Playing Corporate Politics for Cybersecurity
Explore strategies for CISOs to navigate corporate politics effectively for enhanced cybersecurity: Learn how to turn internal challenges into opportunities for building stronger security programs.
CISOs frequently talk to us about the challenges they face dealing with corporate politics. They’re trying to make their organizations more secure, but no one will get out of their way and let them do their job. Every initiative becomes a battle, making progress difficult.
Anyone that has worked in cybersecurity will recognize that story. Cybersecurity teams face an uphill battle in just about everything they do.
However, if corporate politics is the problem, then it’s also the solution. The only way to fix corporate politics is with more corporate politics. I’d argue, is where CISOs and cybersecurity teams really struggle.
Playing Politics
If you’re going to play corporate politics, which you should, the first thing to know is that it’s all about what you’re willing to lose. Sometimes you’ll find yourself in a zero sum game. No one can win every time, and especially not the IT department. You have to know what you’re willing to give up.
You also need to figure out what really matters to you. What do you want to win? Again, it can’t be everything, because you won’t win everything.
From there, it’s about trading. Trade your losses for your wins. Make deals. Figure out what you can give up to other people in exchange for what matters the most. And then go make those trades.
Lastly, look for opportunities where outcomes don't necessarily involve winners or losers. What can you do for other teams and departments to make them happy without causing a problem. And go do that, too. Go buy political capital for yourself.
You might object that you shouldn’t have to compromise on cybersecurity, but the reality is that everyone has to compromise. Cybersecurity is no exception. Your effectiveness depends on your ability to make those compromises wisely. Don’t compromise on the things that matter, but on the things that don’t.
Friendly Security Awareness is Political Capital
The fact that cybersecurity teams are bad at corporate politics is extremely clear when you look at security awareness training. Security awareness training impacts everyone in the company, so it’s a great opportunity to either make friends or enemies. The stakes are also fairly low, at least relative to something like mandatory MFA or strict access control. Security awareness training is therefore a great opportunity for IT departments to win some good will.
And yet, they usually don’t. When CISOs hear me say that I built Pistachio first and foremost for end users, not IT admins, they have a moment of repulsion. The mere idea of focusing on user experience as a primary value driver is foreign to them.
In some ways I get it. Security awareness is a rare case where IT will usually get its way. Most companies will agree that people just have to do it, and tolerate hostile policies as long as it doesn’t get out of hand.
But instead of flexing their power, CISOs should use security awareness to demonstrate that they care about internal users. Design programs that integrate seamlessly into employees' work routines. Shift the focus from punishment to creating a positive experience with security awareness.
Doing so will win political favor, or at least build trust from the rest of the company. And what does it cost? Nothing. Building a security program that respects people’s time, a program people actually like, is better for everyone. It’s a great opportunity to play a political game without giving up what matters.
We believe in a learn-by-doing approach over snooze-worthy videos.
Instead, Pistachio tailors real-world scenarios so your team can build their cyber skills in a safe environment.
Continue reading
Ready to reduce your human risk? Book your demo today.
“We lacked confidence that employees would recognise today’s phishing threats or respond correctly. Since using the Pistachio platform, they are more attentive and proactive in identifying potential risks. The solution is easy to manage, quick to implement, and highly effective.
“The platform is easy to implement and provides clear insights into employee phishing awareness. Its bite-sized learning encourages participation, saves administration time, and allows us to focus more on real threat detection.”
“We were looking for a practical way to improve cybersecurity awareness across the organization. Pistachio made training simple and engaging, and we’ve seen a noticeable improvement in employee awareness with minimal effort.”
“Pistachio removed the burden of planning campaigns, collecting data, and evaluating results. The program challenges each employee at their own level and provides clear, simple reporting. Pistachio has streamlined our awareness training and strengthened our organization’s cybersecurity.”
“Our goal was to help employees better recognize phishing emails and avoid malicious links. Pistachio made this easy and engaging, and we’ve seen a clear improvement in detection, fewer clicks on phishing links, and reduced data disclosure. With minimal ongoing maintenance, it’s an effective and low-effort solution.”
“Within weeks, Presence had flagged several incidents that could have otherwise been missed, including employees forwarding company data to personal accounts during offboarding. The alerts are reliable and actionable, so we've built a full investigation process around them. Although I was skeptical at first, the value was obvious almost immediately.”
“Pistachio has reduced our manual workload to zero with its automated phishing simulations and in‑box delivery of scenario‑based trainings. This has allowed our team to dedicate time to other important security initiatives while Pistachio handles our Security Awareness program seamlessly.”
“Presence automatically detects suspicious behaviour and gives us the visibility we need without constant manual oversight. Within the first few weeks we were already seeing alerts that would have otherwise gone unnoticed as the system learns what is usual and unusual behaviour for our environment.”
“Before Pistachio, security awareness was something we could only offer to a few customers. Today it’s part of every managed service we deliver, and we haven’t had to grow the team to make that happen.”
Fill out the form to book a demo:
Trusted by 1200+ customers & MSPs
