the availability of secure replacements and continuity of essential service. That’s not ceremonial caution. It’s the operating constraint.

DOE’s 2024 report to Congress on large power transformers describes them as expensive, highly customized and difficult to transport. It says current manufacturing lead times can reach and exceed 36 months. DOE said again this month that critical grid equipment can carry lead times of two years or more.

So imagine the security answer is “replace it.” Fine. With what? How quickly? What does the grid do while you wait? Can the replacement be transported to the site? Is there another supplier that can meet the electrical and physical requirements?

The vulnerability may be technical. The remediation is constrained by physics, manufacturing capacity and procurement decisions made years earlier.

The Firewall Assumed the Hardware Was Telling the Truth

There’s another reason this story deserves more than a procurement-policy reading.

In May 2025, Reuters reported that U.S. experts had found undocumented communications equipment inside some Chinese-made solar inverters. One of its two anonymous sources also said undocumented communications devices, including cellular radios, had been found in some batteries from multiple Chinese suppliers.

The caveats are important. Reuters couldn’t determine how many inverters or batteries had been examined. The sources weren’t named. The report didn’t establish that every Chinese inverter contained undocumented hardware, that the devices had been used maliciously or that the U.S. grid had been broadly compromised.

Still, the mechanism matters.

Utilities can put firewalls around the communications paths they know about. An undocumented radio creates a path the network design may not know exists. The firewall didn’t suddenly fail. The inventory was incomplete.

That’s a different class of security problem. The documented interface may not be the complete interface.

A software vulnerability often gives you something concrete to hunt for: a version, a hash, a package, a CVE. Hardware and firmware supply-chain questions can be uglier. What is actually inside the device? Which components came from which suppliers? Which maintenance channel can reach it? What behavior is undocumented because nobody knew to ask?

The Reuters report isn’t proof of a hidden kill switch. It’s evidence that provenance and interface discovery deserve a place in the threat model.

Procurement Is Architecture

Security teams often inherit supply-chain risk after the consequential decisions have already been made.

The vendor was selected. The contract was signed. The equipment was ordered. The remote-support model was accepted. The update path was designed. The dependency on the manufacturer became part of operations.

Then security gets asked whether the system is safe.

NIST’s new July 2026 due-diligence guide for cybersecurity supply-chain risk management is useful here because it refuses to reduce the problem to a vendor questionnaire. Its assessment components include foreign ownership, control or influence, provenance, resilience, foundational cyber practices and supply-chain tiers.

FERC has been moving in the same direction for the bulk-power system. In September 2025 it approved new action on supply-chain risk-management reliability standards, building on requirements for entities to address risks in industrial-control-system hardware, software and services.

The common thread is visibility before dependence.

Procurement determines more of your eventual security architecture than most organizations admit. It can determine who can maintain the equipment remotely, how updates arrive, which supplier dependencies sit underneath the product and whether you have a realistic replacement path when the risk changes.

By the time an incident responder sees an alert, those choices may already be sunk costs.

The Flag on the Box Is Not a Control

The executive order explicitly pushes federal procurement toward U.S.-manufactured energy infrastructure. That can reduce some geopolitical and supply-disruption risks. It doesn’t turn country of origin into a complete security model.

NIST’s July guidance makes that clear without making a political argument. Foreign ownership, control or influence is one component of due diligence. So are provenance, resilience, basic cyber practices and the tiers behind the supplier you are directly buying from.

Domestic equipment can still have vulnerable firmware, weak remote access or fragile supplier dependencies. Foreign equipment isn’t one homogeneous risk category either.

So I’d resist the easy translation of this order into “buy American and the security problem goes away.” The government itself is building a more granular model. The order allows the Secretary of Energy to establish criteria for pre-qualified equipment and vendors, while also evaluating particular transactions and existing equipment based on risk.

The useful question isn’t which flag is printed on the shipping crate.

It’s whether you understand the equipment’s provenance, communications paths, update and maintenance mechanisms, supplier dependencies and replacement options well enough to make a decision when the threat model changes.

The grid makes this problem dramatic because the equipment is enormous, the service is essential and some replacements take years. The leadership lesson travels well beyond utilities.

Take the technology your organization can’t operate without and look at three things: remote-access or maintenance channels you don’t directly control, supplier or component tiers you can’t currently trace and replacements that would take months or years instead of days.

If the answer is “we don’t know,” that doesn’t mean the equipment is compromised.

It means you don’t know which options you have if a vulnerability, sanctions decision, supplier failure or incident suddenly changes the acceptable risk.

That’s why inventory belongs at the beginning of this story, not after the headline about backdoors.

In 2020, DOE was already restricting certain Chinese-supplied bulk-power equipment serving critical defense facilities. In 2025, FERC tightened the supply-chain conversation again. Now the federal government has declared a national emergency and is explicitly considering how to identify, inventory, isolate, monitor and replace risky equipment already in the field.

Two facts can sit next to each other without much editorial help: the risk has been on the government’s radar for years, and the installed base still matters enough to require a new emergency order.

Security debt isn’t always old code.

Sometimes it arrived on a pallet, passed procurement and became part of the infrastructure before anyone asked how hard it would be to remove.

If a critical system can’t be inventoried, isolated, monitored or replaced without threatening the business it supports, procurement already made part of your incident-response plan.

Security should know what it bought before the incident decides for you.

Subscribe now

Resources

• Executive Order 14421, Declaring a National Emergency to Secure the United States Bulk-Power System, August 26, 2026, published in the Federal Register August 31, 2026: https://www.govinfo.gov/content/pkg/FR-2026-08-31/pdf/2026-17843.pdf

• The White House, Fact Sheet: President Donald J. Trump Declares a National Emergency to Secure America’s Bulk-Power System, August 26, 2026: https://www.whitehouse.gov/fact-sheets/2026/08/fact-sheet-president-donald-j-trump-declares-a-national-emergency-to-secure-americas-bulk-power-system/

• U.S. Department of Energy, Large Power Transformer Resilience Report to Congress, July 2024: https://www.energy.gov/sites/default/files/2024-10/EXEC-2022-001242

• U.S. Department of Energy, Strengthening America’s Grid Supply Chain, August 2026: https://www.energy.gov/oe/articles/strengthening-americas-grid-supply-chain

• Reuters, Rogue communication devices found in Chinese solar power inverters, May 14, 2025, republished by Investing.com: https://www.investing.com/news/stock-market-news/ghost-in-the-machine-rogue-communication-devices-found-in-chinese-inverters-4043741

• Federal Energy Regulatory Commission, FERC Takes Action to Enhance Reliability of the U.S. Electric Grid, September 18, 2025: https://www.ferc.gov/news-events/news/ferc-takes-action-enhance-reliability-us-electric-grid

• National Institute of Standards and Technology, SP 1326, Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide, July 8, 2026: https://csrc.nist.gov/pubs/sp/1326/final

• U.S. Department of Energy, Secretary of Energy Signs Order to Mitigate Security Risks to the Nation’s Electric Grid, December 17, 2020: https://www.energy.gov/articles/secretary-energy-signs-order-mitigate-security-risks-nations-electric-grid

Source note: the Federal Register identifies the August 26 order as Executive Order 14421. The White House order page currently labels it 14420, which duplicates the number shown for an August 10 order on the White House executive-order index. I use the Federal Register number here and avoid relying on the White House page for the identifier.

Analytical note: the argument that procurement decisions become part of incident-response capability is my interpretation of the order, DOE replacement constraints, NIST due-diligence guidance and FERC supply-chain requirements. The Reuters findings are reported findings based on anonymous sources and an undisclosed sample size, not proof of broad grid compromise.

• Pulse Security AI’s 42-person survey found 71% spent 10+ hours preparing each board cycle while 55% said their board had no formally defined cyber risk appetite.

• NACD’s 2026 guidance says the board and management should define that appetite, then report current exposure against it.

• Better slides can’t replace the missing decision about how much risk the company is willing to carry.

Pulse Security AI surveyed 42 security leaders and corporate directors about board reporting.

Seventy-one percent said they spend at least ten hours preparing for each board cycle. Fifty-five percent said the board has never formally defined the company’s cyber risk appetite.

Those two numbers don’t belong in separate conversations.

The first says security teams spend a lot of time building the report. The second says many of those reports have no agreed threshold to report against.

The usual advice is better storytelling. Shorten the deck. Replace CVSS scores with business scenarios. Add financial exposure. Put the architecture diagram in the appendix.

And that’s all useful.

But eventually somebody has to answer a different question: How much of this risk are we willing to carry?

If nobody has answered it, the CISO can spend two days polishing the presentation and still walk into the room without the one thing that makes the colors mean anything.

Subscribe now

Ten Hours Against No Baseline

The Pulse numbers need the usual vendor-survey caveat.

Pulse is a security-program-management company. Its survey had 42 respondents, 70% of them CISOs or heads of security, plus more than 20 in-depth interviews and two workshops involving roughly 22 CISOs. Pulse says directly that the statistics aren’t nationally representative.

So I wouldn’t turn 55% into an estimate of every corporate board in America.

I‘d treat it as a field signal.

Especially because the 2026 NACD and Internet Security Alliance Director’s Handbook on Cyber-Risk Oversight describes exactly the governance step the survey says is often missing.

NACD’s Principle Four says the board should work with management to define the organization’s cyber-risk appetite: the amount and types of risk it is willing to accept while pursuing its objectives. NACD says that appetite should be explicit, quantitative where possible and expressed in business or financial terms. Management then operates the program inside that direction.

Principle Five completes the loop. NACD says board reporting should show current exposure against the board-approved risk appetite.

That’s a different job from making a technical dashboard easier to understand.

Red and Green Need a Reference Point

A critical vulnerability can be technically severe whether your board likes it or not. Severity and business acceptance are different questions.

The board isn’t there to decide whether CVSS 9.8 is a large number. It needs enough information to understand what the scenario can do to the business, how exposed the company is and whether management is operating inside the risk boundary the company agreed to.

That last part disappears when the appetite was never defined.

Imagine two identical red boxes on two board dashboards.

At Company A, red means estimated exposure exceeds a board-approved threshold and management needs a decision on treatment.

At Company B, red means the security team thinks the situation is bad.

Same color. Different governance.

Company A encoded a prior decision into the report. Company B encoded an opinion.

Share

This is where I think we sometimes give CISOs the wrong communication advice. We tell them to stop speaking security and start speaking business. Fine. But business language doesn’t create a business decision nobody made.

Pulse found another version of this in its small sample. Forty-nine percent primarily described cyber-risk severity with qualitative categories. Only 3% primarily used quantified dollar amounts.

I wouldn’t turn that into “everything needs a dollar sign.” Fake precision is not maturity. NACD itself says quantitative where possible. A qualitative boundary can still be a boundary.

The failure is having none.

“Speak Business” Is Downstream Advice

Take ransomware against a critical operation.

A CISO can explain the likely interruption, which services are exposed, what recovery looks like, which controls are missing and the plausible financial consequences.

The board may understand every word.

There‘s still another decision: is that exposure acceptable?

Maybe the company is willing to carry more risk because reducing it would delay a major launch. Maybe the potential loss sits outside anything the company wants to tolerate. Maybe management should transfer part of it through insurance, spend to reduce it or explicitly accept it for six months.

Security can model those choices and recommend one. Security shouldn’t quietly make the enterprise risk decision by deciding whether a box is red.

NIST IR 8286A Rev. 1 comes at the same problem from the enterprise-risk side. The December 2025 revision describes cybersecurity risk analysis in the context of risk appetite and risk tolerance, then uses risk registers to help decision-makers prioritize risk response and monitoring.

So the threshold is not decoration around the risk analysis. It It’s an input to it.

If the company never established that input, the CISO ends up reverse-engineering risk appetite from whatever gets approved, delayed or funded.

You find out what the company was supposedly willing to risk only after somebody reacts to the recommendation.

That’s backwards.

The Board Meeting Should Produce a Decision

Pulse reported one number I think deserves more attention than it got: half of respondents said their boards had made no explicit decision to accept, mitigate or transfer cyber risk during the prior year.

Again, small sample.

Still worth asking about your own board.

If a quarterly cyber meeting produces questions, discussion and another request for slides but never an explicit risk decision, what exactly is the meeting governing?

My read is that a lot of organizations have turned the cyber board deck into a briefing instrument. The CISO explains the environment. Directors ask questions. Everybody leaves better informed.

NACD’s model asks more of the meeting.

The report should show where current exposure sits relative to a boundary the board already approved. When exposure crosses that boundary, management reduces it, transfers it, avoids it or comes back with a reason the company should accept more.

That changes the package.

For each material scenario, I’d want five things: the scenario, current exposure, the agreed appetite or tolerance, management’s recommended response and the decision required from the board.

Examples: ransomware disrupting a core operation, compromise of sensitive customer data, failure of a critical third party.

Then stop.

The vulnerability inventory can live somewhere else.

And if the company has never defined the appetite, don’t hide that absence behind a heat map. Put it on the agenda.

The Missing Decision

Only 12.5% of the security leaders in Pulse’s survey said they were very confident that the board walked away from a presentation understanding the true state of the security program.

The obvious response is another round of communication training.

Maybe some CISOs need it.

But communication isn’t always the first failure.

A board report can explain the security posture clearly and still leave directors unable to judge whether the posture is acceptable. That happens when reporting gets built before risk appetite does.

So before spending another ten hours on the deck, look at the red, yellow and green boxes and ask what each one is measured against.

If the answer is a board-approved risk boundary, good. Improve the report.

If the answer is “we haven’t actually set one,” stop polishing slide four.

That’s the first item on the agenda.

Leave a comment

Resources

• Pulse Security AI, The CISO-Board Communication Gap, August 2026. Survey of 42 security leaders and corporate directors, 20+ interviews and two moderated workshops with roughly 22 CISOs. Pulse explicitly states that the statistics are not nationally representative.

• National Association of Corporate Directors and Internet Security Alliance, 2026 Director’s Handbook on Cyber-Risk Oversight, Principle Four: Adopt an Enterprise Framework for Managing Cyber Risk, April 16, 2026.

