Wolf&Grayson EditorialSecurity roadmaps are where good intentions go to die. Most run three to five years, cross a dozen jurisdictions, and collide with regulatory change before the first phase closes. Then the plan quietly becomes a document nobody references, and the security function loses the one factor that makes it effective at the executive level: credibility. Kris Boike, who leads cybersecurity at a global law firm, has a sharper read on why this happens. The roadmap fails not because the threat landscape moved, but because it was built as a project schedule instead of a business plan. In a professional services firm, where client confidentiality is contractual, where legal obligations differ by jurisdiction, and where continuity of service is the product itself, that distinction decides whether the program survives its own first year.
Sequencing Is The Strategy
Boike builds the roadmap around a risk-based business plan that ties three things together: protection of client confidentiality, contractual legal obligations, and continuity of legal services. Those connect directly to investment priorities. The sequencing follows from that logic rather than from vendor cycles or audit deadlines. Foundational work comes first, identity, asset visibility, and data governance, and only then does the program expand into data loss prevention, third-party assurance, and secure AI adoption. The order is not arbitrary. Deploy data loss prevention before you know where your data lives and you have purchased an expensive control that cannot see much of what it is supposed to protect.
The discipline shows in what each initiative must carry. “Each initiative needs an accountable owner, funding, dependencies, and measurable outcomes, with priorities shaped by client commitments and jurisdiction-specific requirements,” Boike says. Four attributes, and most roadmaps in circulation have one or two. An initiative without a named owner belongs to the chief information security officer (CISO) by default, which is how security programs become bottlenecks. An initiative without mapped dependencies gets accelerated on request, then stalls because the prerequisite was never built. Leadership revisits the roadmap as threats and business needs change, and Boike makes a point of the part most firms leave implicit: leadership explicitly decides which residual risks the firm accepts. Risk acceptance that is never spoken aloud is not acceptance. It is exposure with no owner.
Credibility Survives Change, Promises Do Not
The common failure mode when regulation shifts mid-execution is defending the original plan. Boike inverts it. The roadmap is anchored to durable business outcomes, client confidentiality, resilience, and demonstrable compliance, while the delivery plan is allowed to move. Those outcomes do not expire when a new requirement lands. The delivery sequence underneath them always will. When requirements change, Boike and her team work with key firm stakeholders to assess the impact on controls, deadlines, resources, and existing commitments, then bring explicit tradeoffs to firm leadership for approval, with enterprise and technology risks factored into the conversation.
The mechanics that keep this honest are accountable owners, quarterly reviews, and measurable milestones, which together expose slippage early rather than at the point where it becomes a disclosure problem. Boike is direct about where authority comes from. “Credibility comes from explaining what changed, why priorities moved, and what risk remains, rather than promising that the original plan will never change.” That is the harder discipline, because the first version of the plan is the one leadership remembers and the one a CISO is tempted to protect. The same approach carries into timeline pushback. Boike presents practical options, phased delivery, additional resources, or interim controls, with costs and risk tradeoffs made explicit, and she makes clear what the delay itself creates in enterprise and technology risk. Sequencing and scope can move. The controls most critical to client confidentiality, regulatory obligations, and business continuity do not. And when a material security priority is deferred, the deferral comes with an accountable business owner, documented risk acceptance, and a firm date for reassessment. No verbal agreements and no unfunded promise to revisit it later.
Personal Liability Changes The Calculation
CISOs now carry personal liability alongside tightening regulation, and that reality is reshaping how roadmaps get constructed. Boike does not treat it as a burden to be managed around. “The potential for personal liability reinforces my focus on a defensible roadmap, with clear priorities, accountable ownership, and evidence that material risks are being addressed.” Defensibility becomes a design constraint, which produces better programs. She sequences mandatory obligations and the most consequential exposures first, alongside the foundational controls that later improvements depend on. Governance, accurate reporting, and documented escalation are built in from the outset, so leadership understands funding gaps and the consequences of deferrals at the moment those decisions are made rather than during an incident review.
For boards and chief executives, Boike’s guidance points at a shift in how the next two to three years should be governed. Roadmaps become adaptable business plans with priorities tied to client trust, operational resilience, and measurable risk reduction. The specific capacity she wants built is the ability to reassess AI adoption, balancing internal labor force decisions against AI usage, AI third-party dependencies, and overall third-party and four-party dependencies, along with regulatory obligations, without restarting the program every time. That requires sustained investment in foundational controls, clear executive ownership, and flexibility in funding and delivery. Her sharpest correction is aimed at how directors read security reporting. “The board’s role is to set risk appetite, resolve investment tradeoffs, and hold leadership accountable for outcomes, not simply completion of projects.” A board tracking completed milestones can approve a program that finishes everything it started and still leaves the firm’s most consequential exposures untouched. Risk appetite is the only lens that catches it.
Follow Kris Boike on LinkedIn for more insights on cybersecurity leadership, risk governance, and board-level decision-making.
