Throwing the Elephant

In a live question-and-answer session after the talk, Bryson took audience questions on the ideas presented. On managing up, Bryson suggested starting with informal rapport, then moving toward business language such as quarterly objectives and the metrics used to track them. Those goals reveal the pressures shaping a manager's decisions, and many security staff feel frustrated because leaders higher up often lack visibility into their daily work.

Asked about regulation versus real security, Bryson argued that compliance checklists matter to the business because a company may not legally operate without meeting them. Practitioners can treat the checklist as a foundation and build applied security work on top of it to serve business needs. On founding a company, Bryson pointed to a passion strong enough to sustain the effort and a tolerance for administrative work that is not core to the product.

The session closed with a call for kindness: toward yourself, in managing anxiety and work-life balance, and toward colleagues facing the same pressures. Bryson also noted that no single person can overcome an organization that does not prioritize security.