Global – October 27, 2026 -- Coalition's newly appointed Chief Information Security Officer, a 25-year InfoSec veteran, argues that security teams run on a finite supply of organizational trust, and that high-friction controls drain it and push staff toward less-protected workarounds.
Coalition's CISO treats organizational trust as a limited token budget
The executive spent five years at Coalition before taking the CISO role. The CISO describes trust as a basket of tokens: every control costs tokens, and some cost more than others. Friction belongs only where risk warrants it, while teams should look for changes that raise protection and lower cost at once. Hoarding tokens benefits attackers, the CISO writes, because a control adequate two years ago may fall short today. Coalition holds vendors and itself to the same standard.
AI adoption tests whether security teams default to refusal
Refusing new tooling shifts risk onto other teams, such as those shipping slower or unable to automate, and it never appears in a security report. A company that falls behind competitors by rejecting everything takes on risk as well. Coalition's approach is to name specific exposures, decide which are worth carrying and align leadership on where the line sits. It draws on underwriting teams tracking emerging AI risk across a wide range of businesses and on incident responders handling active events for real victims.
Coalition runs tabletop drills on the assumption that controls will fail
Security leaders should tell executives plainly that controls will fail at some point, the CISO says. Decisions are made in advance: who can pull a system offline, who communicates with customers, what the business can live without, and how operations continue while systems are down. Coalition runs regular tabletop incident response drills.
Credibility in cyber insurance depends on following one's own advice
Coalition's standing in the cyber insurance industry rests partly on brokers and policyholders trusting its team's expertise. "Advice you wouldn't implement yourself is the definition of bad advice," the CISO writes.