CyberWatch

Helen Patton (Cisco) | Crafting an effective cybersecurity strategy

By

By

Access Point Consulting

Cybersecurity is often seen as a reactive field, constantly responding to threats as they emerge. But Helen Patton, Cybersecurity Executive Advisor at Cisco, argues that a well-defined cybersecurity strategy can shift the focus to a proactive approach—one that aligns security efforts with broader business objectives.

Strategy vs. Tactics
Cybersecurity without a strategy can quickly devolve into firefighting. “Having a strategy allows you to plan with big-picture goals in mind, rather than just reacting to today’s fire,” Helen explains. It provides a framework that connects security initiatives to the company’s mission and ensures progress is measured over months and years—not just incidents and responses.

Defining a Cybersecurity Strategy
A security strategy isn’t just about “not getting breached.” It should reflect the organization’s specific goals and operating environment. At Ohio State University, Helen aligned security with priorities like supporting research, student learning, and faculty operations.

"Your strategy should answer: What are we enabling with our security efforts? How does security support the mission?" she says. It’s about more than just defense—it’s about making security an asset, not an obstacle.

Balancing Flexibility with Structure
Cyber threats evolve rapidly, but a strategy shouldn’t be purely reactive. Instead, it should be broad enough to account for shifting risks without constantly being rewritten. Helen notes that strategic plans should typically cover a timeframe of one to three years—long enough to drive meaningful change but flexible enough to adapt as needed.

Engaging Stakeholders for Buy-in
A strategy can’t be developed in isolation. Helen stresses the importance of stakeholder engagement: “You have to make sure the business understands why security matters and how it contributes to overall success.” Security leaders should work with executive teams, IT, and business units to ensure alignment.

Moving Beyond the 'Department of No'
Security has long been perceived as an obstacle to innovation, but Helen believes a strong strategy helps shift that narrative. “Instead of saying no, security should focus on managing risk and guiding informed decision-making,” she says. A strategy provides a framework to evaluate new initiatives, ensuring they align with long-term goals without introducing unnecessary risk.

Where to Start
For those looking to develop a cybersecurity strategy, Helen recommends leveraging existing frameworks, learning from peers, and networking with other security leaders. “Find out what’s working in your industry, but always critically evaluate whether it makes sense for your organization.”

Listen to the CyberWatch podcast on Spotify and Apple Podcasts, or watch the episode on YouTube.

Resources

CyberWatch

January 29, 2025

Ricoh Danielson (Vitrix Health) | Building a security culture and embracing AI

Being a CISO has never been easy, and 2025 doesn't promise to make it any easier. What you need to know to begin and to succeed in the job. Today we're talking with Ricoh Danielson. Ricoh is the CISO at Virtix Health. He has a wealth of experience as a CISO, as a cybersecurity expert, and as someone in demand for his knowledge of risk and cybersecurity around the world. We talked to him about what the job of CISO is in 2025, what you need to know if you're moving into the role and, most important, what you need to know to succeed as a CISO this year and for the coming years.

Find out more
November 22, 2024

Patch Updates, New Malware Threats, and the Ongoing Supply Chain Battle

On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.

Find out more
October 25, 2024

Ransomware, Supply Chain Attacks, and Nation-State Threats

CyberWatch, by Access Point Consulting, is your weekly source for emerging cybersecurity news, regulatory updates, and threat intelligence. Backed by experts in security consulting, regulatory compliance, and security operations, Access Point enables you to manage cyber risks, respond to incidents, and drive innovation in your company. Read here or on our website; listen on Spotify or Apple Podcasts; or watch on YouTube.website; listen on Spotify or Apple Podcasts; or watch on YouTube. .

Find out more