Designing Security for the People Who Have to Live With It

Our primary goal as a cybersecurity organization is simple: make the secure path the easy path.

Anyone who tells you security doesn't introduce friction is lying. It’s rare to add protection without adding cost somewhere, and the cost is usually paid in someone else's time and attention.

The best security program is the one nobody notices. Not because it isn't there, but because it seamlessly integrates into the organization and supports, rather than hinders, getting the job done.  At its best, an effective security program can be a risk-enabler, which opens the door for more opportunities than it closes off.

I've spent 25 years in InfoSec, building products, getting paid to break them, and defending companies. For the last five years, I’ve dedicated my career to protecting Coalition and recently stepped into the role of Chief Information Security Officer. Fittingly, our mission here is to protect the unprotected.

Coalition’s mission points inward as much as outward. After all, we can't credibly protect other companies without protecting our own, and executing that mission starts with how we build and maintain trust within our own walls.

Why frictionless security wins

The Information Security team must play a delicate balancing act and avoid squandering its mandate. People want to do the right thing for security, but their most important goal is to get their job done and have a positive impact on the business. Heavy-handed security can turn goodwill into circumvention. People tend to find the path that lets them finish their work, and the workaround is almost always less protected than the one they avoided. 

My team operates as if we have a basket of tokens. The tokens are the organizational trust we’ve been given, and we have a finite amount to spend on security. Every control we implement costs us tokens, some more than others. It’s easy for a security team to feel all-powerful, but every high-friction rule burns through that trust.

We can't credibly protect other companies without protecting our own, and executing that mission starts with how we build and maintain trust within our own walls.

The discipline is spending deliberately: accepting friction where the risk genuinely warrants it and hunting for places where you can raise the bar and lower the cost in the same move. But deliberate spending isn’t the same as going easy.

The tokens exist to be spent, and hoarding them only benefits attackers. A control that was adequate two years ago may not be adequate today, which means the requirements we place on ourselves, and on the companies we depend on, have to keep improving. At Coalition, we expect a high standard from our vendors, and we hold ourselves to the same bar. There's no quarter from me on either.

The cost of saying no

Right now, the sharpest test of all this is AI. When a new category of tooling emerges, the instinctive security answer is to say no.

Saying yes opens the door to security risks that you can’t yet name. Saying no creates a risk that lands on somebody else — the team shipping slower, the function that can't automate — and never appears in a security report. Many security programs default to refusal, and refusal is often the more expensive choice. But an organization that falls behind its competitors by saying no to everything takes on risk just as surely as one that moves too fast. This is when being deliberate about spending your tokens will have the most positive impact.  

The real work is engineering the yes: naming the specific exposure rather than the general unease, deciding which exposures are worth carrying, and getting leadership genuinely aligned on where the line sits. Coalition is well-positioned for these conversations because we see cyber risk from several angles at once. Our underwriting teams track how AI risk is emerging across a wide swath of businesses. Our incident responders are in the trenches, handling active events on real victims. Our entire organization is full of technologists who take things apart to understand them. 

Saying yes opens the door to security risks that you can’t yet name. Saying no creates a risk that lands on somebody else and never appears in a security report.

When we weigh a new exposure, we reason from what we observe rather than what we imagine. Saying no is what you fall back on when you can't see well enough to say anything else.

Plan for controls to fail

No matter how strong your program is, you should be prepared. You can be the best driver on the road and still end up in an accident.

Every security leader should plan for controls to fail at some point and say so plainly to their executives long before anything happens. If you have let people believe a breach is impossible, you’ll inevitably struggle to get the time and money to prepare for one and find yourself explaining residual risk at the worst possible moment.

Planning for failure is what produces preparedness. If you accept that you’ll be breached at some point, decisions get made in advance:

• Who has the authority to pull a system offline?

• Who communicates with customers?

• What can the business live without?

• How do we keep operating when systems are down?

Those decisions are difficult to make under the pressure of a real incident, and the teams that make them beforehand are the ones better positioned afterward. To prepare, we run regular tabletop incident response drills and continually work to raise the bar. We may not be able to predict the exact event, but our practice gives us a framework we can use to respond effectively, if necessary.

Credibility is hard to build and easy to lose

As a security leader for a company that advises other businesses on managing cyber risk, I believe we’re answerable for how we manage our own risk.

Coalition has earned its standing in the cyber insurance industry, in part, because brokers and policyholders trust that our team knows what it’s talking about. Credibility takes years to build, but it only takes one bad day to lose it all. Integrity matters to me, and advice you wouldn’t implement yourself is the definition of bad advice.

The standard here isn't mine alone to take credit for. Security works as an enabler at Coalition because of an entire team that asks the same question before anything ships: What is this going to feel like to the person on the other end?

I feel fortunate to work at a place where I’ve never once had to argue that security matters. Our customers put their trust in us every day. Deserving that trust means being there on the day something goes wrong for them and having done the unglamorous work long before.

This blog post is designed to provide general information on the topic presented and is not intended to construe or render legal or other professional services of any kind. If legal or other professional services are required, the services of a professional should be sought. The reader is cautioned to consult independent professional advisors and formulate independent conclusions and opinions regarding the subject matter discussed herein. Coalition makes no representations as to the accuracy or completeness of this content. Any action taken based on this information is at the sole discretion and risk of the reader. Coalition and its affiliates expressly disclaim any liability for losses or damages resulting from the use of or reliance on this information, which is used strictly at the reader’s own risk. 

Copyright © 2026. All rights reserved. Coalition and the Coalition logo are trademarks of Coalition, Inc.