What a Cancer Diagnosis Taught a Security Leader About Risk

A routine physical that included a PSA blood test led a risk management leader to a stage-three prostate cancer diagnosis. He had no symptoms and no known family history of the disease.

The leader described the diagnosis as a personal account, not medical advice or a recommendation about PSA testing or treatment. He used the experience to discuss how security leaders prepare for risk and support people under pressure.

In cybersecurity, leaders review controls, supplier assurances, technology settings and management recommendations. He compared that process with a patient’s right to ask clinicians about treatment options, assumptions and possible consequences. He stressed that personal health and cybersecurity are different areas.

The diagnosis changed how he viewed risk appetite. Security leaders can assess threats at an organizational level, but decisions become harder when the risk affects their own health or the people close to them. Information may be incomplete, while emotions are high.

Before beginning radiotherapy, he focused on fitness, diet, rest, meditation and mental preparation. He also reassessed his use of alcohol and caffeine. The 37-week treatment became a series of daily goals, with an aim to be in the best condition possible for each session.

That routine gave him structure during a period when he felt he had limited control. He described resilience as dependent on routines, manageable goals, supportive relationships and time to recover. When his body indicated that he was doing too much, he changed his approach.

He compared that experience with the pressure on cybersecurity teams to work overnight during incidents or remain available at all times. In his view, a security function cannot maintain resilience when employees have little chance to rest. Recovery, boundaries and support should form part of ongoing performance expectations.

The leader disclosed his diagnosis publicly to raise awareness. Some people did not know how to respond, while others offered support. He connected those reactions with workplace attitudes toward security concerns. Organizations may ask employees to report incidents early and seek help, while cultures that expect leaders to appear certain can discourage openness.

People undergoing cancer treatment may need time off, flexible hours, changed responsibilities, regular check-ins, occupational health assistance or employee support programs. The leader maintained that employees should decide what personal information they disclose, when they disclose it and who receives it.

He cautioned against treating illness as a management problem that can be solved through willpower. He identified preparation, curiosity, trusted expertise, clear communication and the ability to adapt as habits that can help risk leaders respond to uncertainty, while acknowledging that they cannot control every outcome.

The account called for more open discussion of prostate health among men. People concerned about their personal risk should consult qualified health professionals about their circumstances and what PSA testing may reveal.