There is one sentence I hear from information security leaders more than almost any other:
“I don’t have time to do what I need to do.”
The problem usually isn’t motivation, discipline, or effort. Security leaders already work hard. The deeper problem is that their ability to handle difficult work attracts more difficult work.
Questions, approvals, exceptions, vendor reviews, audit requests, incidents, meetings, unfinished decisions, and executive concerns all flow toward the person who has demonstrated that they can carry them. Eventually, being able to handle almost anything becomes the reason the leader has time to think about almost nothing.
I wrote The Security Leader’s Operating System to help change that.
Security Leaders Don’t Need Another Productivity Trick
Most productivity systems concentrate on organizing work after it has already been accepted.
This field guide starts earlier.
Before deciding where a task belongs, it asks whether that work should exist in its current form at all. It applies the EDSAM mental model:
- Eliminate work that does not need to happen.
- Delegate outcomes that do not require the leader’s authority or judgment.
- Simplify work until it produces the smallest useful result.
- Automate the predictable parts of the work that remains.
- Maintain only what must remain under the leader’s direct care.
The objective is not to help security leaders process an endlessly growing queue more quickly. It is to redesign the system so that less work requires the leader in the first place.
Protect the Work Only the Leader Can Do
Some work genuinely belongs with the security leader.
Setting risk appetite, challenging assumptions, translating technical exposure into business decisions, communicating during consequential events, developing people, and accepting residual risk cannot simply be optimized away.
But that work is often crowded out by management exhaust: status collection, repetitive reporting, preventable escalations, meeting preparation, evidence retrieval, routing questions, and processes that exist largely because they have always existed.
The guide introduces practical ways to distinguish leader-only work from work that can be removed, transferred, redesigned, or supported by better systems.
It includes:
- A Money, Attention, and Time workload scan
- The Eisenhower Matrix mapped into EDSAM
- TaskGrid as an example of integrating urgency, importance, agency, commitments, planning horizons, and EDSAM dispositions
- Information security workload playbooks
- A recurring operating cadence
- A 30-day reset
- Capacity and decision tools
- Field-ready worksheets and checklists
- A NIST Cybersecurity Framework 2.0 scope check
AI Can Reduce Work—or Industrialize the Wrong Work
Modern LLMs, GPTs, skills, assistants, and agents make this conversation more urgent.
These tools can retrieve information, summarize evidence, compare documents, prepare decision packets, draft communications, and move bounded work through repeatable processes.
They can also accelerate bad processes, obscure missing context, accumulate excessive authority, and create new infrastructure that someone must maintain.
That is why the guide applies EDSAM before automation.
It explores how to divide work among humans, models, and deterministic systems; how to establish capability levels and autonomy budgets; and how to preserve accountable human judgment when AI-enabled workflows can create real consequences.
The important question is not simply, “Can AI perform this task?”
The better sequence is:
- Should this work exist?
- Who should own its outcome?
- What is the smallest useful result?
- Which parts are predictable enough to automate?
- What judgment, authority, or relationship must remain human?
A Field Guide, Not a Theory Book
This is intended to be used with the work already in front of you.
Choose one recurring meeting. One report. One approval queue. One source of preventable escalation. One hour of work that only you can perform.
Then apply the system.
A saved hour is useful. A redesigned workflow that prevents the same demand from returning every week is leverage. A clearer decision boundary makes the entire team stronger.
My broader goal is to leave behind a legacy of useful knowledge—methods that other people can test, challenge, improve, and carry forward. I hope this guide becomes part of that working library.
Download the Field Guide
You can download The Security Leader’s Operating System here:
Download The Security Leader’s Operating System
As you work through it, I would be interested to hear what you eliminate, delegate, simplify, automate, or deliberately maintain first.
