Resources
Breach, Blame, Repeat

Breach, Blame, Repeat

World renowned cyber security expert, Dick Clarke, advises on breaking the cycle of breach and blame by evolving the role of the CISO.

Abstract digital eye overlaid with DNS-like code, symbolizing DNS data as a cybersecurity visibility layer

Key takeaways

The article “Breach, Blame, Repeat” reports advice from world-renowned cybersecurity expert Dick Clarke on breaking the cycle of breach and blame by evolving the role of the Chief Information Security Officer (CISO). It frames the real-world problem as recurring breaches followed by finger-pointing that fail to improve organizational security posture, stresses the technical and organizational environment where CISOs must operate across people, process, and technology, and highlights outcomes of reframing the CISO role toward accountability, cross-functional collaboration, and proactive risk management to reduce repeat incidents and improve resilience.

What is the main problem Dick Clarke identifies about how organizations respond to breaches?

Dick Clarke identifies a persistent cycle of breach and blame as the primary problem: after a security incident organizations often focus on assigning fault rather than learning and improving. This reactionary approach prevents systemic changes across people, processes, and technology, leaving similar vulnerabilities unaddressed. Clarke argues that breaking this cycle requires evolving the CISO role away from scapegoating toward leadership that drives accountability, cross-functional collaboration, and sustained risk reduction.

How does Clarke suggest the role of the CISO should evolve to prevent repeat incidents?

Clarke suggests the CISO’s role should evolve from a reactive defender to a strategic leader who partners across the organization. The CISO should emphasize proactive risk management, aligning security objectives with business priorities, and fostering collaboration between IT, operations, and executive leadership. This shift enables consolidated responsibility for security outcomes rather than isolated blame, improving the organization’s ability to implement technical controls, refine processes, and cultivate a security-conscious culture that reduces the likelihood of repeat breaches.

What operational impacts can organizations expect by adopting Clarke’s recommended changes?

Adopting Clarke’s recommendations leads to more durable operational improvements: organizations can expect clearer accountability for security outcomes, better integration of security into business processes, and strengthened incident prevention and response capabilities. By moving away from blame and toward coordinated leadership, teams can more effectively remediate root causes, deploy technical safeguards, and standardize processes. Over time these changes should reduce recurrence of similar incidents and enhance overall organizational resilience to cyber threats.