• National Association of Corporate Directors and Internet Security Alliance, Principle Five: Guide Cybersecurity Risk Measurement and Reporting, April 16, 2026.

• NIST IR 8286A Rev. 1, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management, December 2025.

Analytical note: the argument that an undefined risk appetite can make otherwise accurate board reporting less decision-useful is my interpretation of the governance guidance and survey findings above. Pulse’s sample is small and non-representative.

• Gallup’s May 2026 data says 65% of employees at organizations using AI report better personal productivity. Only 14% strongly agree AI has changed how work gets done. The 51 points in the title come from subtracting the second number from the first.

• ISC2 found 65% of cybersecurity professionals surveyed are spending more time deciding whether to trust or act on AI recommendations, while 63% are spending more time checking the output.

• AI can shorten the first part of the job without shortening the whole job. Review, ownership and human judgment can become the new delay.

People are reporting that AI makes them faster. The organizations around them seem to be changing much more slowly.

Gallup’s current workplace AI indicator puts numbers on that difference. Among employees at U.S. organizations that have implemented AI, 65% say it has had a positive effect on their productivity and efficiency. By comparison, 14% strongly agree AI has transformed how work gets done in their organization. That’s the 51-point spread I’m writing about: 65% minus 14%.

I’m doing that subtraction, not Gallup. The 51 points aren’t a formal Gallup metric, and the two questions use different response scales. So I wouldn’t treat 51 as some new productivity index. It’s a useful signal that the individual experience and the organizational experience may be moving at very different speeds.

Gallup’s Q2 numbers make that worth watching. Forty-seven percent of U.S. employees say their organization has integrated AI tools, up from 41% the previous quarter. Fifty-two percent say they use AI in their role at least occasionally, and 30% use it a few times a week or more.

People are using the tools. Now follow what happens to their work after the tool finishes.

Subscribe now

Faster Worker, Same System

Take a security analyst using AI to cut a first-pass investigation from twenty minutes to five. Great. Then the recommendation waits for senior review. Maybe an application owner has to weigh in. Maybe somebody needs to approve a change or verify the evidence before anyone acts.

Security already knows this pattern. Add a lot more finding capacity without adding triage capacity and you don’t magically get fewer vulnerabilities. You can get a bigger queue. AI can create the same problem in ordinary workflows: more useful output arriving faster at the same people who were already responsible for checking it.

Gallup doesn’t measure that downstream effect. I’m making the connection. But Microsoft’s 2026 Work Trend Index gives us another reason to look there. Its global survey covered 20,000 AI users across 10 markets. Only 26% said leadership was clearly and consistently aligned on AI. Microsoft also found that organizational factors such as culture, manager support and talent practices accounted for 67% of the statistical association with reported AI impact, compared with 32% for individual factors such as mindset and behavior.

Microsoft is careful here, and we should be too. That’s an association, not proof of cause. But it points at something leaders can inspect inside their own companies. Someone can get very good at using AI while their work still passes through the same approvals, handoffs and decision rules it did two years ago.

The tool changed. The route didn’t.

Share

Security Is Already Feeling It

ISC2 surveyed 856 cybersecurity professionals who use AI in their roles. Sixty-five percent said they were spending more time deciding when to trust or act on AI-generated recommendations. Sixty-three percent were spending more time reviewing or validating AI output.

That’s the part I care about.

AI can remove effort from one part of the job and put some of it back somewhere else. The work didn’t disappear. Some of it moved into deciding whether the answer is good enough to act on.

ISC2 also found that 48% were spending less time on tasks that don’t involve AI assistance. At the same time, half of respondents said human decision-makers bear final accountability when an AI-recommended action turns out to be wrong. Nearly a quarter said they’re often or very often expected to act on AI-generated security output without fully understanding how it was produced.

So the machine can produce the recommendation faster, while the person sitting behind it still owns the mistake.

That changes the job.

SANS saw something related in its July AI survey. AI use in cybersecurity rose from 50% to 78% in a year, yet only 27% of practitioners described their deployments as mature production. Seventy-six percent said security now has a governance role for enterprise AI. Sixty-three percent reported significant shortcomings in AI-assisted threat detection and response.

The tools arrived quickly. The rules for trusting them, checking them and deciding who owns the result are taking longer.

The Bottleneck Moved

Security teams have spent years automating the slow parts of the job. AI speeds up another chunk of it. But if the output still sits waiting for review, approval or someone willing to own the decision, you haven’t removed the delay. You’ve moved it.

An alert might be summarized in seconds and then wait an hour because nobody trusts the summary enough to close it. Or AI might rank a vulnerability instantly, only for the ticket to sit because the application owner isn’t clear. The machine has already finished. The work hasn’t.

That distinction matters because a lot of AI programs are still being measured at the tool. Seats. Usage. Prompts. Agents deployed.

Those numbers tell you whether people are using AI. They don’t tell you whether anything finishes sooner, let alone with accuracy.

If you want to know that, measure what happens after the output appears. How long until somebody checks it? How often does it get sent back? How often does a human reverse the recommendation? Most important, when does someone finally act?

If the first step went from twenty minutes to five and the final action still takes three hours, AI probably did what you asked it to do.

You found the next constraint.

Run Two Clocks

Pick one security workflow and run two clocks.

Stop the first when AI produces something a competent person considers useful. Stop the second when the organization actually does something with it.

The distance between those clocks is where I’d look next. Maybe the work is sitting with a reviewer. Maybe nobody knows who can approve it. Maybe the evidence isn’t strong enough yet. Whatever the reason, you can finally see where the time went.

Alert triage is an obvious place to try this because the start and finish are relatively easy to see. But the test works anywhere AI touches a workflow. Don’t ask only whether the analyst got faster. Ask whether the decision happened sooner and whether the result was still good.

I wouldn’t turn this into a staffing argument yet. Some tasks will genuinely require fewer human hours. Others may create more review because AI lets people produce plausible-looking work much faster than before. You have to measure the whole path before you know which one you have.

Gallup’s 51-point spread doesn’t prove organizations have failed to change. It tells us employees report a much bigger change in their own productivity than they report in how work gets done around them.

That difference is worth looking more deeply at.

If AI gives your analyst an answer in thirty seconds and your organization still needs three days to act on it, stop measuring the thirty seconds.

Follow the work downstream.

Leave a comment

Resources

• Gallup, Artificial Intelligence Indicator. May 2026 data: 65% positive self-reported productivity among employees at organizations that implemented AI, 14% strongly agree AI transformed how work gets done, plus survey methods and current adoption measures.

• Gallup, Organizational AI Adoption Jumps Six Points, July 20, 2026. Reports organizational integration rising from 41% to 47% in Q2, 52% total workplace AI use and 30% frequent use.

• Microsoft, 2026 Work Trend Index: Agents, Human Agency, and the Opportunity for Every Organization, May 5, 2026. Global survey of 20,000 AI users across 10 markets, including leadership alignment and the 67% vs. 32% organizational/individual association. Microsoft states the finding is associative, not causal.

• ISC2, Rethinking AI’s Impact on Cybersecurity Roles, July 14, 2026. Survey of 856 cybersecurity professionals using AI, including changes in validation time, decision pressure and accountability.

• SANS Institute, AI Use in Cybersecurity Jumped From 50% to 78% in a Year, July 13, 2026. Survey of 536 cybersecurity and IT practitioners plus a module of 57 senior security leaders, including maturity, governance and detection/response findings.

The queue and two-clock examples are my interpretation of the survey results. Gallup, Microsoft, ISC2 and SANS didn’t measure those exact workflow effects.

• Security capacity is easiest to cut when nothing is visibly on fire, which can make preparedness look like unused labor.

• Recent CISA workforce cuts and a later pledge to restore 600 positions make the problem unusually visible: cyber capability doesn’t rebuild at incident speed.

• The better leadership test is not utilization. It’s whether the organization can absorb a serious incident without discovering that one exhausted person was the control.

Security capacity looks wasteful when nothing is burning. The incident channel is quiet, the queue is manageable and a senior responder who isn’t actively responding to anything can start to look like expensive empty space on a staffing sheet. That’s usually when somebody gets clever with the math.

The role is consolidated. The second person who knows the ugly part of the identity stack is declared redundant. Regional coverage gets thinner. Training gets pushed because production work is measurable and preparedness mostly isn’t. On a normal Tuesday, the spreadsheet looks cleaner. Then the pager goes off, and the spreadsheet discovers what it removed.

The Spreadsheet Sees Idle

Cybersecurity has a measurement problem that often gets disguised as a staffing problem. We are very good at counting visible work: alerts closed, vulnerabilities patched, tickets handled and assessments completed. We are much worse at pricing the ability to handle the thing that hasn’t happened yet.

That ability can look suspiciously like slack. A senior responder who has enough room to think. Two people who can each perform a critical function even though only one is needed during normal operations. An engineer who remembers why the ugly exception exists because they were there when it was made. A regional advisor whose value sits partly inside relationships thatdon’t not generate tickets.

Put those people into a utilization model and some will look expensive. Put them into a real incident and the arithmetic changes quickly. NIST’s current incident-response guidance treats incident response as part of cybersecurity risk management across the organization, not as a task that begins after detection. If response capability has to exist before the event, some of what leadership is buying will look quiet before it looks valuable.

The hard part is that quiet capacity and useless capacity can look almost identical from far enough away. That’s exactly why a spreadsheet built around ordinary-week utilization is such a weak instrument for deciding what the organization can safely lose.

CISA Is Running the Experiment in Public

The current fight over the Cybersecurity and Infrastructure Security Agency makes the problem unusually visible. In June, Sen. Mark Warner said CISA had lost nearly one-third of its workforce since January 2025, primarily senior career officials. In May, Sen. Maggie Hassan separately wrote that CISA had lost more than a third of its workforce in 2025, including almost all of its senior leaders.

Those are statements from elected officials, not an independent census of the agency, so I wouldn’t treat either percentage as a sacred measurement. The direction is still difficult to miss. CISA lost substantial experienced capacity, and on June 28 Warner publicly welcomed what he described as CISA’s plan to rehire 600 federal employees.

In her May letter to CISA’s acting director, Hassan put it plainly:

In 2025, for example, CISA lost more than a third of its workforce, including almost all its senior leaders, raising questions in the private sector and Congress about the direction of the agency.

There’s a useful detail on the other side of the aisle too. In January, the Republican-led House Homeland Security Committee said its FY2026 DHS appropriations package included $20 million to strengthen the CISA workforce and directed the agency to maintain sufficient staffing, preserve regional field offices and ensure every state and territory had dedicated cybersecurity-advisor support.

The politics are different, but the operational fact underneath them is not: cyber capability has to be standing there before the bad day arrives. That doesn’t mean every cut is reckless or every security role is sacred. It means leadership should understand what a role is buying before deciding that today’s unused capacity is tomorrow’s safe savings.

Share

Capacity Is More Than Headcount

A lazy version of this argument would be “never cut security people.” I don’t buy that. Security organizations can get bloated, teams can keep doing work long after the reason disappeared and a large headcount can still produce a weak program.

Headcount is not capability, but capability is not headcount-free either. When an experienced person leaves, the organization can lose more than one line on an org chart. It may lose the memory of why a control was built a certain way, the person who knows which vendor actually answers after midnight, the responder who can separate familiar noise from the first five minutes of something ugly and the second pair of hands that lets the first responder sleep before hour twenty-six.

Some of that can be documented. Good teams document aggressively. Some of it lives in what people have seen, who they know and what they notice before they can fully explain why it feels wrong.

GAO’s July review of the Federal Rotational Cyber Workforce Program is a useful reminder that building this kind of depth is not automatic. GAO reported that 634 employees applied to the program over its life, while only eight were approved to serve rotations. It also found the program had effectively been halted after low participation and shifting priorities.

The point is not that rotations solve the workforce problem. The point is that judgment, cross-agency familiarity and operational depth take deliberate repetition to build. Once that depth leaves, a requisition is not the same thing as replacement.

The Utilization Trap

A security function run at permanent full utilization is a system with no shock absorber. It can look wonderfully efficient right up until something abnormal happens, then every person pulled into response creates another hole behind them. Vulnerability work pauses. Access reviews slip. Engineering projects stall. Someone who already owns two critical systems inherits a third because the one person who knew it best is now living in the incident bridge.

This is where utilization and readiness stop being the same thing. The corporate instinct is to ask whether people are busy enough. Security leadership has to ask something more useful: busy enough for which day?

A normal week and a serious incident are different operating modes. Designing the team entirely around the first and expecting it to absorb the second is like sizing emergency power around average grid demand. It works beautifully until the reason you bought emergency power finally shows up.

That is why I am suspicious of the phrase “extra capacity.” Extra compared with what: the average ticket queue, last quarter’s incident count or the worst event the company has already survived? A spare tire is underutilized right up until the interesting part of the trip.

Run the Incident-Day Test

Before cutting a security team, I would want a different sheet. Not names and salaries first. Capabilities. Take the credible incident you least want next quarter and run the staffing model against it.

Who is on the bridge in the first hour, and who can replace them six hours later? Which critical functions have one person who actually understands the machinery? What normal security work stops while response is underway? Which partner or vendor relationships disappear when one employee leaves?

Then look at the second day, because that is where the fantasy of unlimited human capacity usually gets expensive. Who slept? Who is making consequential decisions after sixteen hours awake? Who can communicate with executives while somebody else stays close enough to the technical detail to know whether the story is drifting away from reality?

There is a difference between redundancy and resilience. Redundancy is two people who can do the same job. Resilience is having enough depth, memory and relationships that the system can take a hit without turning one exhausted person into the architecture.

If the cuts still make sense after that test, make them. Security should not be exempt from hard choices merely because the work is scary. But the choice should be explicit: this is the capability we are reducing, this is the failure mode we are accepting and this is what we will not be able to recreate quickly if we guessed wrong.

That is a much cleaner conversation than arguing about benchmark headcount or pretending there is a universal ratio of security people to employees. A board does not need to know whether the team looks lean. It needs to know what the organization can still do when the incident consumes the people normally doing everything else.

