Innovation, leadership and legacy

You have mastered the tool, protected it and governed it. What remains is everything the tool will not do for you: making what did not exist before, leading the people who make it, and leaving behind a mark that goes on working after you have stopped.

OPENING STORY

The idea everyone rejected

When Fawzooz first put forward the idea of "cognitive security", the answer he got was polite and final: this is not information security. A colleague he respected told him, "you are talking about psychology, and we protect servers." In another committee he was asked a question worth quoting in full: "and where is the technical control you are proposing?" He had no technical control to offer. What he had was an observation that the most valuable thing we lose is never breached over the network.

Two difficult years went by. He did not change the idea at all; he changed three things about how he presented it. He cast it as a model that could be measured rather than as an opinion. He tied it to the language of the people who decide — risk, audit and compliance, rather than psychology. And he proved it in one small case before he asked any organisation to adopt it.

Today that model is applied and taught. The difference was never in the quality of the idea, which was exactly the same idea it had been on the first day. The difference was in engineering it until it could be adopted.

And that is what the last degree is about. Innovation is not a moment of inspiration but a craft. Leadership is not a position but the business of enabling whoever makes things. And legacy is not what you achieved; it is what carries on after you.