The difference between a security project and a security organisation

When the person who started it leaves, 67% of security programmes fail (Gartner 2024). This underlines the importance of a solid governance structure rather than a series of standalone projects. Where projects deliver temporary solutions, a security organisation is built for lasting protection. The difference does not lie in technical detail, but in the way you govern your security policy. That calls for an approach that goes beyond implementing technology.

What organisations get wrong

Projects have an end point

Security projects are often aimed at specific goals, such as implementing a new system or fixing a vulnerability. These projects have a clear beginning and end. Although they are valuable, they offer no lasting solution. Once a project is completed, there is often no one left to take ownership of maintenance and further development. This can lead to outdated systems and new risks.

An organisation has an owner

A security organisation is more than a collection of projects. It requires an owner who is accountable for policy and long-term strategy. This means there is continuous attention to new threats and that the organisation responds to change. An owner makes sure the organisation can adapt and improve, even when key people leave. That is what separates temporary solutions from durable security.

How it works instead

Governance is essential

Effective governance makes security efforts durable and consistent. Without good governance, projects can quickly lose their effectiveness once the people who started them leave. This requires clear roles, accountabilities and a vision that reaches beyond individual projects.

The risks of failing programmes

When security programmes fail, organisations become exposed to attacks and data breaches. The loss of the person who started it can lead to a lack of continuity and focus, undoing results achieved earlier. This underlines the need for a structural approach.

Strategic governance

A governed security organisation can respond quickly to changing threats and technologies. This calls for an owner who is not only technically capable, but can also think and act. Only then can an organisation arm itself effectively against future challenges.

What it delivers

Governance structure. Put a clear governance structure in place that reaches beyond individual projects. This prevents your security efforts from depending on specific individuals.

Ownership. Appoint an owner for your security organisation. This supports continuity and provides a focus that protects the organisation against future threats.

Governance. Focus on governance to make your security organisation agile and future-proof. This makes it possible to deal effectively with new risks and technologies.

A durable security strategy takes more than projects; it takes vision and governance. Read more about our approach.