That is the capacity number. If the answer depends on calling back the people you cut six months earlier, you did not save capacity. You spent it.

Resources

• U.S. Sen. Mark Warner, “Warner Raises Alarm on CISA Workforce and Budget Cuts That Are Leaving Our Country Vulnerable to Threats,” June 16, 2026. https://www.warner.senate.gov/newsroom/press-releases/warner-raises-alarm-on-cisa-workforce-and-budget-cuts-that-are-leaving-our-country-vulnerable-to-threats/

• U.S. Sen. Mark Warner, “Senate Intel Vice Chair Warner Statement on Secretary Mullin’s Pledge to Rehire 600 Staffers,” June 28, 2026. https://www.warner.senate.gov/newsroom/press-releases/senate-intel-vice-chair-warner-statement-on-secretary-mullins-pledge-to-rehire-600-staffers/

• U.S. Sen. Maggie Hassan, “Senator Hassan Presses for Answers on Major Reported Data Leak at Leading Cybersecurity Agency,” May 19, 2026. https://www.hassan.senate.gov/news/press-releases/senator-hassan-presses-for-answers-on-major-reported-data-leak-at-leading-cybersecurity-agency

• U.S. House Committee on Homeland Security, “Chairman Garbarino Celebrates House Passage of the FY2026 Department of Homeland Security Appropriations Bill,” January 22, 2026. https://homeland.house.gov/2026/01/22/chairman-garbarino-celebrates-house-passage-of-the-fy2026-department-of-homeland-security-appropriations-bill/

• U.S. GAO, “Cyber Workforce: Agencies Did Not Widely Adopt Rotational Program,” July 16, 2026. https://www.gao.gov/products/gao-26-108736

• NIST, “Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile,” SP 800-61 Rev. 3, April 2025. https://csrc.nist.gov/pubs/sp/800/61/r3/final

Only 34% of security professionals surveyed plan to stay with their current employer. The sharper signal is a 54-point career-satisfaction gap tied to whether security feels like a core organizational priority.

I’m still in Las Vegas. Black Hat has wrapped and DEF CON is underway, which puts an unusual amount of the security profession within a few miles of each other for a week.

It’s a strange place to be thinking about retention.

Or maybe exactly the right one

IANS Research and Artico Search surveyed more than 500 security professionals for their 2026 Cybersecurity Talent Report, published in April. Only 34% said they plan to stay with their current employer.

That does not mean the other 66% have resignation letters drafted. Some are considering a move. Some are probably undecided. But only about a third are willing to say, yes, I plan to remain here.

For a field that spends so much time talking about talent shortages, that’s a pretty uncomfortable number.

The 54-point number

The same report contains a finding I think is more useful than the headline.

Among security staff who see security as a core organizational priority, 73% report being satisfied with their careers. Among those who perceive little or no organizational backing for security, satisfaction falls to 19%.

That’s a 54-point gap.

Not between the highest-paid people and the lowest-paid. Not between executives and analysts. The split in this particular finding is how respondents perceive their organization’s commitment to the work.

That’s correlation, and it’s worth saying so clearly. The survey does not prove that organizational backing causes career satisfaction. People who are happier may also judge their organizations more favorably, and there are probably other variables moving underneath both numbers.

Still, 73 to 19 is hard to wave away.

It suggests that what people believe about the organization’s commitment to security is connected to how they feel about the career they’re building inside it.

The pay answer, and where it runs out

Pay people more.

Fair answer.

Money matters. I’ve never met an engineer who works day after day for gratitude, and anyone trying to explain retention while pretending compensation is irrelevant has probably skipped an important part of the problem.

But the IANS and Artico data adds an interesting wrinkle: wage growth matters more for retention than absolute pay level. Employees receiving even modest increases reported higher satisfaction and stronger intent to stay than employees whose compensation remained flat, regardless of where the absolute number started.

That makes intuitive sense to me. The number matters, but movement carries information too.

A raise says something changed.

Steve Martano, an IANS faculty member and partner at Artico Search, framed the larger issue around rising expectations and constrained resources. His point was that top talent is looking for more than compensation alone. Visibility, career growth and support from security leadership matter too.

So I don’t think the data says pay doesn’t matter.

It says pay isn’t the whole message.

What people are working inside

The pressure underneath these retention numbers isn’t especially mysterious.

ISC2’s 2025 Cybersecurity Workforce Study surveyed 16,029 people responsible for cybersecurity around the world. 59% reported critical or significant skills needs on their teams, up from 44% the year before.

More interesting to me is what happened downstream.

ISC2 reports that 88% of respondents experienced at least one significant cybersecurity consequence because of a skills deficiency within their team or wider organization. Sixty-nine percent reported more than one.

That isn’t a prediction about what a shortage might eventually do.

Respondents were describing consequences they said had already happened.

You can pay somebody well and still place them inside a system where the responsibility keeps expanding faster than the resources available to meet it. The salary changes. The queue doesn’t. The person is still accountable for an outcome they increasingly suspect the organization has not equipped them to produce.

Eventually that becomes information.

Not just about the job.

About the place.

The person expected to fix it may be looking too

Leadership isn’t standing outside this problem.

Proofpoint’s 2025 Voice of the CISO surveyed 1,600 CISOs across 16 countries. Sixty-three percent said they had experienced or witnessed burnout during the previous year. The same report found 66% facing what respondents described as excessive expectations.

Then IANS and Artico surveyed 662 CISOs for their 2026 State of the CISO benchmark. Nearly seven in ten said they were open to making a career move within the next year.

That doesn’t mean seven in ten are quitting either.

It does mean the people we’re asking to stabilize security teams are themselves unusually mobile.

I think that matters when we reduce retention to something a manager is supposed to fix with better one-on-ones.

The manager may be looking at the same door.

What Vegas builds really well

This week makes the contrast difficult to miss.

Black Hat’s Business Hall had more than 400 vendors and startups this year. Its own description talks about networking, making connections and discovering career opportunities alongside all the products, demos and meetings.

Then there’s BSides Las Vegas.

Its Hire Ground program has existed since at least 2016. The archived description talks openly about interview preparation, recruiters, resume help, social profiles and career mapping. Hire Ground is still on the BSidesLV schedule in 2026, with sessions this week on high-performing security teams, getting hired, surviving the cyber job market and standing out in it.

That’s useful infrastructure. I’m not criticizing it.

People need ways into better jobs. People need ways out of bad ones.

But we’ve gotten remarkably good at building machinery around movement.

Recruiting systems. Career tracks. Interview coaching. Resume reviews. Job boards. Search firms. Conference programming.

There’s a whole apparatus for helping somebody become somebody else’s employee.

I can’t find an equivalent apparatus for making the current place worth staying.

Nobody rents floor space to retention

That’s the line I keep coming back to.

Nobody rents floor space to keeping people.

There’s no retention booth because retention isn’t really a product. You can’t buy it in a hall at Mandalay Bay, integrate it next quarter and put a green check beside it.

It’s mostly ordinary decisions.

Whether someone gets the headcount they were told was coming. Whether the project that matters gets funded. Whether a strong engineer can see an actual next step instead of another year of “we’re working on the leveling framework.” Whether the security leader is allowed to make decisions or simply absorbs accountability from people who can.

None of that demos especially well.

It still shows up in the numbers.

The mentorship answer

Nick Kakolowski, IANS’s Senior Research Director, argues that leaders should invest harder in mentorship, coaching and career development. The idea is straightforward: give people a sense of progression and purpose before burnout gets to make the decision for them.

I agree with that.

I also think mentorship has a failure mode we don’t talk about enough.

If the person coaching you has no budget, no headcount, no authority over progression and no realistic path of their own, eventually the coaching becomes a description of a room neither person can change.

Good conversation. Same room.

Mentorship works when it’s attached to something real.

A decision someone can make. A training budget that actually exists. Scope that can expand. A title that can change. Compensation that moves. Access to work that develops the person instead of simply consuming them.

Otherwise we’ve handed somebody a sympathetic listener and called it a career path.

What “backing security” actually looks like

This is where I think the 73% versus 19% number gets interesting.

Saying security is important is free.

Every company can do that.

The team learns what you mean by watching everything that costs something.

Budgets. Hiring approvals. Deferred projects. Incident staffing. Whether security gets involved before or after a decision. Whether the CISO has access to the people making the tradeoffs. Whether the same three people keep absorbing the work created by every new priority.

Those are signals.

People are good at reading them.

Which may be why “organizational backing” shows up so loudly in the satisfaction data. Whatever the direction of causation, employees are not judging the company’s commitment from the values page.

They’re living inside the allocation decisions.

The test I’d rather use

I’ve never loved tenure by itself as a measure of a healthy team.

Long tenure can mean someone is thriving. It can also mean they haven’t looked recently, the market isn’t cooperating or leaving would cost too much personally.

I’d rather ask something harder:

A team where the answer is yes has a chance of making staying an actual choice.

That’s different from retention through friction.

Different from loyalty through dependency.

Different from quietly building a room with a difficult door.

And I think people can feel the difference.

The hall for the other half

Black Hat is over now. DEF CON is going.

Vegas is still full of movement: people meeting each other, exchanging ideas, discovering companies, finding opportunities and figuring out what they might do next.

That machinery works.

I’m glad it exists.

But after looking at the retention numbers, I’m more interested in the machinery that doesn’t have a hall.

The part where someone goes back to work after all of this and decides, again, that the place they’re already in is still worth choosing.

Nobody gets a booth for that.

Somebody still has to build it.

Resources

• 2026 Cybersecurity Talent Report announcement - IANS Research and Artico Search

  Primary source for the survey of 500+ security professionals, the 34% stay-intent figure, 73%/19% career-satisfaction split, wage-growth finding and comments from Nick Kakolowski and Steve Martano.

• 2025 ISC2 Cybersecurity Workforce Study

  Primary study based on 16,029 respondents. Source for the 59% critical/significant skills-needs figure and the 88%/69% reported security-consequence figures.

• Proofpoint 2025 Voice of the CISO

  Primary source for the survey of 1,600 CISOs across 16 countries and the 63% experienced-or-witnessed-burnout figure.

• 2026 State of the CISO Benchmark - IANS Research and Artico Search

  Primary source for the 662-CISO sample and the finding that nearly seven in ten CISOs are open to a career move within the next year.

• Black Hat USA 2026 Business Hall

  Black Hat’s official description of the 2026 Business Hall, including its 400+ vendors and startups, networking focus and career-opportunity language.

• BSides Las Vegas 2026 Schedule

  Official 2026 schedule showing Hire Ground and its current career-focused programming.

• BSidesLV Hire Ground archive, 2016

  Archived description of Hire Ground’s interview preparation, recruiter networking, resume support, social-profile help and career mapping.

• DEF CON 34 Conference Information

  Official DEF CON 34 conference information for the August 6-9, 2026 event in Las Vegas.

Someone offered me a bigger title once, and the thing I remember isn’t the title. It’s the list that came with it. Everything I’d now be responsible for, printed out, longer than the list before it. I kept waiting for the second page, the one that says what I’d be allowed to decide, and it wasn’t in the folder. Nobody hands you that page. You’re supposed to be too flattered to ask for it.

I’ve been thinking about that folder a lot lately, because the numbers say the entire security profession is being handed the same one. This April, Gravitee put a survey in front of 750 senior technology leaders across the UK and US. 54% reported an experienced or suspected AI agent security or data-privacy incident in the prior twelve months. Over a third confirmed one outright.

Now set the growth curve next to that number: the enterprise agent footprint roughly doubled between December 2025 and April 2026, and nearly 38% of organizations already run more than 100 agents in production. The incidents aren’t trailing adoption. They’re pacing it.

When one surfaces, the board often asks this question: why didn’t you see it?

Notice the pronoun. Not why didn’t we see it. You. Accountability had already landed on one chair, and nobody paused to ask whether that chair came with the access to answer.

AI governance has now been added to the job description, usually as one line: ensure AI safety. Splunk’s 2026 CISO Report asked 650 CISOs across nine countries, and 96% said they oversee AI governance and risk across the enterprise.

Fine. Look at what the mandate actually covers, though. Procurement runs agents that negotiate vendor terms and HR has them screening candidates and drafting offer letters. These systems don’t retrain themselves overnight, but they don’t hold still either. Configurations drift. Prompts get tuned. A vendor pushes an update and tool access quietly widens. The agent your team reviewed on Monday isn’t quite the agent making decisions on Friday and no change ticket marks the difference. Many were bought and wired in by teams the security org has never audited.

I call them shadow agents. Some were never approved. Others were approved once and changed underneath the approval. They’re shadows not because someone deliberately hid them, but because no one built a durable line of sight from deployment to consequence.

Forrester thinks they’re security’s problem now: its 2026 threat list ranks AI agents second, personal agents slipping in through browser hooks and inbox access, acting at machine speed outside governance, with CISOs accountable for exposure they have limited control over. And they don’t enter at the bottom of the org chart. TrustedTech Team surveyed 2,001 UK and US employees this spring: 65% of senior decision-makers use AI tools their employer hasn’t approved. The employees under them? 31%.

So here’s the ledger the board never reads. The mandate: clear. The tooling: partial and fragmented. The access: restricted, since the systems live under budget lines security doesn’t own. The authority to pull one out of production? Often zero.

Accountability moved into the seat. It doesn’t appear that anything else came with it.

The generous read says I’m describing a promotion, not a trap.

And it’s worth taking seriously, because smart people make it. Deloitte’s 2026 Global Technology Leadership Study surveyed more than 660 senior technology executives and put the shift in one line: “the era of the operational technologist is over.” The argument runs: security spent twenty years asking for a seat at the strategy table and AI governance is finally that seat. The CISO stops being the firewall keeper and becomes steward of the organization’s digital conscience. Not compliance anymore: judgment.

There’s real logic here. Somebody has to lead the security and assurance side of AI governance, and few executives in the building have spent a career studying how systems fail when a motivated person wants them to fail. Legal thinks in liability. Engineering thinks in uptime. Security already lives in adversaries and blast radius, which is exactly the muscle this moment demands.

