One of the most thought-provoking sessions I attended, so far, at the Gartner® Security & Risk Management Summit this week wasn’t led by a security practitioner, analyst, or technology vendor.
It was led by José Andrés.
The renowned chef, humanitarian, and founder of World Central Kitchen spent the session sharing stories from restaurant kitchens, disaster response efforts, and some of the most challenging environments in the world. While the subject matter had little to do with cybersecurity on the surface, many of the leadership lessons felt surprisingly relevant to the challenges security leaders face every day.
Throughout the discussion, one theme surfaced again and again: success is rarely determined by how well you execute the plan. It’s determined by how well you adapt when the plan no longer applies.
In a world where AI is accelerating change, threats are evolving faster than ever, and organizations are being asked to do more with limited resources, that message resonated deeply.
Master the Fire First
One of Andrés’ earliest lessons came from his father while learning to cook over an open flame.
Everyone wanted to stir the pot. Everyone wanted to control the ingredients. But none of that mattered until you learned to control the fire.
“Master the fire first.”
It’s a simple lesson, but one that immediately made me think about cybersecurity.
Security teams spend a tremendous amount of time chasing emerging threats, new vulnerabilities, evolving compliance requirements, and now the rapidly expanding impact of AI. Yet many organizations still struggle to fully understand the environment those risks exist within.
Before you can effectively prioritize risk, validate exposure, or respond with confidence, you need a clear understanding of the underlying environment.
You need to master the fire.
In cybersecurity, that means understanding the assets, pathways, dependencies, and controls that make up your hybrid environment. Without that foundation, every decision becomes more difficult and every response becomes more reactive.
Stop Waiting for the Perfect Plan
Andrés returned repeatedly to a simple truth: no matter how much planning you do, eventually something will happen that wasn’t in the plan.
Security leaders know this better than anyone.
Every organization has playbooks, runbooks, policies, and incident response plans. They’re essential. But the next major attack, business disruption, AI-driven threat, or operational crisis will almost certainly introduce variables nobody anticipated.
One observation from the session stood out to me. We spend a lot of time teaching people how to follow the plan. We spend far less time teaching them how to adapt when the plan breaks down.
The teams that perform best aren’t always the ones with the most detailed playbooks. They’re the ones that can quickly assess new conditions, make informed decisions, and adjust course when necessary.
Adaptability isn’t a backup plan. Increasingly, it’s becoming a core capability.
Use the Ingredients You Already Have
One of the most practical lessons from the keynote centered around resourcefulness.
In Andrés’ world, if there isn’t enough food, you add more rice. You work with the ingredients you have. You don’t stop moving because conditions aren’t perfect.
That mindset felt particularly relevant for cybersecurity teams.
Most organizations aren’t struggling because they lack security tools. They’re struggling to get maximum value from the tools, data, and expertise they already possess.
Security leaders face the same challenges every year: budget pressure, staffing constraints, competing priorities, and a growing list of responsibilities. Success often comes less from acquiring another platform and more from making better use of existing investments.
That may not be as exciting as deploying a new technology, but it’s often where the biggest gains are found.
The most resilient organizations learn how to create advantage from what they already have.
Make Adversity Work in Your Favor
One of my favorite moments came when Andrés described burning onions while cooking.
His response?
“Let’s call it burnt onion soup.”
The audience laughed, but the lesson landed.
Unexpected events happen. Mistakes happen. Conditions change.
The best leaders don’t spend valuable time wishing circumstances were different. They accept reality, adjust, and move forward.
Cybersecurity leaders face this challenge constantly.
A critical vulnerability emerges without warning. An acquisition introduces new risk. A cloud deployment changes architecture overnight. AI creates both new opportunities and new concerns at the same time.
The organizations that navigate these moments most effectively aren’t necessarily the ones that avoid adversity. They’re the ones that respond quickly and turn disruption into momentum.
The Worst Decision Is the One You Don’t Make
Perhaps the most powerful lesson of the morning came from Andrés’ experience responding to humanitarian disasters.
When disaster strikes, there is never perfect information. There is never complete certainty. There is never enough time.
Yet decisions still have to be made.
As Andrés put it:
“The worst decision is the one you don’t make.”
That lesson resonates deeply in cybersecurity.
Too often organizations become trapped waiting for more information, more validation, more approvals, or more certainty. Meanwhile, threats continue evolving and attackers continue moving.
AI is only accelerating this reality.
Security leaders are increasingly being asked to make decisions in hours rather than weeks. Perfect information is becoming a luxury. The ability to act decisively is becoming a competitive advantage.
The organizations that succeed won’t be the ones that know everything. They’ll be the ones that know enough to move forward with confidence.
Finding Clarity in the Middle of Chaos
World Central Kitchen has delivered millions of meals in some of the most challenging environments on earth. According to Andrés, success often comes from seeing possibilities where others see obstacles.
In Gaza, they partnered with existing restaurants. In stadiums, they used kitchens that were already there. Instead of starting from scratch, they looked at what was available and found ways to build on it.
The same mindset applies to cybersecurity.
The strongest security teams are not the ones drowning in the most data. They’re the ones that can quickly identify what matters. They understand which exposures create real business risk, which vulnerabilities are actually reachable, and where to focus limited time and resources.
In a world overflowing with alerts, dashboards, and findings, clarity becomes a competitive advantage.
The Next Security Challenge Is Already Taking Shape
Toward the end of the discussion, Andrés shifted to a topic few expected: food security.
He argued that food, water, and supply chains are national security issues that deserve far more attention. His point wasn’t really about agriculture. It was about recognizing tomorrow’s challenges before they become today’s crisis.
That message feels especially relevant in cybersecurity.
The next major disruption may not look anything like the last one. Just as food systems, energy infrastructure, and supply chains have become security concerns, AI is rapidly reshaping how organizations think about cyber risk, resilience, and operational readiness.
The leaders who will be best positioned for what’s next are the ones asking difficult questions today, before everyone else starts asking them tomorrow.
What emerging risk deserves more attention now?
A Lesson Worth Taking Home
As I left the session, I found myself thinking less about food and disaster relief and more about the challenges security leaders face every day.
The pace of change is accelerating. AI is reshaping both attack and defense. Teams are being asked to make decisions faster, often with incomplete information and limited resources. In many ways, cybersecurity has become an exercise in operating through uncertainty.
That’s why Andrés’ message resonated so strongly.
The goal isn’t to predict every challenge. The goal is to build organizations that can respond when the unexpected happens.
Master the fire first. Understand the environment. Trust your people. Act decisively.
Then adapt to whatever comes next.
