Security debt is inevitable, but how you define, measure, and prioritize it determines whether it stays manageable or becomes an existential risk. Garrett Smiley, CISO at Serco, built the company’s risk management program from the ground up and previously served as CSO at General Dynamics Information Technology. In this episode, he shares a pragmatic framework for tackling security debt, explains why KRIs beat KPIs for security teams, and makes the case that rapport building is the most underrated skill in cybersecurity leadership.
You can read the complete transcript of the episode here >
How do you define and measure security debt?
Garrett draws a clear distinction between security debt and vulnerability findings. Security debt consists of risks an organization has knowingly taken on that ideally it would not carry. A practical example: deploying two-factor authentication everywhere except one business unit due to constraints. The gap between “deployed” and “fully implemented with no exceptions” is security debt.
Measuring it requires context:
- Liability assessment: How does carrying this debt expose the organization legally or financially?
- Exploitability: How likely is this specific gap to be exploited given the organization’s attack surface?
- Business context: An air-gapped system in a secure facility has different priorities than a public-facing web application.
The critical point: security debt is not static. What was acceptable six months ago may now represent unacceptable risk due to changes in the threat landscape. Continuous reevaluation, not one-time classification, is what keeps debt from becoming a crisis. This aligns with how risk-driven security programs approach prioritization over compliance-driven ones.
How should security teams prioritize debt when resources are limited?
Resources are never unbounded. Even with budget, you still need people, and most security staff are already operating at 300-400% capacity. Garrett’s approach to prioritization:
- Work with leadership: Security cannot prioritize in isolation. Partner with organizational leaders to help them understand the risk posed by specific debt items.
- Roadmap the work: Create a sequenced plan that tackles the highest-liability items first while acknowledging that not everything can happen simultaneously.
- Accept the constraint: Something has to give. The honest conversation is about what you are choosing not to do and why, not pretending everything will get done.
The prioritization is always contextual. Whether EDR edges out application whitelisting or two-factor authentication takes precedence depends entirely on the organization’s attack surface, industry vertical, and existing controls. There is no universal answer, only a universal process: assess liability, assess exploitability, and decide in partnership.
How can security teams build effective partnerships across the organization?
Garrett is blunt: the situation is often worse than “security as a roadblock.” In many organizations, security is simply ignored and marginalized. The fix is rapport building, which he considers the most critical skill for security professionals.
His approach:
- Care about their pain points: If you do not understand what other teams struggle with, they will not give you the time of day. Learn their challenges first.
- Explain your motivations: Be transparent. “My goal is not to be a jerk. My goal is to help you do what you are already doing in a more secure way so we all keep getting paychecks.”
- Accept the advisory role: Security does not own the systems it governs. Separation of duties means you advise, consult, and identify risk. You do not dictate.
However, rapport alone is insufficient without tone from the top. If senior leadership does not demonstrate that security matters, individual relationship building hits a ceiling. Both elements, grassroots rapport and executive messaging, must be in place. This mirrors the dual approach discussed in building cybersecurity teams across organizations.
How should you set up a security organization from scratch?
When starting from zero, Garrett follows a clear sequence based on urgency:
- Incident response first: You must be able to react when things go sideways. If someone is exfiltrating data and you cannot respond, nothing else matters. Codify workflows, define swim lanes, and build muscle memory before incidents occur.
- Vulnerability management second: Once you can respond to incidents, get visibility into your attack surface. This program will immediately reveal whether your asset governance is adequate (it usually is not).
- Asset governance third: You cannot secure what you do not know exists. Continuous monitoring capability is the foundation everything else builds on.
The analogy: if the building is on fire, first get everyone out, then call the fire department, then figure out what started it. Incident response is safety. Vulnerability management is triage. Asset governance is prevention.
Why are KRIs better than KPIs for security teams?
Garrett is openly resistant to KPIs for internal security staff. His reasoning:
- Capacity mismatch: If a team needs ten people but has three, KPI data will make it look like they are underperforming when they are actually doing the work of multiple people.
- False signals: Measuring ticket closure time when staff is at 300% capacity produces misleading data that does not reflect actual performance.
- Contractual exceptions: KPIs make sense for third-party staff augmentation where deliverables are contractually bounded. For internal teams, they often waste time confirming what leadership already knows: you need more people.
KRIs (Key Risk Indicators) are more valuable because they show where risk is accumulating across the entire organization, not just within the security team:
- Broad visibility: KRIs reveal whether IT operations, end users, or security itself is the bottleneck.
- Behavioral insights: Phishing simulation metrics show user behavior trends. Patching cadence shows operational discipline.
- Motivating factor: Senior executives do not like bad reports. KRIs create accountability that drives improvement across departments.
The principle: what you measure, you pay attention to. What you pay attention to tends to improve. KRIs focus that attention on risk reduction rather than activity metrics.
What role does culture play in security effectiveness?
Garrett challenges the idea that organizational culture is monolithic. Within his own infosec team, culture is deliberately healthy because of intentional hiring and team building. The broader organization is a different story.
His cultural framework:
- Hire for fit and adaptability: Security professionals must be able to deal with difficult people. Not every stakeholder will be cooperative, and that is part of the job.
- Do not expect universal buy-in: Some teams will resist. Some will ignore you. The response is persistent, patient rapport building, not force.
- Security is everybody’s job: This sounds like a tired trope, but it is operationally true. If people are not performing securely, the organization is not secure regardless of what tools are deployed.
The security culture shift requires both top-down messaging and bottom-up motivation. Neither alone is sufficient. Leadership must signal that security matters, and individual teams must be motivated to act on it.