Subscribe now

If the CISO can’t lead this, who can?

It’s a fair question.

So I ran the test it implies.

Pick one AI agent already in production. Something touching real money: loan underwriting, maybe payment routing. Then ask the executive who’s accountable for it to map that single agent’s lifecycle end to end: where the data comes from, what the agent can touch and who owns the decision when the agent gets it wrong. And somewhere in that map, make them show you the gate between recommendation and action. For consequential decisions, the model proposes; something more deterministic - a policy engine, a validation check or, where the stakes require it, a human - disposes.

My bet on where it breaks: the surface answers arrive fast. Vendor name, model family, the liability clause in the contract. Then you ask what the agent actually saw before last Tuesday’s decision, what context and instructions shaped its recommendation, and what authorized the system to act on it. The trail dies at the first integration boundary. Not because anyone’s hiding it... because nobody built the layer that would show it. Opaque to the buyer and often to the builder too.

If the ownership and evidence actually exist, a credible first-pass map shouldn’t require an excavation. I doubt most organizations could produce that map today. Gravitee’s numbers suggest that isn’t just my experience: mean monitoring coverage sits near 52%, leaving roughly half of production agents outside security’s line of sight.

Stewardship of a system you can’t inspect isn’t stewardship. It’s faith.

The trap is the assumption underneath the title: visibility tells you what happened. Authority lets you stop it. Evidence lets you defend what you did afterward. Boards are assigning the outcome while leaving all three incomplete. A dashboard doesn’t help if you can’t change what sits behind it. And shadow agents don’t necessarily announce themselves in the logs security already watches. Their consequential moves may happen across orchestration layers, tool calls, vendor APIs and downstream workflows that were never designed to preserve the model’s context or explain why an action was allowed. By the time the transaction reaches the system of record, the trail you’re being asked to audit may begin after the decision it was supposed to explain.

So one desk owns the outcome while the causes sit inside systems that desk can’t open. Ask why a specific decision went the way it did and you may get an explanation generated after the fact, not evidence of the path that produced it. That’s not oversight. That’s a performance audit where the auditor is denied the working papers, then graded on the result.

I’d call it a control gap, except a gap implies two edges you could someday close. This is accountability on one side and nothing on the other.

Elevation and exposure look identical on the org chart.

Both arrive with the bigger title and the seat at the table. The difference doesn’t show until something breaks. Elevation means authority moved with the responsibility. Exposure means the responsibility landed alone. One has the keys. The other just holds the seat.

The board says it wants a guardian. A guardian can act. What they’ve built instead is a witness: someone positioned close enough to the failure to describe it under oath, too far from the machinery to stop it.

That’s not a promotion. It’s a one-way door. You can walk into the seat. The accountability doesn’t walk back out with you.

The record already shows what the seat can cost. Joe Sullivan, Uber’s former chief security officer, was criminally convicted of obstructing an FTC proceeding and concealing a felony in connection with the company’s 2016 breach. The SEC later named SolarWinds CISO Timothy Brown individually in its SUNBURST case. That case ultimately ended without liability - the remaining claims were dismissed with prejudice in November 2025, with no finding against Brown - but he still spent two years as the named defendant.

CISOs did the math. In Splunk’s same survey, 78% said they’re concerned about personal liability for security incidents, up from 56% a year earlier. A 22-point jump in twelve months. And the seat doesn’t hold long enough to fix what it gets blamed for: One industry estimate from Cybersecurity Ventures puts typical large-enterprise CISO tenure at 18 to 26 months, compared with nearly five years across the rest of the C-suite.

So the practical move, the whole reason I’m writing this, is boring and it’s the only real defense I know. When they offer you the seat, do the arithmetic nobody does out loud. Put the new accountability in one column and the new authority in the other. The power to say no. The budget to see. The headcount to keep pace. The standing to halt a deployment that scares you. If the second column keeps up with the first, take the seat and do good work in it. If the first column runs a full page and the second is one sentence, you weren’t elevated. You were positioned. (You might have accepted both kinds of offers previously. The second kind pays about the same and sleep is a lot worse.)

Boards keep saying they want someone who can spot the failure before it happens. (I’m not sure “see” is even the right verb for what they’re asking. Predict, maybe. Or absorb.) The architecture they’ve funded guarantees the opposite: agents that act before the audit trail begins and vendor systems that hide the prompts, context, orchestration and version changes needed to reconstruct what happened. Every quarter the demand for accountability grows. Every quarter the visibility shrinks. Those two curves cross exactly where the CISO is standing.

So the question I’d put to any board isn’t whether their CISO can govern AI. It’s this: what have you let them see? Not the dashboards. The decisions.

Demand the accountability without answering that question and you haven’t built oversight. You’ve cast the trial in advance. When your organization joins Gravitee’s 54%, the CISO will be asked: why didn’t you see it? The answer won’t be in the logs. It’ll be in the contract.

Share

Resources

• The CISO Report 2026: From Risk to Resilience in the AI Era (Splunk) - Primary survey of 650 global CISOs on AI governance ownership and personal-liability concern (78% vs 56% year-over-year).

• Announcing Forrester’s Top Cybersecurity Threats For 2026 - Forrester’s own framing of agent threats as its second-ranked 2026 cybersecurity threat, including the “accountable for increased exposure with limited control” language.

• SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures - SEC’s original October 30, 2023 press release naming CISO Timothy Brown individually - the cautionary precedent the article uses.

• SEC Voluntarily Dismisses Landmark Enforcement Action Against SolarWinds and its CISO - Law-firm writeup of the November 20, 2025 dismissal with prejudice that closed the Brown case.

• State of AI Agent Security Report 2026 (Gravitee) - 750-leader survey on AI agent visibility, monitoring coverage and incident rates - the core shadow-AI-agent evidence base.

• Turns out the C-suite loves shadow AI (Help Net Security, on TrustedTech Team’s 2026 report) - Censuswide-fielded survey showing decision-makers use unapproved AI at more than twice the rate of the employees they manage (65% vs 31%).

• From Operators to Orchestrators: Deloitte’s 2026 Global Technology Leadership Study - 660+ tech-leader survey framing the broader operator-to-orchestrator mandate shift the CISO promotion narrative sits inside.

• CISOs Turnover Persists As AI Makes Cybersecurity More Crucial Than Ever (Cybersecurity Ventures) - Source for the 18-26 month CISO tenure figure used as exposure evidence.

Leave a comment

If AI does the entry-level work, where do the senior people come from? The question has nagged me for weeks and I can’t shake it.

I’ve watched people get good, and it never happened the way the org chart says it should. It happened in the boring work, the stuff nobody puts on a highlight reel. Someone burns two days chasing a false lead. Feels like pure waste at the time. But they never get fooled by that pattern again. Next time it shows up, they clock it in seconds and keep that instinct for good. Nobody sat them down and taught it. The two wasted days did.

The grunt work wasn’t in the way of the learning. The grunt work was the learning. Boring on the surface, load-bearing underneath.

And that boring work is exactly what the machines are good at now. So everyone tells a happy story: we’ve freed the junior people from the drudgery, they can skip ahead to the interesting problems. I keep nodding at that story and then not believing it. We’re automating the tuition and keeping the diploma, and the bill arrives late, from a direction nobody’s watching.

Trace it forward and it goes somewhere uncomfortable. If the entry-level work is what generates the reps, and the machines are now eating the entry-level work, then the reps stop happening. No reps, no pattern library. No pattern library, no instinct we’d call senior. Not slower. Missing. And an absence is a hard thing to notice. You don’t miss the people who never got trained, right up until the day you reach for the next person up and your hand closes on air.

Subscribe now

The comfortable answer shows up fast, and you may have heard it in a budget meeting. We’ll just hire senior when we need it. Let the machines run the junior tier and buy the experience on the open market.

But every company running that plan is pulling from the same crop, and not one of them is planting next year’s. Senior talent isn’t mined, it’s grown, and the growing is the exact thing we handed to a model. Push it all the way out and it eats itself: harvest every season and plant none, and the field goes bare on a schedule you could almost date. A company that spends its seniors faster than it grows them is eating its seed corn. You can do that for one hard winter. You can’t call it a strategy, though people will, because on a spreadsheet it looks like one.

(The early signals lean the same way, and I hold them loosely: entry-level postings are down about a third in eighteen months, and the 2026 forecasts read it as the agents taking the first rung.)

And I’d be telling half the story if I stopped at the bottom rung. The top is getting cut too. I’ve spent a career becoming the kind of seasoned security person this argument says will be scarce, and the market isn’t acting scarce. It’s acting the opposite. Companies aren’t only skipping next year’s planting. They’re thinning the standing crop, and they’ve learned to be polite about it. In April 2026 Microsoft offered its first voluntary retirement in 51 years: buyouts for its longer-tenured people, the eligibility math literally your age plus your years of service totaling seventy or more, against the backdrop of its roughly $80 billion in AI-infrastructure spending. Voluntary is a generous word for it. My read is extraction at the senior end, dressed so it doesn’t land on the layoff line.

I’ve wanted to be wrong about this, because I don’t love being the guy at the funeral. There’s one clean escape, and it’s a good one. Maybe AI doesn’t only do the junior work. Maybe it hands a beginner senior judgment directly and skips the apprenticeship. I just don’t think it’s the world we’re in…yet. A model can hand you the answer. It can’t hand you the years of being wrong that taught you to hear when an answer is off. It’s like an ear for a mix: you can’t download one. You train it over a few hundred hours, most of them spent on things that turn out not to matter, until you hear the problem before you can name it. Judgment isn’t information. It’s the residue of paying for your own mistakes, and the receipt doesn’t transfer to someone who never paid.

So it comes down to two doors. Either the machine grows senior judgment for us, or it still has to grow inside a person. The first door only opens if judgment can be handed over whole, and it can’t. Which leaves the second. We didn’t remove the need for the apprenticeship. We removed the soil it grew in, and told ourselves the plant would be fine.

Share

The strongest case against me is one I can’t wave off, so I won’t. Every tool set off this same alarm. Calculators would kill arithmetic. Compilers would kill the real programmers. Stack Overflow, the IDE, autopilot, each one was going to hollow out the craft, and the craft came through every time. So why would this one be different? (I’ve called a “this changes everything” dead wrong before, so grade me accordingly.)

The difference I keep landing on: those tools took away the toil but left the decision with a human. You still picked the approach. You still sat there at 2 AM working out why the thing wouldn’t run. The reps that build judgment stayed. Agentic AI is the first that reaches past the labor and takes the decision itself. If that’s right, this isn’t the old story in new clothes.

Unless the reps just move up a floor, which is the version where I’m wrong and glad to be. Maybe the new apprenticeship is riding the agents: catching the confident wrong answer, knowing when to overrule it. If junior people are learning to judge what the machine hands them, the ladder reforms one rung higher and I can sleep. If they’re only learning to accept it, the rung is gone. That’s the signal I’d watch, and it’s too early to call.

You can’t stop this, and I’m not sure you’d want to. Most of the automation is good, and pretending it isn’t is its own kind of dishonesty. What you can do is notice that the apprenticeship used to ride along inside the grunt work, and now it doesn’t. You put it back by hand, on purpose: letting a person do the slow thing the machine could do faster.

That’s a cost now. It used to come free, and free things are the easiest to cut without noticing you cut them. So notice. Somebody has to choose to pay for the apprenticeship on purpose, with a line item and a straight face, or it stops getting paid at all, and nobody sends a memo when it does.

The toil was never the price of the work. It was the tuition for whoever comes next. We automated the tuition, filed the receipts, and told ourselves we’d saved money. In about five to ten years we’ll see what a field looks like with nobody coming up behind it. I’d rather not run that experiment. I think we already started.

If you manage a team: are your juniors learning to judge what the agent hands them, or just to accept it? That’s the signal I’m watching. Tell me what you’re seeing.

Resources

• Forbes, “5 Leadership Trends That Could Shape 2026” - the shrinking pool of entry-level roles and the call to rethink how you grow junior talent.

• USAII, “AI Leadership Trends 2026” - agentic AI moving from planning and reasoning to executing tasks on its own.

• CNBC, “Microsoft plans first voluntary retirement program for US employees” - the age-plus-years-of-service formula and the AI-spend context behind the April 2026 buyout.

Leave a comment

Fifty-nine percent of hiring managers say their companies emphasize AI when explaining layoffs or hiring freezes because it plays better with stakeholders than admitting financial constraints. Only nine percent say AI has fully replaced certain roles.

The survey came from ResumeTemplates.com: a thousand U.S. hiring managers, asked at the end of 2025 about the year ahead. The revealing number is not that AI has no effect. It plainly does. Nearly half said it had reduced some need for hiring. The revealing number is the distance between what companies say publicly and what has actually happened inside the work.

Challenger, Gray & Christmas counted 173,568 announced job cuts attributed to AI from 2023 through June of this year. More than a hundred thousand came in the first six months of 2026 alone. But “attributed to AI” is not the same as “a machine replaced this person.” It’s the reason employers cited for the cut, which isn’t necessarily the same as a machine directly replacing the person whose job disappeared.

So why does everyone reach for AI?

Because it plays better. With investors. With the board. With the press. Even with the person you just walked to the door.

“The technology moved faster than we could” sounds like weather. “We spent more than we made, changed our priorities and decided your role cost too much” sounds like a choice. One makes the layoff feel inevitable. The other leaves fingerprints.

Leaders keep reaching for the first one.

I don’t think that reach is always cruelty, or even mostly cowardice. More often, it’s a category error. Leaders confuse a kinder-sounding explanation with an honest one. They choose the version that costs less in the room, then leave the other person to absorb the cost later.

That person may spend the next year rebuilding a career around a threat that was never described accurately. They retrain for the wrong problem. They doubt the wrong skill. They rearrange a life around a story designed to make the company look less responsible.

The invoice still comes due. It just lands on someone else’s desk.

What You Don’t Owe Them

Start with the debts leaders think they carry and do not.

