What's a security professional's greatest superpower?

What's the greatest superpower a security professional can have?

Persuasion.

One unique fact about being in security is that there’s a wide responsibility spanning the entire organization. Your direct authority on the other hand, often extends over a tiny subset of that same organization.

You're responsible for making sure that applications you don't build that are based off of a roadmap you didn't design and run by a team you don’t control are secure and well protected. Likewise, you're responsible to ensure the security of a bunch of laptops you didn't set up, don't manage and that were distributed to people not reporting to you spread across the planet.

For a long time, security has had a reputation as grumbly curmudgeons, complaining about how dumb users are and why they are the root of all evil. Rather than improve things in the reality that we live in, many thought that we could complain about perceived problems until reality bent to our will.

In what shouldn’t be a terribly surprising turn, this attitude left many sidelined in their roles and entire businesses less secure because of it.

This is because, one of the skills most likely to drive impact as a day-to-day security professional isn't superior technical knowledge about secure coding or system design, it's the ability to persuade others.

The vast majority of impact that we have on an organization is through our ability to influence others. Without it, you'll be struggling to stay afloat before you've even started to assess what the problems you need to address are.

Spend time getting to know the people with the power to help or hinder you in reaching your goals. Learn what they do and who they are as humans. Understand their pain points. Prioritize helping others, even if it isn't a direct benefit to you. Make sure your team does the same. Listen and give them a voice in what you do, likewise, lending your voice to support their goals.

Tech is great but people are where things get done.