Who We Decide to Be When We See It Coming: Accountability, Action, and the Intelligence Gap in Security

When you strip away the language and the frameworks, most security failures come down to one thing: people saw enough, early enough, and still didn’t act with the weight the situation deserved.

That’s not a tooling problem. That’s an accountability and leadership problem.

If you’re serious about closing the “intelligence gap,” you have to start by deciding what kind of organization you’re going to be when that quiet, uncomfortable recognition moment hits. Do you want to be the group that digs into why the signal never turned into action, or the group that writes a cleaner story and moves on?

Everything else flows from that choice.

For me, this starts with identity. You have to be intentional about the kind of operating standard you’re willing to live with, not just put values on a wall. What will you always protect? What conduct is never acceptable, even if it delivers results? Where do you draw the line between “we’re not sure yet” and “this is enough to move”?

That identity has to show up in how you set priorities. You can’t protect everything, so you need to be blunt about a few things:

• What are the truly critical parts of your business or mission that you cannot afford to lose or disrupt?
• What are the most likely and most dangerous ways those things can be eroded—by people, by process failure, by supply chain, by insider behavior, by external actors?
• What does “early” realistically look like for each of those scenarios?

You are identifying the likely items you would expect to find if you were conducting an informed investigation. Except you are doing without the safety net of empirical evidence.

You are not done after this phase. You’re just out of excuses.

You then build an information and discernment architecture around those priorities. Not a giant “collect everything” machine that creates information fog that “overwhelms you with information”. I’m talking about a deliberate approach to illuminating the specific indicators that point toward the scenarios you care about most. You’re asking things like, if this supply chain is going to fail, what will we see first? If an insider is going to move from disgruntled to dangerous, what changes in behavior, access, or narrative will show up along the way?

That’s where intelligence lives. It lives in behavior through way you choose what to look for, how you interpret it, and how quickly it feeds your decision cycle. If your “intelligence” never changes what leaders do, it’s just background noise of buzzwords and window dressing. Organizations cannot allow the mislabeling dynamic situations or “fluid tradecraft” for lack of discipline.

Security’s job in this picture is not simple and demanding. You must protect those critical assets, resources, and activities against the most credible threats your analysis surfaced. That means being relentless once you’ve set your priorities. No half-measures, no “we’ll get to it next quarter” when those indicators you said mattered start blinking. If something has made the list as “critical,” then your behavior has to match the label.

And this is where accountability really bites.

If people see those indicators and nothing happens (no escalation, no decision, no consequence) that’s not a gap in awareness. That’s a choice. It’s a choice about what you actually value, regardless of what the policy says. Over time, your organization learns that choice better than any training they received or operational drills you practiced. “We knew, we spoke up, and nothing changed.” You can’t engineer your way out of that with better dashboards or reorganizing, again.

At the same time, commitment can’t mean stubbornness. A serious organization is both committed and adjustable. You build a blueprint from your best analysis of threats and critical functions, but you don’t treat that blueprint as sacred. Reality gets a vote.

If the data starts to tell you that your assumptions were off or the threat is showing up in a different part of the business, through a different channel, on a different timeline, you change your mind. You revisit your scenarios, you re-align your indicators, you adjust your priorities. Sticking to a plan that has been clearly disproven isn’t “discipline,” it’s negligence.

Accountability here cuts both ways:

• You’re accountable for doing the work upfront: defining standards, naming critical items, mapping realistic threat paths, and designing what you will watch for.
• You’re also accountable for listening when reality tells you your initial model was wrong, and moving accordingly and decisively.

The whole idea behind this “intelligence gap” is that security should be an information‑fed ecosystem, not an after‑action ritual. If threat and risk analysis done properly, indicators are not random surprises. They’re the early chapters in a story you already outlined. A late payment pattern in a fragile supplier, a pattern of exceptions in a high‑risk process, a sudden narrative shift around a leader online, a change in tone and behavior from a key insider must not be treated like disconnected “data points”.

They’re pieces of the probable sequence that leads to something you already said you cannot afford; like a supply chain choke, a fraud event, an insider walkout, a violent incident. If you’ve done your analysis honestly, you’ve already imagined those paths. When the early steps start to appear and you still don’t move, that’s not mystery. That’s a failure to act on courage, clarity, or both.

If I had to boil this down into what I’d say to a couple of friends in this space, it would be this:

All of this still falls short if you stop at analysis and “raising concerns.” After you’ve done the hard work of defining who you are, what matters most, how it can realistically break, and what the early indicators look like, you must plan the actions you will take when those indicators appear. You must also decide who owns them.

That means getting very specific:

• At each key decision point, what exactly do we do first, second, and third?
• Who is the primary owner for that action, by name or by role; not “the business” or “security,” but an accountable person or team?
• Who are the supporting actors, and what are they expected to contribute when that trigger is hit?
• What are we willing to disrupt, what projects, relationships, short‑term metrics and when that plan says it’s time to move?

You write that down in plain language. You pressure test it. And then you rehearse it until, when the indicator lights up, people aren’t inventing the response on the fly or waiting to see if anyone else will move first. They are doing what they already agreed they would do.

This is where courage shows up in a way you can actually measure. It’s not just the courage to call out an uncomfortable pattern or to send an escalation email when you know it will create friction. It’s the courage to follow the plan you built, at the moment you said you would follow it, even when the outcome isn’t guaranteed and even when it might make you unpopular or expose you to second‑guessing later.

Sometimes those calls will turn out to be wrong, or at least not fully right. You will pull a lever and later decide you overreacted, or you will disrupt something that didn’t need that level of interruption. That’s part of the deal. The point isn’t perfection. The point is integrity.

You defined who you are, you defined what you would protect and how, you defined what indicators would mean “we act now,” and then you stood behind that definition when it was tested. You adjust the plan afterward based on what you learned, but you don’t rewrite your own history to pretend you were never sure.

That combination of clear identity, honest analysis, deliberate indicators, and the practiced courage to follow your own playbook is what closes the gap between “we knew” and “we did something about it.” Without that last step, all the intelligence in the world is just documentation for the next honest reckoning. Everything else like tools, dashboards, and frameworks either supports that or gets in the way.rganization. It is also to help shape how the organization sees and thinks about risk. Security becomes a strategic intelligence function, not just a perimeter defense.