You don’t owe your people a promotion on a schedule. You can’t manufacture a bigger role where the organization has no room for one, and you shouldn’t pretend a path exists because the truth would be disappointing. You don’t owe them happiness. It was never yours to provide, and leaders who try to manage everyone’s emotional weather usually stop managing the work.

You don’t owe anyone a five-year trajectory or a promise about where the company will land three years from now. You don’t know. Neither do I.

Pretend otherwise and you have written a check against a future you can’t see. People arrange real lives around what their leaders tell them. The mortgage. The second child. The house closer to an office that may be half empty next year.

Optimism can feel generous when you hand it over. When it was never grounded in anything, it lands as a lie.

What You Actually Owe Them

Now the part that costs you: an honest read on their situation. What they’re working with. What’s changing. What you know, what you don’t and where the limits of your own visibility begin.

That’s the obligation most leaders avoid because it’s harder than the comfortable ones.

An honest read doesn’t mean leaking a reorg before it’s announced or pretending confidentiality doesn’t exist. It means refusing to manufacture reassurance when you know the ground is moving. It means telling someone a project’s funding is uncertain while it’s still uncertain, rather than letting them discover it after months of work. It means answering “Is my job safe?” with the real shape of what you can say: “Here is what I know. Here is what I don’t know yet. Here is when I expect to know more.”

People don’t need certainty from you. They need an end to false certainty.

The dark is the real problem. When people can’t tell whether they are safe, the mind doesn’t wait politely for evidence. When people can’t tell whether they are safe, the mind doesn’t wait politely for evidence. It fills the silence, often with the worst plausible story.

A vague town hall doesn’t settle that. It feeds it. Every “exciting year ahead” with nothing specific behind it becomes another hour your best people spend checking layoff trackers in a private tab because leadership left them to write the ending themselves.

The Cover Story Is a Control Gap

Security has a name for a defense that looks solid and isn’t: a control gap. You told everyone the door was locked. You believed it. Then something walked through, because the lock was a claim you made, not a thing you tested.

The AI-layoff narrative is a control gap the size of a company. When AI is used to cover a decision that was primarily financial, the narrative becomes a control gap the size of a company. You told your people the change was about technology and the future. What actually happened was a budget decision made in a room. When the distance between the story and the record shows, and it always shows, you don’t just lose that argument. You lose the next ten things you say, because every reassurance gets read through the one that turned out to be managed.

Set two moves side by side. In March, Epic Games cut more than a thousand people, a fifth of the company. The CEO, Tim Sweeney, put one line in the memo: the layoffs weren’t about AI, but rather, declining Fortnite engagement had left the company spending significantly more than it was making. That sentence did more for his standing than any vision would have, because it was checkable and it was the real reason.

Then, nearly in the same breath, he said the newly laid-off would flood the market with resumes “of once-in-a-lifetime quality,” which, to my ear, framed people he had just fired as a windfall for somebody else. So keep both halves. Honesty about the cause is the obligation. It’s not the same as honesty delivered with care, and getting the first right doesn’t buy back fumbling the second. You can tell the truth and still tell it as if the person across from you is a line item. Most leaders miss on opposite ends of it.

The Conversation You’re Avoiding Right Now

You already know which one it is. Someone on your team is running on a picture of their situation you know is out of date, and you’ve let it stand because correcting it is a bad afternoon. Maybe their role is on a list. Maybe the work they’re pouring themselves into got deprioritized in a meeting they weren’t in. Maybe you don’t know their future and you’ve been performing like you do.

The AI era will mint a lot of leaders who hide inside uncertainty. “Nobody knows which roles exist in two years.” Fair, as far as it goes. But the obligation was never to know the future. It’s to tell people what you know today, including the size of what you don’t. Uncertainty isn’t a reason to say nothing. It’s the thing you owe them a straight account of.

I’ve held zero attrition across every team I’ve had real control over, through layoff seasons that took people all around us. Not by being generous. People see through generous. I did it by being specific when specificity was expensive, and by never telling anyone a version of their situation I couldn’t stand behind a year later.

You can’t be responsible for their career. You can be honest about the road. That’s the whole job.

Resources

• ResumeTemplates.com, “The Great Turnover: 9 in 10 Companies Plan to Hire in 2026, Yet 6 in 10 Will Have Layoffs”. Survey of 1,000 U.S. hiring managers, published April 22, 2026. The survey reports that 59% emphasize AI because it plays better with stakeholders, while 9% say AI has fully replaced certain roles.

• Challenger, Gray & Christmas, “Challenger Report: June Layoffs Cool to 45,849, Down 53% From May; AI Leads Reasons for Fourth Consecutive Month”. Reports 101,743 AI-attributed job cuts in the first half of 2026 and 173,568 since 2023.

• Epic Games, “Today’s Layoffs”, March 24, 2026. Tim Sweeney’s employee memo states that declining Fortnite engagement had left the company spending significantly more than it was making, and that the cuts were not related to AI.

• GamesRadar+, “Epic Games CEO Tim Sweeney Says Latest Layoffs Will Result in ‘a Stream of Resumes of Once-in-a-Lifetime Quality Folks’”, March 25, 2026.

Leave a comment

The most useful thing a red team does isn’t break your systems. It shows you the distance between what you believe about your systems and what’s actually true. The break-in is almost incidental. The real deliverable is the argument that comes after: the one where your team said the thing was secure and someone just proved it wasn’t. That conflict, the gap between the confident story and the demonstrated reality, is the most valuable information in the building.

Most leadership rooms run with that sensor unplugged.

The Calm You Should Worry About

Leaders are trained to like a quiet meeting. Everyone aligned, no friction, decision made. It feels like health. Sometimes it is.

More often it’s a reading, and the reading is bad.

A team that never disagrees is not a team that agrees. It’s a team that has learned disagreement isn’t worth the cost. The tension didn’t evaporate. You just lost your view of it. There’s a name now for the balance piling up in that account: conflict debt. Every hard conversation a team skips gets borrowed against the future, at interest, and the interest comes due later as attrition, as slipped dates, as the decision that suddenly needs three meetings because the real objection never got said in the first one. Surveys this year show teams addressing the root of their disagreements less often than they used to, not more. The debt is growing across the industry, quietly, the way debt likes to.

Security people know this shape by heart. A clean dashboard is not proof the network is safe. It can just as easily mean your detection is broken. Green is not a state of the world. Green is a state of your instrumentation. A room with no visible conflict is making the same claim, and it deserves the same suspicion: it’s telling you what got surfaced, not what’s true.

Subscribe now

Conflict Is the Readout, Not the Malfunction

When two competent people disagree hard, the disagreement is not the problem to be smoothed over. It’s a pointer. It’s aimed at something real: an assumption nobody stated out loud, a tradeoff nobody wanted to name, two incentives pulling quietly in opposite directions.

The disagreement is the organization showing you where its model of reality has a seam.

Attackers live in those seams. So do competitors, and the failure you’ll be writing a postmortem about next spring. A threat actor rarely beats your controls head-on. They find the conflict in your assumptions: the two teams who each thought the other one owned the thing. When your own people surface that conflict in a meeting, unprompted, they are doing free reconnaissance on your blind spot. The leader who shuts it down to keep the room pleasant is spending real effort to disable their own detection. Then they call the silence that follows alignment.

Read the conflict correctly and you don’t just settle the instance in front of you. You fix the assumption that produced it, which is the one that was going to produce three more.

The Most Agreeable Voice in the Building

The recent research on AI sycophancy is worth understanding. Across the leading models, the systems affirmed the user’s position far more than a person would, on the order of half again as often in one large study. Push back on a model that gave you the right answer and a real fraction of the time it will fold and hand you the wrong one instead. Tell it your weak plan is strong and, more often than not, it agrees. And people trust it more for doing exactly that. The agreeableness that distorts the judgment is the same feature that makes the tool feel good to use.

For a leader who already prefers a quiet room, that’s a problem. You now have a tireless assistant that never raises its hand, never says “I think you’re wrong here,” never carries the weight of an actual objection. It tells you the analysis is sharp. It tells you the strategy holds. Studies have found that people walk away from these exchanges more certain, more convinced they were right, and less willing to go patch things up with an actual human. Some even rated themselves smarter than when they walked in.

That’s not a copilot. That’s conflict suppression at industrial scale, priced as productivity.

The model doesn’t know it’s wrong. It can’t. It has no stake in the outcome and no memory of the room. Your team knows. They almost always know. The only open question is whether you’ve built a place where the machine’s easy agreement gets to drown out the human who was three seconds from disagreeing.

Share

How to Read a Quiet Room

So you stop trusting the silence and start reading it.

When a plan draws no objection, that isn’t a green light. It’s a missing measurement, and your job is to go get it. Not by asking “any concerns?” to a room that already knows which answer you’re hoping for. That question rarely surfaces the truth. You surface the conflict on purpose. Assign it. Give a specific person the explicit job of arguing the plan will fail, and make doing it well safe, even rewarded. Ask what would have to be true for this decision to become next year’s disaster, and watch who suddenly has something to say. You’re not manufacturing fights. You’re making disagreement cheap early so you don’t buy it at full retail late.

And when it does surface on its own, treat it as a gift that just walked in, not a fire to stamp out. The person willing to say the uncomfortable thing to your face is the most expensive employee to replace and the easiest to lose. Punish that messenger once, even with a flicker of visible impatience, and you’ve trained the whole room to route around you. Then you’re back to the calm meeting, everyone nodding, out early. And the calm is lying to you.

The conflict isn’t what’s wrong. It’s what’s finally visible. Suppress it and you’re not managing a team. You’re managing a detection gap.

Leave a comment

I know a kind of leader who’s been running in “go” mode for three years. Every quarter is a sprint. Every initiative is urgent and every plan is a transformation. Ask them what a normal week feels like and they can’t tell you, because they don’t remember one.

From the outside it looks like drive. Up close, after enough years of it, it usually isn’t. They’re not moving faster than everyone else. They’re moving scared, and somewhere along the way the speed stopped being a choice and became the proof that they still matter.

I’ve been that leader. So this isn’t a diagnosis I’m handing down from a safe distance.

The Season That Never Ends

Right now the whole industry is telling that leader they are right to never stop.

The message lands from every direction. Reinvent the org. Rebuild the operating model. Redesign every function for AI before someone else does it first. Every planning cycle comes with the same implied threat: if you are not transforming, with the impact slides to prove it, you are already behind.

Some of that is real. AI is going to force genuine rebuilds in places that have been coasting for years. But here is the part the transformation story usually skips: most of an organization, most of the time, does not need to be rebuilt.

It needs to be kept running.

Kept honest.

Kept from quietly falling apart while everyone’s attention is pointed at the next big thing.

That is not a building season. We just don’t have a flattering name for the one it actually is.

Build, Maintain, Defend

Strip the work down and there are roughly three modes.

Building is the one everybody knows. A new system, or a new team, or a capability that didn’t exist last year and exists now. It’s the season that gets the headlines and the promotions, and it’s genuinely thrilling. It’s also the rarest of the three, and it is not the natural resting state of a healthy company.

Maintaining is what most leadership actually is. The unglamorous work of keeping a good thing good: retention, repair, trust, standards, compliance, documentation and the slow upkeep that never shows up in a launch announcement.

Engineers already know the math, even if the org chart pretends otherwise. A large share of software’s lifetime cost comes after launch, not before it. Depending on the system and the source, maintenance is often estimated at somewhere around sixty percent of lifecycle cost, and in some long-lived systems much higher.

The launch is the photogenic part.

The years of keeping it alive are the actual job.

Defending is the third one, and it’s the mode most leadership writing forgets. It isn’t building and it isn’t steady-state maintenance. It’s holding a line under pressure: the layoff stretch, the breach, the downturn, the months where the work is protecting your people and your systems from harm that’s actively looking for a way in. I spent a long career in security, so I don’t mean defense as a metaphor. I mean the operating posture of keeping real damage from reaching real people. It has a completely different texture than building. Mistake one for the other and people get hurt.

None of these is the advanced version of the others. They’re different work, with their own rhythm and their own definition of a good day.

Share

The Tell

So how do you know which mode you’re actually in?

The fastest test is to look at what you’re adding versus what you’re protecting. In a real building season, addition is the point. You’re supposed to be making new things. In a maintenance season, every new thing you bolt on is weight the system has to carry, and a leader who keeps adding is usually doing it to feel productive, not because the organization needs more surface area.

The harder test is internal, and I’ll be honest about it because I’ve failed it. If you’re wired to build, a maintenance season feels like decline. It feels like you’ve lost your edge, like the interesting part is behind you, like you should be doing more.

That feeling is almost never accurate.

The discomfort of a maintenance season isn’t a signal that something’s wrong. It usually means you built something worth maintaining, and now the job is to not wreck it out of boredom.

I went from founding a security function at a company I’ll leave unnamed, which was pure building, to holding teams steady through years of industry-wide layoffs, which was maintaining and defending at the same time. The second was harder. It was also less visible, less celebrated and more important.

Nobody hands you anything for the attrition that didn’t happen.

Before You Add Anything Else

The AI moment is manufacturing building seasons everywhere, and a lot of them are anxiety wearing a strategy costume. Every org feels pressure to call itself transformational. Plenty are doing ordinary maintenance at high volume and calling it reinvention, because reinvention is the only season the current story rewards.

The cost of getting this wrong is not abstract. Transformation fatigue is now measurable. Workers report burnout, exhaustion and pressure from the frequency of change as much as from the change itself.

You can run a team in building mode for a while.

You cannot run one there forever.

A leader who cannot tell the difference will try.

So name one part of your organization that’s in a maintenance season and you’ve been treating like a building project.

Stop adding to it.

Start protecting what’s already there.

Leave a comment

You upload the resume.

The site promises to save you time: it’ll read the file and fill in the fields for you. Then the page reloads and you see what it did.

Your job title is now your employer. Your employer is now your degree. Three years of work collapsed into one box that reads “2 0 2.”

At the bottom, a button: Review and correct.

So you do.

