Table of Contents
Last week, someone shared a short, four-page article with me. It was written for middle school math teachers, and it was about Florence Nightingale.
I expected the Lady with the Lamp. I found a mathematician. As I read about her life, I couldn’t help but wonder what lessons she brought to the world as a mathematician and statistician. Maybe it was the morning coffee. But the awe stayed. She should have taught me about breach readiness. And I had to write this.
The most famous nurse in history won her biggest battle not with a lamp, but with a chart. At a time when people were dying in hospitals, everyone kept thinking that it was the war. She proved them wrong.
I see us dealing with similar challenges. The challenge in a breach is certainly not the lack of technology.
Most Breaches Are Not Novel. They Are Unmanaged Change
Every breach announcement reads like the same script. “We faced an unprecedented cyberattack.”
Unprecedented? Rarely.
Yes, zero-days exist. Yes, AI-powered adversaries are faster than ever. But read the post-incident reports, and a quieter truth emerges. Attackers mostly walk through doors we opened ourselves and forgot to close.
Those doors open every time the digital enterprise changes.
- A cloud workload spun up for a project and never decommissioned.
- A firewall rule opened “temporarily” for a vendor three years ago.
- A service account whose privileges grew with every release.
- An acquisition connected to the network before anyone understood it.
- An OT system bridged to IT for a dashboard nobody owns anymore.
None of these is an exotic exploit. Each is the digital equivalent of a blocked drain at Scutari. The environment changed. Nobody governed the change. The attacker simply arrived to take advantage of it.
The threat is real. The vulnerability is self-inflicted.
This is why I keep saying that breach readiness is not primarily a detection problem. It is a change governance problem.
Access Best Practices Guide:AI Threat Resilience in the Age of MythosThe Nurse Who Made Generals See
Nightingale refused to accept the death rate as the natural cost of war. She counted. She classified every death by cause. She compared army mortality with civilian men of the same age and found that, even in peacetime barracks at home, soldiers died at roughly twice the civilian rate.
Then she did something most experts still struggle with. She made the data impossible to ignore.
Her polar area diagram, the “rose,” showed each month of the war as a wedge. Blue for preventable disease. Red for wounds. Black for everything else. The blue overwhelmed the red. Two roses side by side showed the year before sanitary reform and the year after. Anyone could see, in seconds, that the problem was preventable and that the fix worked.
She did not present data to impress. She presented it to drive a decision. Her audience was Queen Victoria, the Secretary of State for War, and Parliament. Her asks were specific: a Royal Commission on the Health of the Army, sanitary standards for barracks and hospitals, an army medical school, and standard hospital statistics so that performance could be measured everywhere.
She became the first woman elected a Fellow of the Statistical Society of London. Her numbers saved far more lives than her lamp ever could.
If you are a CISO who has walked out of a board meeting wondering why nothing changed after 40 slides of heat maps, this is your lesson.
Watch: The Academician’s View of Being Breach Ready.
To Face the Next Breach, We Need to Know the Digital Estate
If Nightingale ran a security program today, I believe she would focus on the environmental causes before she looked at the damage due to the enemy. It is exactly how she worked.
She did not wait for the next epidemic to find out what was killing soldiers. She built a baseline and watched for deviation. In the digital world, anticipation means knowing your enterprise as it changes, not as it was at the last audit. Every new workload, identity, connection, and dependency changes your attack surface. If you cannot see the change, you cannot govern the risk it carries.
The death rate at Scutari fell sharply once the sewers were flushed and the wards were ventilated. The disease did not disappear. Its ability to spread did. That is breach readiness. Assume something will get through. Then make sure it cannot move. Build zones and microsegments around critical digital systems, connect them with controlled conduits, and contain the blast radius before the incident, not during it.
Her lasting legacy was not one hospital. It was standardized statistics that let the army learn continuously. Every change, incident, and near miss must feed back into policy. Security that is designed once and left alone decays at the speed of your next release.
Draw the Rose for Your Board
Nightingale put one question in front of her leaders that they could act on: is this preventable? Your board needs its own rose. Not a heat map of 400 controls, but one picture that shows how much exposure comes from unmanaged change, and how fast it shrinks when you act.
These are the questions I would want every board and governing body to ask:
- How many changes were made to our digital enterprise last quarter, and how many of them were known to the CISO team?
- If one system were compromised today, how far could an attacker move before we stopped them?
- How long would it take us to contain that attack without shutting down the business?
- What is our Minimum Viable Digital Enterprise, the part of the business that must remain unaffected, and have we tested that it does?
- Are we measuring breach readiness the same way across every business unit, acquisition, and supplier?
A 5-Point Breach Readiness Checklist for the CISO
- Baseline the estate. Map every asset, identity, and communication path. Keep the map current as things change, not once a year.
- Govern every change. No new workload, firewall rule, service account, or supplier connection goes live without a security review and a named owner.
- Contain by design. Place the crown jewels in breach-ready zones with least-privilege conduits, so a compromise stays in the microsegment where it started.
- Rehearse the breach. Run drills that prove you can isolate an affected zone in minutes while the business keeps running.
- Show the board your rose. Replace compliance percentages with one visual of preventable exposure and how fast it is falling.
Call to Action
Nightingale proved that most of what killed soldiers was preventable, and that leaders act once they can see it.
Most of what breaches enterprises today is preventable too. The attacks are rarely new. The speed is.
If you are a CISO, take this checklist to your next leadership meeting and draw your rose.
If you are a board member, ask the questions above, and do not accept a heat map as the answer.
If you are the CEO, make change governance a business discipline, not an IT ticket.
So here is my question for you. If Nightingale walked through your digital enterprise today, what would her rose show?
The lamp gave comfort. The data changed the system. You can do both. Begin with one critical system this week. Microsegment it. Put it in a zone that denies the next attacker any elbow room.
Prove that it stays unaffected. Then repeat.
That is how you build breach readiness.
Connect with our team to discuss how you can identify unmanaged exposure, contain lateral movement, and strengthen breach readiness across your enterprise.
