Risk management leaders educate people on measuring exposure, testing assumptions and advising on how best to prepare for incidents they hope won’t occur. They know that the absence of a security alert does not stand for safety; that resilience depends on preparedness, and that a plan is only as good as the people who can execute it.
But when the risk is personal, those ideas take on a heavier meaning.
Receiving a Cancer Diagnosis
I was diagnosed after a routine physical that included a PSA blood test. I had not noticed any symptoms and had no known family history. That raised a few eyebrows and ultimately, a stage-three prostate cancer diagnosis.
My experience is not a case for making a personal health choice or offering clinical advice. That’s far from my wheelhouse. However, it is a helpful framework for a profession that often talks about preparedness, leadership and resilience, but sometimes forgets to consider the people expected to deliver all three.
Risk Appetite Changes When the Asset is You
In professional life, leaders can be admirably objective. They can challenge a security control, decide whether a certain risk falls within an agreed tolerance, and explain to a board why a difficult trade-off is necessary. They are typically analyzing a faceless enterprise.
Risk management is more than recommending a set of analytical frameworks. It is also decision making under duress, usually done with incomplete information and nervous tempers. Leaders who never acknowledge that human aspect may be poorer prepared, not richer, when pressure mounts on their own lives or teams.
The parallel with cyber governance should be handled carefully, but it is useful. A security leader should not accept at face value a supplier assurance statement, a default technology configuration, or management recommendations without formal review.
Similarly, a patient should not be made to feel that asking questions is somehow confrontational. In both situations, agency derives from available information, psychological safety, feeling able to say: help me understand the options, the assumptions, and the consequences of the mitigation plan.
Resilience is Preparation, Not Performance
Before my radiotherapy, I prepared deliberately, focusing on fitness, diet, rest, meditation and mental conditioning. I had to reevaluate my relationship with alcohol and caffeine. I sought to make a game out of it, imagining my 37-week treatment as a daily tournament: one demanding day at a time, with the aim of arriving at my best condition possible for each “game.” Doing this gave structure to an experience where I would otherwise feel a loss of control.
The more general leadership lesson here is that resilience grows under certain conditions: clear routines, manageable goals, supportive relationships, and the right to rest. And to change course when the original plan has ceased to be appropriate.
At times I felt like I had overdone it; my body forced me to listen. That matters. Cyber teams are told to endure while normalizing exhaustion: pulling all-nighters for incident response, always on call, the idea that commitment is measured by availability.
But a security function cannot be resilient if its people have little opportunity to recover. Personal resilience is not an individual productivity program. It is an ability reinforced by support, boundaries, and a culture that sees recovery as part of a sustained performance.
Transparency Can Be a Control, Not a Liability
Cancer can carry stigma, especially in senior environments where strength is too often interpreted as invulnerability. I decided to go public with my diagnosis to raise awareness because I did not want to hide what was happening. Not surprisingly, the response was mixed. Some people just plain didn’t know what to say, while others were supportive.
That is a familiar dynamic for security leaders. We want people to disclose incidents early, raise concerns and ask for help. But organizations can unintentionally discourage the openness they say they value. If the culture demands polished certainty from leaders, it becomes harder for anyone to share a vulnerability or need.
Everyone should have the right to control what they disclose and when, and with whom. Leaders who embody the notion that humanity and accountability are not in opposition can help lead by example. They can model a better kind of strength: the ability to hold space for others without pretending to be invincible.
This is not only a show of goodwill to the employers. It is a resilience issue. Workplace support for people undergoing cancer treatment can come in many forms, from time off and flexible hours to adjusted responsibilities, regular check-ins, occupational health support or employee assistance.
A More Human Model of Risk Leadership
Of course, personal health and cybersecurity are not interchangeable. A PSA result is not a vulnerability scan, and treatment is not incident response. The analogy breaks down when trying to make illness sound like a management problem to be solved through willpower.
But risk leaders can still take away something important. The habits that help organizations confront uncertainty, things like curiosity, preparation, trusted expertise, purposeful communication and adaptive recovery, matter in human life too. So does acknowledging what those habits cannot control.
For a profession built around anticipating harm, the challenge is not to become more alarmed. It is to become more attuned to the weak signals we ignore, to the people we expect will cope in silence and to the difference between seeming okay and actually being supported.
We need to let go of stigmas or assumptions and begin an honest dialogue around prostate health for men. The responsible version of that message is just as blunt: talk to a clinician about your personal risk and what PSA testing can reveal.
Cybersecurity leaders often ask organizations if they are prepared for disruption. A more personal question may be just as important: are we creating an environment where people can freely discuss risk, ask for help if they need it and recover without having to compromise their dignity?
Disclaimer: This is a personal account of my experiences and not meant as medical advice. Concerned readers should consult with qualified healthcare professionals.