You retype, by hand, into a web form, the contents of a document you handed over thirty seconds ago. The machine read it. The machine got it wrong. The cleanup is yours.

Hold that picture, because there’s a whole argument inside it.

The Intake Is a Confession

We’re living through the loudest stretch of automation marketing in my lifetime.

Copilots in every product. Agents that will book your travel, triage your inbox and, we’re told, do real parts of knowledge work.

And a lot of companies still ask candidates to apply through an intake workflow that cannot reliably turn a resume into clean structured data without handing the cleanup back to the applicant.

That wording matters.

The lazy version of this take is, “AI is fake because resume parsers still suck.”

That version falls apart fast.

Modern parsing can be very good. Some AI-based tools claim strong field extraction, especially on clean documents and benchmark-friendly formats. But candidates are not applying to a benchmark. They are moving through a company’s actual hiring workflow.

The parser is only one piece.

There is the ATS. The field mapping. The required forms. The filters. The compliance fields. The old integration nobody wants to touch. The new AI language layered over operational machinery that may or may not have changed underneath.

That gap is the story.

Not “AI is fake.”

The gap between what a company says it can do and what it actually operates.

Systems Reveal Values

Here’s the part I keep circling.

A system is a statement of priorities, whether or not anyone meant it to be. What you automate, what you leave broken, who you make absorb the difference: that’s a values document, written in software.

The hiring funnel is often the first real interaction a person has with a company. Before the mission slides, before the culture deck, there’s the intake.

This is not only a candidate-experience gripe.

In 2021, Harvard Business School and Accenture published a two-year study called Hidden Workers, Untapped Talent. A large majority of employers in that study said qualified candidates were being filtered out of their own process because those candidates did not match the exact criteria the system was set up to read. For high-skill candidates, the number was 88%. For middle-skill candidates, 94%.

Not turned down by a person after a real assessment.

Vetted out by the process before the person fully appeared.

That’s the part that should bother more people than it does. This is not a hidden failure nobody noticed. Employers have said they know qualified people get lost this way.

The cost remains acceptable because the applicant pays it, not the company.

The Part That Is Actually Hard

I’m not going to pretend parsing a resume is trivial, because it isn’t, and the people who build these systems would be right to object if I did.

Modern AI parsers can be very good. Some claim field-extraction accuracy in the nineties, sometimes higher, especially on clean documents and benchmark-friendly formats. That is real progress.

But most candidates are not interacting with a clean benchmark parser.

They are interacting with a hiring workflow.

A parser. An ATS. Field mapping. Required forms. Knockout questions. Compliance fields. Old integrations. New AI language bolted onto older operational machinery. Sometimes the parser is modern. Sometimes it’s not. Sometimes the parser is fine and the workflow around it is the part quietly making a mess.

That distinction matters.

Resumes are an ugly input. Humans optimize them for another human’s eye: columns, icons, a little visual personality, dates in whatever format felt clean at midnight. Parsers optimize for fields. Those two goals fight, and the candidate usually cannot see which side their formatting landed on. Some of what looks like the parser failing is really a two-column PDF meeting a system that wanted a single column of plain text.

And even when the parser is good, the intake can still be bad. The company can still ask you to confirm every field. The integration can still drop context. The form can still flatten ten years of work into boxes that do not understand consulting, overlap, contracting, promotion history or the strange little reality of a career that did not happen in neat rows.

That does not soften my argument.

It sharpens it.

If a real share of these failures trace back to format choices, field mapping, ATS configuration, legacy software or workflow design, then they are not just technical limitations. They are product and organizational choices.

Somebody picked the stack. Somebody configured the intake. Somebody decided not to test it against the resumes people actually submit. Somebody decided the applicant’s hour was cheaper than the engineering ticket.

The technical difficulty is genuine.

The decision about who eats that difficulty is still a decision.

Share

Now Both Sides Have Robots

It got stranger recently, and this is where the absurdity starts eating itself.

AI now sits on both ends of the application.

Employers are adding automated screening, ranking, summarizing and scoring tools to hiring workflows. Candidates are using AI to write resumes, tailor cover letters, rewrite bullet points and rehearse interview answers.

So the machine reads the machine.

That sounds efficient until you sit with it for more than ten seconds.

Early research has already found LLM evaluators favoring resumes written by LLMs, including resumes written by the same model doing the evaluation. Not because the person behind the resume can do the job better. Because the document sounds more like the thing the evaluator already prefers.

It’s a self-recognition loop dressed up as assessment.

And then there is the volume problem. Candidates can now fire off applications at a scale no human recruiter was built to absorb. Recruiters get buried. Candidates get ignored. The pile gets bigger. Everyone reaches for more automation to survive the automation that already broke the room.

A self-reinforcing loop, dressed up as progress.

And somewhere inside that loop, the applicant gets smaller.

Their context matters less. Their ability to explain the shape of their own career matters less. Their sense of fairness and human treatment starts to erode.

The research literature points to procedural fairness, transparency, explanation and dehumanization. The lived experience is simpler:

I gave you my story.

Your system turned it into cleanup labor.

Then I got the rejection and wondered the thing almost every applicant wonders but rarely says out loud:

Did anyone even read this?

The recruiter on the other side is not the villain here.

They are often buried in the same flood, trying to find a real signal inside a stack of polished, tuned, AI-assisted documents. The system fails both ends. The difference is that one end can choose to fix the workflow, or choose not to, and the other just absorbs whatever the workflow does.

The regulators see the shape of it.

The EU AI Act treats many employment and candidate-screening systems as high-risk. The European Commission has also published guidance on high-risk AI-system classification, including practical examples to help providers and deployers assess whether a system falls into that category. New York City already requires bias audits and notices for certain automated hiring tools. And in a detail that tells you plenty, a 2025 audit found the city’s own enforcement of that law falling short.

The rule exists.

The enforcement struggles.

The story and the record, sitting right next to each other again.

What the Front Door Says

The tower gleams with the AI story.

The front door is the part nobody fixed, and you’re the one walking through it.

Strip it all back and you get a small, hard observation about automation in general.

Bad automation doesn’t just fail.

It fails in a direction.

It takes the work it was supposed to remove and pushes it onto the person with the least power to refuse it. The applicant retypes the resume. The patient fills out the same form on the sixth clipboard. The customer trains the chatbot that exists where a human used to help.

The technology is not the tell.

The direction of the cleanup is the tell.

So when a company hands you its software’s mistakes to fix before it will even look at you, believe the front door.

Early and honestly, it is showing you whose time it treats as free. That may not tell you everything about the company, but it tells you enough to start asking better questions.

Leave a comment

When I joined Netflix there were four of us doing security. By the time I left, that function had grown past a hundred. Somewhere in the middle of that climb I helped hire an engineer who, about three months in, understood our environment better than I did.

Not better in some narrow corner. Better, full stop. He could hold the live system in his head, trace a request through services I’d only ever seen on a diagram, and tell you where it would fail before it failed.

I remember the meeting where it landed. He was walking us through an attack path and I was two beats behind, nodding while I did math under the table. The feeling I had wasn’t threat. It was relief. The hire was working exactly as designed. The intention wasn’t to bring him in to be slightly useful one rung below me. I wanted him brought in to know more than me.

That’s the part most leaders never make peace with.

The Authority Inversion

There’s an old model where the person in charge is the person who knows the most. The best engineer becomes the lead. The CISO is the one who can out-argue the room on firewalls. Knowledge runs down the org chart, authority runs right alongside it, and the two feel like the same thing.

That model had a good run. It’s over.

The CISO who knew more about firewalls than anyone on the team was a fine CISO for 2010. The surface is too big now. Nobody holds all of it. The cloud architecture, the detection pipeline, the model you shipped to production last week, the regulatory exposure across three jurisdictions: no single human is the smartest person in the room across all of that. If your authority depends on being that person, your authority is already gone. You just haven’t felt it leave.

The inversion isn’t the problem though. The inversion is the design. You’re supposed to hire people who exceed you. What goes wrong is the panic about it, the small hot feeling that if they know more, you’re exposed. That feeling is the actual failure mode, and it manufactures two bad leaders. The one who bluffs. The one who clamps down so nothing happens without them.

Both are trying to protect a kind of authority that stopped existing.

What Credibility Actually Is

So if it isn’t knowledge, what are people following?

Judgment. Specifically, judgment about what matters.

I couldn’t trace every request the way that engineer could. But I could tell you which of the six things he was worried about was the one that would end up in front of a regulator, which one was interesting but survivable and which one we were going to consciously not fix this quarter. And why each call was the call. That’s a different skill than his. Not lower, not higher. It’s the one the seat actually requires.

But here’s where I lose the people who want a clean answer: judgment without literacy is just confident guessing. You can’t evaluate what you don’t understand at all. The leader who says “I don’t need to know the tech, I just hire smart people” is one fluent liar away from a disaster, because they have no way to tell a real answer from a good-sounding one.

You don’t need to be the best cryptographer to run the program. You need to know which crypto question is load-bearing, and enough to know whether the answer you just got was real. Enough to ask the second question. Enough to smell it when someone’s managing you with vocabulary. That’s the line. Not omniscience. Not ignorance dressed up as delegation. Enough to judge.

The Moment of Exposure

Every leader managing experts gets the same recurring moment. Someone is explaining something and you’ve lost the thread.

The old reflex is to nod and bluff. Protect the picture. The team always clocks it: they see the nod that doesn’t connect to anything, and the real cost isn’t that you looked slow. It’s that they just learned information can move past you without resistance. Which is the precise thing you were hired to prevent.

The move is plain. “I don’t follow that yet. Walk me through it.”

I’ve said that sentence in front of people who report to me, more than once, over twenty-five years into this. It doesn’t lose the room. It does the opposite. It tells the expert their explanation has to actually land instead of just sounding right, and it tells everyone watching that the standard in here is understanding, not performance. The strongest people I’ve managed were never confused about whether I was the deepest expert in the building. They were clear that I was the one deciding what we’d stake the quarter on. Different jobs. They knew which one was mine.

Share

What the AI Era Does to This

Until recently, the expert inversion was occasional. You felt it with a few specific hires, in a few specific meetings.

That’s done. Now there’s a system in the room that has read more than your whole team combined, and it’ll explain a vulnerability class or a market or a legal argument in clean, confident prose at three in the morning. The inversion isn’t occasional anymore. It’s constant, it’s synthetic, and it never gets tired or political.

This breaks the bluffers completely. You cannot out-knowledge a model trained on most of what’s been written down.

And yes, you can teach it your “here.” I’ve built the systems that do exactly that: feed a model the postmortems, the org chart and the risk register, and it reads your environment faster than most new hires. The context objection is real. I won’t wave it away.

But two things don’t transfer. First, the part of “here” nobody wrote down: who’s about to quit, what was actually decided in the hallway, the thing that moved this week and hasn’t reached a document. Second, and this is the one that holds: the model can absorb all of it and still not be the one accountable for the call. It’ll hand you ten options and sound equally certain about all ten, because it has nothing at stake in being wrong. You do. Judgment isn’t just knowing the context. It’s deciding under consequences you carry.

That’s the whole job now. Not knowing the most. Reading what you’re being told, by humans and machines both, and deciding what’s worth the weight of the organization. The expert inversion went from a feeling you had about a couple of people to the daily condition of the work. The practice is the same one I learned in that meeting at Netflix. The scale is not.

Your authority was never your knowledge. It’s your judgment about what matters. Confuse the two, and you become the bottleneck the smartest people in your building learn to route around.

ZenOne also produces electronic music. The mixing arc behind the work is at zenonemusic.substack.com.

Leave a comment

Someone knew. Nobody said it in time.

That sentence is underneath every failure across the last several article I’ve published for First Order. The project that delivered cleanly on the wrong problem. The delegation that transferred the task but not the authority. The status report that stayed green until it suddenly wasn’t. The org that flattened and lost the address for accountability. Someone in each breakdown had a read on what was wrong. The gap wasn’t information. It was distance: between the person who knew and the moment where knowing could still have changed something.

I’ve been mapping that distance seven ways. This is the compressed version. Seven principles, five scripts and one checklist. Keep what holds.

The Seven Principles

1. Execution failure is a design problem.

Most post-mortems land on the people. Wrong person, wrong team. Before you adjust the people, look at what they were executing inside. The translation layers. The sign-off chains. The ambiguity nobody was authorized to resolve. When you fix a design problem by replacing a person, the next person produces the same result. The following post-mortem says nearly the same things. That’s information, if you let it change the diagnosis.

Diagnostic: What would have to be true about the org design for this outcome to be predictable?

2. Delegation transfers the task. Not the authority.

The task moves. Context rarely does. Decision criteria almost never. What actually transfers is the deliverable, and sometimes the accountability, which leaves the person holding work they can’t fully execute because nobody told them how to handle what the brief didn’t cover. That’s not their failure. That’s a delegation that didn’t complete the transfer.

Diagnostic: After the handoff, can they explain the decision criteria, not just the task?

3. The middle layer was absorbing what nobody asked it to.

Good managers didn’t relay status. They read the room before a message went up. They decided what not to escalate. They absorbed ambiguity so decisions arrived at execution with signal intact, a function that didn’t appear in any job description and won’t appear on any org chart until it’s gone. Removing the layer doesn’t remove the need. It makes the need invisible until something surfaces that required the function and didn’t have it.

Diagnostic: Who is absorbing the ambiguity now?

4. The status report is optimizing for the relationship.

Every status update is written by someone managing their relationship with the reader. That’s not dishonesty. That’s rational. Status reports optimize for the sender’s standing, not operational accuracy, and those two things diverge more often than most leaders want to admit. A green dashboard that turned red overnight didn’t turn red overnight. Read it forensically: what wouldn’t the writer want you to know? Start there.

Diagnostic: Is there a version of this report the sender would not want you to see?

5. Not all decisions carry the same cost to reverse.

The organizations that execute well spend most of their deliberation budget on irreversible decisions and almost none on reversible ones. Classify before you deliberate. Two-way door or one-way door, stated out loud before the meeting proceeds. The classification takes 60 seconds. Skipping it means spending the same deliberation budget on every call, which is the most expensive management habit that never shows up on any report.

