ISSA-LA Security Summit 2026

Cybersecurity teams are working harder than ever, but many organizations are not becoming safer in proportion to that effort. Security programs often slow down under the weight of their own management habits: recurring meetings that do not produce decisions, dashboards that create noise instead of action, approval chains that diffuse ownership, overlapping tools and controls, stale exceptions, unclear accountability, and backlogs that quietly normalize risk. From the outside, this activity can look like maturity. From the inside, it often feels like exhaustion.
 
Based on Dr. Jason Edwards’ book, Killing the Security Bureaucracy: How Cyber Leaders Cut Waste, Restore Focus, and Reduce Risk, this session examines how well-intended cybersecurity programs become crowded, slow, and difficult to execute. The talk is not an argument against governance, compliance, rigor, or process. It is an argument against the low-value friction that grows when security leaders fail to distinguish between discipline and bureaucracy. Real discipline helps teams make better decisions, clarify ownership, reduce exposure, and act with confidence. Bureaucracy consumes time, spreads accountability too thin, and creates the appearance of control without enough actual risk reduction.
 
Attendees will learn how to identify the most common sources of security bureaucracy, including meeting overload, reporting churn, approval theater, tool and control sprawl, policy bloat, exception debt, backlog growth, false urgency, and cross-functional ownership gaps. The session will also show leaders how to simplify without weakening the program: shortening decision paths, preserving the controls that matter, cutting decorative metrics, assigning clear owners, making exceptions time-bound, and using a practical 90-day cleanup model to reduce drag.
 
The goal is not a looser security program. The goal is a sharper one. Cyber leaders should leave with a practical framework for removing waste, restoring focus, protecting team attention, and improving risk reduction without sacrificing governance, accountability, or discipline.