Risk managers educate people about measuring exposure, test assumptions, and provide advice on how best to prepare for incidents they hope will not occur. They know that the absence of a security alert does not mean security; that resilience depends on preparation and that a plan is only as good as the people who can execute it.
But when the risk is personal, these ideas take on a heavier meaning.
Receiving a Cancer Diagnosis
I was diagnosed after a routine physical including a PSA blood test. I hadn’t noticed any symptoms and had no known family history. This raised a few eyebrows and ultimately, a diagnosis of stage three prostate cancer.
My experience does not justify making a personal health choice or giving clinical advice. This is way out of my wheelhouse. It is, however, a useful framework for a profession that often talks about preparedness, leadership, and resilience, but sometimes forgets to consider the people expected to perform these three functions.
Risk appetite changes when you are the asset
In professional life, leaders can be admirably objective. They can challenge a security check, decide whether a certain risk falls within an agreed-upon tolerance, and explain to a board of directors why a difficult compromise is necessary. They usually analyze a faceless company.
Risk management is about more than recommending a set of analytical frameworks. It is also decision-making under duress, usually done with incomplete information and a nervous temperament. Leaders who never recognize the human aspect may be less prepared, but not richer, when pressure mounts on their own lives or on their teams.
The parallel with cybergovernance should be handled with caution, but it is useful. A security manager should not accept a vendor’s assurance statement, default technology configuration, or management recommendations at face value without formal review.
Likewise, the patient should not be given the impression that asking questions is in any way confrontational. In both situations, action arises from available information, from psychological safety, from a feeling of being able to say: help me understand the options, assumptions, and consequences of the mitigation plan.
Resilience is preparation, not performance
Before my radiation treatment, I prepared deliberately, focusing on fitness, diet, rest, meditation and mental conditioning. I had to reevaluate my relationship with alcohol and caffeine. I sought to make a game of it, imagining my 37-week treatment as a daily tournament: one demanding day at a time, with the goal of arriving at my best possible condition for each “match.” Doing this gave structure to an experience where I would otherwise feel a loss of control.
The broader leadership lesson here is that resilience increases under certain conditions: clear routines, manageable goals, supportive relationships, and the right to rest. And to change course when the initial plan is no longer suitable.
Sometimes I felt like I had done too much; my body forced me to listen. It matters. Cyber teams are told to endure while normalizing burnout: spending all-nighters responding to incidents, always on call, the idea that engagement is measured by availability.
But a security function cannot be resilient if its people have little opportunity to recover. Personal resilience is not an individual productivity program. It is a capacity strengthened by support, boundaries and a culture that views recovery as part of sustained performance.
Transparency can be control, not accountability
Cancer can carry stigma, particularly in elderly settings where strength is too often interpreted as invulnerability. I decided to go public with my diagnosis to raise awareness because I didn’t want to hide what was happening. Unsurprisingly, the response was mixed. Some people just didn’t know what to say, while others were supportive.
This is a dynamic familiar to security leaders. We want people to disclose incidents as soon as possible, raise concerns and seek help. But organizations can unintentionally discourage the openness they claim to value. If culture demands refined certainty from leaders, it becomes more difficult for anyone to share a vulnerability or need.
Everyone should have the right to control what they disclose, when and with whom. Leaders who embody the idea that humanity and responsibility are not in conflict can help lead by example. They can model a better type of strength: the ability to hold space for others without pretending to be invincible.
This is not just a demonstration of goodwill towards employers. It’s a question of resilience. Workplace support for people undergoing cancer treatment can take many forms, from time off and flexible hours to tailored responsibilities, regular check-ins, workplace health support or employee assistance.
A more human model of risk leadership
Of course, personal health and cybersecurity are not interchangeable. A PSA result is not a vulnerability scan and remediation is not an incident response. The analogy breaks down when we try to frame illness as a management problem to be solved by willpower.
But risk leaders can still take away something important. Habits that help organizations cope with uncertainty, such as curiosity, preparation, reliable expertise, focused communication, and adaptive recovery, also matter in human life. The same goes for recognizing what those habits can’t control.
For a profession based on the anticipation of damage, the challenge is not to be more alarmed. It’s about becoming more attuned to the weak signals we ignore, the people we expect to get away with it quietly, and the difference between looking good and actually being supported.
We need to let go of prejudices and prejudices and start an honest dialogue about prostate health in men. The responsible version of this message is equally direct: talk to a clinician about your personal risk and what the PSA test can reveal.
Cybersecurity leaders often ask organizations if they are prepared for disruption. A more personal question may be just as important: Are we creating an environment where people can freely discuss risks, seek help if they need it, and recover without having to compromise their dignity?
Disclaimer: This is a personal account of my experiences and does not constitute medical advice. Concerned readers should consult qualified healthcare professionals.