Diagnostic: If this turns out to be wrong, what does it actually cost to undo?

6. When the org flattens, accountability goes ungoverned.

The hierarchy went away. The accountability didn’t. It lost its address. Remove the coordination layer without explicitly answering who owns the call when two people at the same level disagree, and you haven’t simplified the org; you’ve made the routing invisible. Traffic still moves. Nobody knows where it goes. The most honest sentence in a flattening announcement is the one nobody says out loud: we removed the layer. We haven’t replaced what it did.

Diagnostic: Who owns the call when two people at the same level disagree?

7. Perfect execution of the wrong problem is worse than failure.

It consumes resources, builds false confidence and defers the real diagnosis. It also produces clean documentation of the wrong outcome, which makes the direction look sound past the point where it was off. This is what a control gap looks like: SOC 2 audited, all findings remediated, full compliance in place, breach through a service account that wasn’t in scope. The controls didn’t fail. The problem definition did. Most post-mortems never reach the problem statement. They land on the execution. (I’ve seen consecutive projects in the same org run on the same unchallenged assumption before anyone questioned it.) So the next project starts with the same inherited frame, more carefully documented this time.

Diagnostic: Who was responsible for challenging the problem statement before scope was approved?

Five Scripts

1. When you’re inheriting a failing execution: “What decision was made at the start of this that nobody has challenged since? I want to see that before we talk about what to change.”

2. When delegating: “Walk me through the decision criteria, not the deliverable. Tell me how you’d handle it if the spec changes at the end.”

3. When a status report doesn’t feel right: “This reads clean. What’s the version you’d write if you knew I already knew what wasn’t working?”

4. When a decision is stalling: “Is this a one-way door or a two-way door? If it’s reversible, we decide today. If it’s not, we slow down.”

5. When you’re flattening a team: “Before I remove this layer, I need three things this person currently decides that nobody else is authorized to decide. I need owners for each one before the announcement goes out.”

Share

Field Checklist

Use before the meeting ends.

• Does the person you delegated to know the decision criteria, not just the task?

• Did anyone challenge the problem statement before scope was approved?

• Who absorbs ambiguity now that the coordination layer is thinner?

• Is this decision reversible? Have you named that out loud?

• When did you last see a status report that surfaced a problem before it became one?

• If two people at the same level disagree right now, who makes the call?

• Can you name the person who owns the crossing from knowing to doing?

Execution is a system. The system runs on relationships. The leader who understands both: who can hold the org structure in one hand and hold the person in front of them in the other. That’s who closes the gap between what’s decided and what actually gets done.

That’s what Arc 2 was about.

What it couldn’t map is the space between the leader and the person. Not the structure. Not the decision flow. The relational work under any of it: the conversation that doesn’t scale, the trust that doesn’t route through a system and the read on a room that can’t be delegated. That layer isn’t in any framework. It’s where everything increasingly depends.

That’s next.

ZenOne also produces electronic music. The mixing philosophy behind his productions is at zenonemusic.substack.com.

Leave a comment

The project ran clean.

Eighteen months. Five milestones. Green dashboards. Calm steering committee updates. Every deliverable on schedule and under budget.

The team was good. The execution was tight.

Then the thing shipped, and everyone quietly realized it had solved a problem nobody actually had.

Nobody’s fault. Wrong problem. Perfect execution.

That phrase keeps coming back to me. Not because the execution failed. It didn’t. The problem was in the brief, and nobody questioned the brief.

The wrong problem statement survived eighteen months of excellent work because every milestone it generated looked like evidence the project was on track. Completed deliverables aren’t evidence that you’re solving the right thing. They’re evidence that you’re solving something.

When the problem statement is wrong, they’re the most expensive kind of false positive.

The Green Dashboard Problem

Wrong problem statements are hard to kill.

They don’t look wrong at first. They look like alignment. Everyone agrees on the objective. The roadmap makes sense. The milestones have owners. The steering committee has the right people in the room. The deck looks responsible.

That’s the trap.

Once the problem statement becomes the container for the work, everything downstream starts optimizing inside it. Teams debate scope. Leaders negotiate timelines. Finance asks about budget. Product asks about dependencies. Security asks about risk. Nobody asks whether the original frame deserved that much confidence in the first place.

And the better the execution gets, the harder the problem is to see.

Every completed deliverable creates the impression of progress. Every green status report lowers the appetite for uncomfortable questions. Every month of clean execution makes it more socially expensive for someone to say, “I think we may be solving the wrong thing.”

By month six, that sentence no longer sounds like wisdom.

It sounds like sabotage.

So the work continues. The machine stays healthy. The metrics move. The project gets praised for discipline. And the original assumption, the thing everything depends on, gets protected by the progress it produced.

The postmortem comes later.

By then, it usually starts with someone saying the strategy failed.

It didn’t.

The strategy executed. The problem statement failed.

The Control Gap

In security, there’s a version of this pattern: the control gap.

Your controls can be working and your threat model can still be wrong. SOC 2 audited. Findings remediated. Documentation clean. Review complete. Then the breach happens through a service account nobody treated as part of the real risk surface.

The controls didn’t fail.

The problem definition did.

Threat modeling, whether you use STRIDE or something less formal, forces one move before any control gets designed: stop accepting the first formulation of the problem. The first question isn’t “how do we defend against this?” It’s “what are we actually defending, from whom and under what assumptions?”

That question changes everything.

Because once you surface the assumptions, you can start testing them. You can ask what’s missing from scope. You can ask who benefits if the frame stays narrow. You can ask whether the system everyone keeps calling “internal” is actually exposed through some integration, workflow or vendor relationship nobody bothered to model.

I studied philosophy while I was studying security and AI (at that time, I studied Symbolic AI (rule-based logic) and early machine learning. Instead of training massive neural networks on GPUs, we learned to write logic-based programs, build expert systems, and search decision trees manually.) Different fields, same discipline: find the hidden premises.

Every argument rests on assumptions the speaker doesn’t make explicit. The philosopher’s job, like the threat modeler’s, is to surface those assumptions before accepting the conclusion.

The disciplines are, at root, about refusing to take the problem as given.

Most organizations don’t operate that way.

Problem statements arrive from leadership. They carry the authority of whoever defined them. By the time they reach the people doing the work, they’ve been formatted into tickets, roadmap items, operating plans and quarterly commitments.

At that point, questioning the premise doesn’t feel like better thinking.

It feels like creating drag.

So the team takes the brief as given. Execution begins.

Why Nobody Challenges It

The authority problem comes first.

Someone with power defined the problem. Questioning the problem now means questioning the person, or at least questioning the judgment that person already put into motion. That may be healthy in theory. In practice, most organizations still punish it quietly.

Not directly. Rarely that clean.

It shows up as tone. Timing. “Let’s not overcomplicate this.” “We already aligned on that.” “We can revisit after phase one.” Small phrases that tell everyone where the edges are.

Then the investment problem sets in.

Three months in, you’ve allocated resources, built a team, briefed stakeholders and created expectations. Questioning the problem statement now means suggesting that a lot of intelligent people may have been moving in the wrong direction.

The sunk cost doesn’t make the problem statement right. It just makes the truth more expensive to say.

That’s why wrong problem statements survive.

Not because nobody sees them.

Because seeing them is different from being willing to pay the cost of naming them.

And by the time the evidence is obvious enough to say out loud, the project is usually too far along for the organization to treat it as a framing failure. So it becomes an execution failure instead.

Teams get restructured. Leaders get replaced. The next brief gets more detailed requirements, tighter governance and more frequent status reviews.

The original failure never comes back for trial.

It just gets documented more carefully next time.

Share

When You Add [Modern] AI

AI doesn’t pause to check the brief.

That’s not a criticism. That’s what execution engines do. They don’t ask, “Should I be doing this?” They ask, “How do I do this well?”

If you hand AI the wrong problem statement, it will get you to the wrong answer faster, cleaner and with better documentation than a human team could have managed.

The deliverables will look sharper. The analysis will look more complete. The recommendations will sound confident. The whole thing may feel more rigorous because the process produced so much evidence of effort.

That confidence is the dangerous part.

Perfect output on the wrong problem statement often looks better than messy output on the right one. AI doesn’t know the difference. And a lot of leaders, if we’re being honest, don’t either. Not when the formatting is clean, the narrative is coherent and the answer arrives in thirty seconds instead of three weeks.

Speed doesn’t clarify the frame.

It just gets you farther from the moment when someone still could have challenged it.

The organizations that struggle in the next few years won’t only be the ones that fail to deploy AI. Some of them will deploy it everywhere. Aggressively. Proudly. With dashboards and internal case studies and a lot of confident language about productivity.

And they’ll still get slower where it matters.

Because they’ll be accelerating work that should have been questioned upstream.

AI makes the execution gap cheaper to enter and more expensive to escape.

The Question Before the Work

Before any scope gets approved, there’s one question worth asking out loud:

Did someone explicitly decide this was the problem, or did it arrive as given?

That question sounds simple. It isn’t.

It forces the room to separate direction from decision. Direction is what happens when a problem statement moves with authority. Decision is what happens when the assumptions underneath it have been examined, challenged and still chosen.

They look almost identical on a roadmap.

They have very different postmortems.

The problem statement that nobody questioned carries the full weight of shared assumption. Everybody thinks somebody else verified it. It becomes the most confident thing in the room and the least examined.

That’s where a lot of execution failure really begins.

Not in the missed deadline. Not in the bad handoff. Not in the team that “couldn’t execute.”

Earlier.

Quieter.

At the moment everyone agreed to solve the problem before anyone had done the harder work of deciding whether it was the right one.

Directions and decisions look the same on the timeline.

They have very different postmortems.

Leave a comment

The announcement said they were removing unnecessary management layers to move faster.

Six months later, a product decision had been stalled for three weeks. Not because the team was struggling. Not because the call was complicated. Because the layer that used to hold accountability for exactly that kind of call had been reorganized out of existence. The question of who could actually make it floated above the org chart with no owner.

Nobody replaced what had been removed. They announced it, then moved on.

This is the part that doesn’t show up in flattening announcements: removing the layer doesn’t remove the accountability. It removes the address. And an accountability without an address is just a problem that belongs to everyone in general and no one in particular. I started to dig into this issue in What Middle Management Was Actually Doing.

The Design Question

When I built Nimbus, a multi-agent AI system with an explicit foreman/worker coordination architecture, I had to answer a question that most human organizations never ask out loud.

When two agents reach different conclusions about the same task, who wins?

In a human organization, that question has an implicit answer. Someone in the hierarchy has authority. The chain of command resolves the conflict. You don’t have to write it down because everyone carries it. We’re taught that early on. The org chart is a routing table for decisions, and it’s always running in the background.

In an AI system, there’s no implicit anything. I had to make it explicit. Deference hierarchies: which agent defers to which, under which conditions, and why. Escalation criteria: what counts as a genuine conflict versus a difference that the system should resolve on its own. Pre-execution audit logging: who’s accountable for what the system did before it did it, not after.

It took weeks to write down what any competent middle manager would have just known.

That’s the thing about implicit systems: they work until you try to replace them, and then you discover how much they were doing. The org chart wasn’t just a reporting structure. It was a decision routing table. It answered the “who wins?” question before anyone had to ask it. When you flatten the org, that routing table gets thinner. The question doesn’t go away. It just stops having a default answer.

What Happens to the Call

In a flat org, ambiguous calls don’t resolve more cleanly. They resolve more slowly, or they resolve through whoever is most persistent.

That second outcome is worth sitting with. When the hierarchy no longer answers “who wins?”, something else fills the gap. Usually: whoever sends the most messages, or whoever escalates to a shared stakeholder first, or whoever simply doesn’t yield. None of those are decision systems. They’re just noise with an outcome attached.

The leader who inherited broader scope after the flattening often absorbs this without naming it. They start showing up in threads they shouldn’t need to be in. They find themselves making calls that used to resolve two levels below them. They’re not doing it wrong. They’re doing it because the routing table has a gap, and the call has to go somewhere.

This is the work that migrates up when the layer comes out. Not the visible coordination work; AI can handle most of that. The work that migrates is the judgment about who should hold which call, under what conditions, with what authority. That judgment lived in the middle. When the middle is gone, it lives wherever it lands.

Usually: on the people the announcement quietly promoted into broader scope, without briefing them on what they just inherited.

Share

Before the Announcement Goes Out

There’s one question that has to be answered before any flattening announcement goes out. Most organizations skip it.

When two people now at the same level of your new flat org reach different conclusions about an important call, who makes the decision?

In a hierarchy, the answer is structural. In a flat org, it has to be explicit. It has to be written down before the first ambiguous call arrives. If it isn’t, you haven’t designed a flatter organization. You’ve removed the mechanism that was making calls without anyone noticing, and left the calls with nowhere to go.

This isn’t an org chart exercise. It’s a decision routing exercise. For every major decision class: who owns it, who provides input, who has veto authority, and what the escalation path looks like when the owners can’t align. That document doesn’t exist in most organizations because the hierarchy made it unnecessary. Flattening makes it mandatory.

IMD’s 2026 research on organizational design put the frame plainly: “The winners in 2026 will not be those deploying the most models, but those reinventing how decisions, teams, and execution work.” The reinvention is the part most orgs skip. They announce the structure. They don’t redesign the routing.

Ask the room which calls are now unaddressed. The silence will tell you how much work is left.

The hierarchy went away. The accountability didn’t. It just lost its address.

ZenOne also produces trance music. The mixing arc behind his productions is at zenonemusic.substack.com.

Leave a comment

The machine had been running forensics for four hours. The attacker was still in the environment. Not because we were asleep at the wheel. Because in incident response, the first loud move can become a flare. Tip the actor too early, and you may lose the trail before you understand the blast radius.

Someone asked: do we wipe it?

I knew the answer before I finished hearing the question. A wipe stops the bleeding. It also destroys the forensic trail, changes the state of the evidence, and may erase what Legal would need if this became a dispute. Once you wipe, you don’t unwipe. That call doesn’t come back.

