NexLINKEDIN ARCHIVE / Security
Build a cybersecurity-first culture
You can buy better security tools. However, you need to foster a cybersecurity first culture.
By Phil Kinsley
Adapted and republished on Nexlinks. The publication date is the original article date; the text is preserved as historical author commentary.
Date derived from the original LinkedIn post identifier, shown in America/New_York time; the export supplied only a relative age.
Historical author commentary. Statements and links reflect the original period; this import is not a new factual verification of every historical claim.
You can buy better security tools. However, you need to foster a cybersecurity first culture.
I have rarely seen cybersecurity fail because an organization lacked the right tools. In fact, most places I have worked at had more technology than they knew what to do with. Where things consistently broke down was quieter and harder to name. The culture underneath the program worked against it, often without anyone realizing it.
When speed is rewarded above all else, people learn very quickly which controls matter and which ones can be bypassed. Access keeps accumulating not because teams are careless, but because no one truly owns identity decisions end to end and removing access is rarely as celebrated as granting it. Phishing does not persist because employees are foolish. It persists because reporting mistakes feels uncomfortable, risky, or pointless. Shadow IT does not appear out of malice. It appears when delivery is praised and guardrails are treated as friction instead of support.
None of that is a technology problem. It is a signal problem.
Cybersecurity becomes a culture issue long before it becomes a breach or incident. Culture shows up in what leaders tolerate, what gets waved through during crunch time, and how exceptions slowly become normal. It shows up in whether security is framed as an enabler or as something that “slows things down,” and in whether accountability is clear or quietly diffused across teams.
The strongest security programs I have been part of did not start with tools, dashboards, or maturity models. They started with clarity. Clear ownership. Clear expectations. Leadership behavior that made secure decisions the default rather than the heroic exception. When that foundation exists, the technology actually works the way it is supposed to.
If a security strategy assumes people will change without the culture changing first, it is fragile by design.
I would be interested to hear where others have seen culture either strengthen security or quietly undermine it in their organizations.
Original publication
Original LinkedIn post ↗Original writing supplied by the author. Feed cards, repeated article announcements, and provider promotion have been removed. Consult current primary documentation before acting on historical technical guidance.