I’ve been thinking about something that keeps coming up in cybersecurity conversations.

A risk is raised.
It’s clearly important.
Everyone agrees it matters.

And then… nothing happens.

Not because leadership disagrees.
Not because the risk isn’t real.
But because the conversation never crosses a certain threshold.

It stays in the realm of importance, never entering the realm of choice.

What’s interesting is that urgency doesn’t seem to help.

In fact, urgency often makes it worse.

When something feels urgent but undecidable, the safest response is delay. Not denial, but delay. “Let’s revisit.” “We need more input.” “This is serious, but not right now.”

I used to interpret this as resistance.

I don’t anymore.

I think it’s a signal that the risk was never shaped for judgment.

The moment I noticed this pattern was the moment I stopped asking:
“Why don’t they act?”

And started asking:
“What decision am I actually asking them to make?”

Often, the honest answer was:
​I wasn’t.

I was presenting a situation.
I was describing exposure.
I was highlighting consequences.

But I wasn’t designing a choice.

Once you see this distinction, it’s hard to unsee.

Many cyber risks feel “obvious” to the people closest to them. But obviousness is a terrible input for executive decisions. Leaders don’t act on what feels obvious to someone else — they act on what has been made decidable for them.

Urgency without structure doesn’t accelerate decisions.
It postpones them.

That thought has been sitting with me.

— Lars

​