That’s a one-way door.

The same room had made two other calls that night. We’d read Legal in: reversible, if we needed them to stand down. We’d pulled credentials on three compromised accounts: also reversible, if we were wrong about any of them. Two-way doors. We could move fast, make the call, adjust if we got it wrong.

A wipe wouldn’t be like that.

I made it crystal clear to executive leadership not to wipe. I walked out knowing exactly what we almost traded for the recovery window. The weight from that incident is still legible to me. It has a texture. You don’t necessarily learn it from a framework. You learn it in the room, under fire, when the question lands and something specific sharpens in your attention.

Years in incident response for high-risk corporate and government clients gave me a felt sense for this distinction that no framework really teaches. The calls that are irreversible don’t announce themselves as irreversible. They arrive disguised as the obviously right move. The experienced IR commander learns to pause on “obviously right.” That’s exactly when you ask which door you’re standing in front of.

Years later, I found cleaner language for what that room had already taught me. Jeff Bezos called them one-way and two-way doors in his 2015 shareholder letter. Some decisions are one-way doors. Some are two-way. One-way doors require careful deliberation and time to get right. Two-way doors don’t. Make the call, go back through if you’re wrong. The framework is simple. Most organizations still don’t use it in practice.

That’s not a failure of awareness. From my experience most leaders have heard of one-way doors. The concept lands. What they haven’t built is the habit of classifying before the meeting ends. So they apply the same scrutiny to every significant decision: the same committee, the same deliberation budget for a call that costs a day if it’s wrong as for one that costs a quarter.

That’s the most expensive management mistake that doesn’t show up on any dashboard.

Deloitte’s 2026 research on AI and decision-making puts the gap in plain view:

64% of executives say AI-enabled decision-making is very important, but only 5% believe their organizations are leading there.

Underneath that gap is the real problem: 57% of organizations are still operating at low decision-making maturity. The ambition is high. The foundation isn’t.

AI is about to accelerate the rate at which decisions land on every leader’s desk. The acceleration doesn’t change which decisions are irreversible. It changes how fast you can act on a recommendation. If you can move from “the model says do this” to done in hours instead of days, you’ve compressed the gap between the decision and its consequences. That’s not a problem if you classified the decision correctly. It’s a compounding problem if you didn’t.

A two-way door you walked through too fast: recoverable.

A one-way door walked through because the output looked confident and the process felt smooth: that’s the new incident. Deloitte’s language for this is precise:

“AI is amplifying existing deficiencies instead of solving them.”

The decision framework you have right now is the one AI will run faster. If that framework doesn’t distinguish between reversible and irreversible, you’ll get to the wrong answer more thoroughly than before.

The 60-Second Classification

The instinct I developed isn’t complicated. Before committing to any significant call, ask one question: can this be undone?

Not “should this be undone.” Not “do I want to undo it.” Just: is undoing it structurally possible, in a timeframe that matters?

If yes: two-way door. Move.

If no: one-way door. Slow down. Get the right people in the room. Don’t let it happen by default.

The classification takes less than 60 seconds. The hard part isn’t the analysis. It’s the discipline to stop and ask when the room is moving fast, the pressure is high and the path looks obvious. Obvious is not the same as reversible.

The signal I trust most is the one that fires when someone says “we should just...” and something sharpens. Should just is almost always someone treating a one-way door like a two-way door because the immediate move appears to be clear. It often is clear. The question is what you’re trading when you make it.

Share

Before the Meeting Closes

Every meeting ends with decisions or the appearance of decisions. Most organizations don’t distinguish between the two. The agenda items hopefully resolve, the call wraps, and people leave with a shared sense of what was agreed. Or at least what the loudest voices believed was agreed. That’s the quiet failure mode of modern meetings: too much talking, not enough listening, and a room full of people mistaking airtime for alignment. Nobody asked which agreements were reversible and which weren’t.

That gap is where decisions become regrets.

The practice: before any meeting closes on a significant item, ask the room out loud: is this a one-way door? If it is, name what can’t be undone. Name who’s actually making the call. Ask what would need to change to reverse it.

The silence that follows that question is almost always the most useful data in the room.

If nobody can answer it, you haven’t made a decision. You’ve made a direction. Directions and decisions look the same on the meeting notes. They have very different postmortems.

You can classify any decision in 60 seconds. If you’re not doing that, you’re spending the same deliberation budget on every call. That’s not discipline. That’s recklessness with a calendar.

Leave a comment

Outside the security room, I produce trance as ZenOne. Different medium, same obsession: tension, timing, and knowing when a move can’t be taken back: zenonemusic.substack.com.

The dashboard was green on Friday.

By Monday morning, it was a five-alarm incident. Three engineers on a bridge call, leadership looped in. The explanation that followed started the same way every postmortem starts: nobody saw it coming.

That’s not what the signals said. The signals had been saying something was wrong for at least three weeks. Nobody read them as a pattern. They’d been reading the status reports instead.

Status reports don’t lie. They optimize.

Every person who writes a weekly update is making a series of micro-decisions about their relationship with the reader. What to lead with. What to bury. What to frame as “in progress” rather than “at risk.” What to omit because explaining it would take too long, raise questions the format can’t handle or create the impression that something is less under control than it is. None of this is dishonesty. It’s rational. It’s the incentive structure working exactly as designed: the writer is managing a relationship, not reporting a system state.

A team lead who surfaces a dependency risk in week one, mentions it again in week three and gets no response, will probably stop surfacing it in week seven. Not because it went away. Because they learned, correctly, that this channel doesn’t address that kind of risk. They adapted to the incentive structure. The report became less accurate and more legible at the same time (I’ve watched this play out more than once. Nobody names the pattern while it’s happening.)

Once you understand what a status report is optimizing for, you can start reading it correctly. Until then, you’re receiving managed information and calling it data.

I spent years at Netflix building OSINT-driven tooling to detect credential theft and account abuse. The job wasn’t to look at what the system reported. It was to learn the difference between what was being detected and what was being manufactured. A clean SIEM isn’t a safe network. It might mean your detection is working. It might mean your detection is broken and nothing is surfacing. Those two states look identical from the outside. Most people see the green light and feel reassured. The forensic instinct asks: why is it green, and what would have to be true for it to stay green while something was wrong?

Status reports are the same problem.

The signals that turned that dashboard red on Monday were in the Friday report. They were described as “some ongoing challenges we’re monitoring” or “a few items we’re still working to close.” Maybe they weren’t there at all: cut for length, cut because the format doesn’t reward ambiguity, cut because three weeks of raising the same issue with no response teaches you something about what gets heard. The report said green. The system had a different read.

The Forensic Read

Most leaders read status reports for confirmation: things are on track, or they aren’t. The forensic read is different. It looks at what’s in the report and what’s missing from it.

The omissions are almost always more useful.

When a risk item stops appearing in updates after being mentioned for two weeks, that’s rarely resolution. It’s more often avoidance: the writer learned the issue wasn’t getting traction and stopped raising it. Percentage completions with no definition of “complete” are precision in the service of ambiguity (and I’ve watched entire quarterly reviews built on that particular evasion). A team lead writing “we’re working through some challenges” with no timeline attached: the missing timeline is the actual data point.

Look for hedging language that changed. If last week’s update was flat and direct, and this week’s has more qualification in it, something shifted. The writer knows something they haven’t figured out how to say yet. Sometimes they’ve figured it out and decided this isn’t the document to say it in, which is a different problem. That change in register is worth a conversation.

This isn’t about suspicion. It’s calibration. The report is produced under specific pressures: time, format, hierarchy, relationship management. Reading it forensically means understanding those pressures and adjusting for them, the way you’d adjust for the known limitations of any instrumentation.

The question isn’t “is this accurate?” It’s “what is this document doing, and what does it not have room for?”

Share

Better-Written, Same Problem

AI-generated status summaries are already showing up in some organizations. They’ll become standard. The early versions are more consistent than human ones: cleaner structure, tighter sentences, no hedging buried in paragraph five.

They’ll also optimize for the same thing.

The incentive structure isn’t in the human; it’s in the data being summarized. If the underlying project is at risk and the inputs to the AI summary don’t capture that risk explicitly, the AI will produce a cleaner version of the same managed information. Better-written. Same problem.

The organizations that run into trouble will be the ones that mistake legibility for accuracy. A well-formatted green light reads more convincingly than a confused one. That’s not an improvement. It’s a more credible version of the same signal problem.

The One Practice

One conversation a week that isn’t a report.

Not a check-in. Not a status sync. A specific question: “What would you have put in last week’s update that you decided not to?” (I started asking this about eight years into managing. Should have started in year two.)

The pause before the answer is the data. What surfaces there is the stuff that was too complicated for the format, too uncertain to commit to writing, too politically charged to send up the chain. That’s almost always where the actual system state lives: the unformatted version, before anyone decided what it meant for you to know.

You don’t need to run this with everyone. Pick the two or three people whose reports have the most influence on your decisions. Ask them that question, once a week, in a 10-minute conversation. What you hear will change how you read the written version.

The status report tells you what the sender needs you to believe. A conversation tells you what’s actually happening. If you’re managing entirely through reports, you’re managing the narrative, not the system.

Leave a comment

What changed was that the layer in the middle was gone.

Not the layer that wrote status reports. Not the layer that ran standups and owned project timelines. That work was visible, trackable, and easy to argue either way. The part that disappeared wasn’t in any job description.

The Job Description Was Wrong

Middle managers managed. That was the job: deliverables, headcount, one-on-ones, escalation chains. Coordination. Translation between executive intent and team execution.

All of that is technically accurate. None of it captures what the function actually did.

Here is what the function actually did.

Before the weekly update went to the VP, someone read it and thought: not like this, not today. The VP had spent the morning in a difficult conversation about budget. The draft led with a delay. That was still true. But the manager rewrote the lead, buried the delay after the context that explained it, and sent a version that communicated the same information in a way the VP could receive without making a decision she’d regret.

The data didn’t change. What changed was the timing, the framing, the read of what the room could hold.

That’s not in the job description. None of it ever was.

The Relay and the Read

Gartner projects that 20% of organizations will eliminate more than half their middle management roles through AI by the end of this year. The argument, made publicly by executives at the top of companies that should know better: AI can model the information relay layer. Automated synthesis. World models. The pipeline from team input to executive insight doesn’t require humans to pass it along.

That’s true.

Here’s what’s missing.

There’s another problem, and it runs in the opposite direction. When you make coordination cheaper, you get more of it. Economists call this Jevons Paradox: efficiency improvements in a resource tend to increase total consumption of that resource, not reduce it. AI makes information synthesis cheap. That means more information gets synthesized, more decisions get surfaced, more edge cases get flagged. The middle layer that was filtering that volume before it reached the top is now gone. You haven’t reduced the coordination burden. You’ve removed the filter and increased the volume at the same time.

The relay was never the function. The relay was the visible part of the function. The part that isn’t visible ... the part that generates no artifact, produces no deliverable, appears in no report ... was something different.

Call it the room read. The calibration that happens before the message moves, not after. The decision about what gets escalated and what gets absorbed. The translation that runs in both directions: executive to team, team to executive, and neither in quite the language the other would have used.

No model is doing that. Not because models can’t read sentiment or draft contextually. Because the room read isn’t about information. It’s about relationship. It’s knowing that Marcus is defensive about this topic, that he’ll hear the framing as an attack even if it isn’t, and adjusting before anyone has to recover from the damage.

That’s not coordination. That’s judgment about people, in real time, invisibly, with consequences nobody tracks until the function is gone.

What Disappeared

When the layer comes out, a few things happen.

Executives start receiving signal that’s less processed. Not worse data. Less filtered data. Information that used to arrive shaped for context now arrives shaped by whoever wrote it, which is rarely the person who needs to read it. The volume stays the same. The interpretive layer that used to sit between sender and recipient is now the executive’s problem.

Teams start sending things up without calibration. Not because they got careless. Because the person who would have said wait, not like that is no longer in the structure. The 11 PM message that used to get intercepted, contextualized, and returned with a translation now lands directly. Sometimes it’s fine. Sometimes it causes exactly the problem it was trying to prevent.

And the things that never got escalated start surfacing: the whole point of the function, the ambiguity absorbed at the layer level before it became someone else’s problem. Because there’s no layer left to absorb them.

None of this shows up on any dashboard. It shows up in the postmortem, six months later, when someone asks why coordination has been so hard and nobody can answer.

Share

What the Remaining Leader Now Carries

Flatter orgs can work. AI is genuinely useful in the relay portion of the function: aggregating updates, summarizing threads, surfacing patterns in data that would have required human review.

The question is what remains after the relay is automated.

What remains is the judgment layer. The room read. The calibration of tone before the message moves. The decision about what the team can hear right now, and what needs to wait, and what needs to be reframed before it reaches anyone at all.

That work doesn’t disappear when the org flattens. It migrates. It moves up to whoever is left. And the leader who thinks they removed a coordination function is usually in the middle of absorbing it themselves, without having noticed.

The new job description would say something like: receives unprocessed signal from multiple directions simultaneously, calibrates for relationship and context before transmitting, decides in real time what can be held and what needs to move, does this invisibly, continuously, without a title that names the function.

That’s what middle management was doing.

You don’t need a middle manager. You need someone who can take the signal before it becomes noise.

The title is optional. The function isn’t.

Resources & Further Reading

• The Manager’s Path by Camille Fournier (O’Reilly, 2017) — The clearest account of what actually changes at each management layer, written from the inside. The middle chapters are the ones worth reading twice.

• An Elegant Puzzle: Systems of Engineering Management by Will Larson (Stripe Press, 2019) — Treats the middle layer as a systems problem, not a headcount decision. Useful if you’re designing the replacement, not just arguing about whether to remove the layer.

This is part of the Execution Gap arc. Previously: The Delegation Illusion. Next: The Status Report Is Lying to You.

ZenOne also produces trance music. The mixing arc behind his productions is at zenonemusic.substack.com.

Leave a comment