Defensive agility: seven habits for faster response

When a vulnerability advisory lands, the speed of an organization's response depends less on the sophistication of its tools than on whether anyone already knows who patches, who tests, and who can take a system offline. A set of seven recommendations, drawn from interviews with security leaders and engineers at Infosys, Deloitte, CompTIA, Microsoft, Black Kite, Softline Solutions, and ClearStack Advisory, lays out how teams can build what the practitioners call defensive agility: the capacity to change course quickly without disrupting the business.

The advice covers architectural choices, automation boundaries, and the unglamorous work of rehearsing bad days. Each recommendation comes from a named practitioner, and several describe how their own organizations or clients handle the tension between speed and control.

Start with a zero-trust baseline

Anant Adya, an executive vice president at business and technology consulting firm Infosys, recommends beginning with a zero-trust approach that continuously verifies access across users, devices, and applications. He argues that such a strategy must be woven into the technology framework and the business lifecycle, not bolted on as a separate security initiative.

Adya describes security as needing to move from a protective afterthought to a business accelerant as enterprises adopt AI, modernize applications, and operate across distributed environments. He says that integrating zero trust into daily operations and AI workflows can help organizations adapt to threats while also innovating faster, integrating acquisitions more securely, and scaling globally without accumulating architectural or operational debt.

“As attack surfaces expand, organizations must prioritize risk quantification and identify vulnerabilities to strengthen their security posture and improve their ability to recover from attacks that are inevitable.”

— Anant Adya, executive vice president at Infosys

Modernize and rationalize the security stack

Sharon Chand, cyber defense and resilience leader at Deloitte, says many large organizations struggle to keep pace because their systems are incredibly complex or filled with old software, custom code, and a mixture of disconnected security tools. That complexity can hinder containment speed.

Chand advises CISOs to evaluate existing infrastructure and technologies and consider how the organization currently responds to threats. She also recommends streamlining operations into a more integrated system.

“Security organizations must also have access to AI-driven systems to detect and automate response to machine-speed attacks at the pace of adversaries,”

— Sharon Chand, cyber defense and resilience leader at Deloitte

Automate only what is reversible

Randy Gross, CISO at training and certification organization CompTIA, recommends deciding in advance which defensive actions are safe enough to happen without placing a human in the middle. Locking an account, killing a session, or isolating a device, he says, should already be automated when confidence is high and the action is easy to reverse.

Gross warns against equating a strategy review with operational governance. He advises reviewing strategy at least quarterly, but he says the guardrails around automated agents must be continuous and automated because permissions and integrations may change frequently in a medium-to-large enterprise. The CISO and team should also revisit strategy when enough changes have accumulated that risk has changed materially.

“The strategy shouldn’t be just to put more AI in the SOC; it should be to reduce the latency between finding a threat and doing something useful about it.”

— Randy Gross, CISO at CompTIA

Trade higher walls for structural resilience

Jatin Chopra, a senior software engineer at Microsoft, says defensive agility requires an enterprise system with the architectural capacity to absorb, isolate, and adapt to anomalous behavior without relying on human intervention. He describes this as a transition from static perimeter defense, where you build higher walls, to dynamic, structural resilience where the environment itself constantly shifts to restrict threat propagation.

Chopra says that codifying defensive protocols into the architecture, rather than enforcing them through a review board, lets engineering teams maintain high developer velocity while inherently restricting the attack surface. In his view, it turns security from a workflow tax into an automated platform capability.

Watch for bureaucracy that stalls action

Bob Maley, CISO at security-as-a-service provider Black Kite, says security strategy should stop being an annual document process and start being a loop that runs continuously using data the organization trusts. Decisions, he recommends, should feed to someone who actually has the authority to make rapid critical choices.

Maley points to the pace of attackers as the reason. A ransomware crew, he says, does not wait for a quarterly review when a new vulnerability opportunity appears on a Friday afternoon.

“If your defense team needs a steering committee before it can react, the gap between their tempo and yours is where the breach lives.”

— Bob Maley, CISO at Black Kite

Let automation clear the path for judgment

Timur Rakhmatullin, senior software engineer at Softline Solutions, a consulting and social media marketing services provider, observes that most security teams he has worked with build static defenses. They set up rules, configure alerts, and write runbooks, but then something happens that does not match the runbook and everyone freezes.

Rakhmatullin runs automated security scans across 30-plus repositories using in-house tools. The scans catch vulnerabilities, license issues, and other gaps. The key part, he says, is that any engineer can override a scan result, escalate it, or reclassify a finding in minutes.

“Humans make the judgment calls.”

— Timur Rakhmatullin, senior software engineer at Softline Solutions

Rehearse the ugly scenarios

Chris McGlasson, founder of ClearStack Advisory, a fractional executive technology and AI strategy firm, suggests rehearsing difficult scenarios before they happen. Teams should know who patches, who tests, who talks to the business, and who has the authority to take something offline at 2 a.m.

McGlasson recommends writing it down and running it twice a year. Teams that do so, he says, treat incident response like a fire drill. He adds that many CISOs risk disaster because they treat security like a research project instead of a fundamental initiative.

As an example, McGlasson points to a severe, ongoing security crisis affecting Citrix NetScaler ADC and NetScaler Gateway appliances, which he describes as a mass wave of critical zero-day exploits. According to McGlasson, Citrix immediately warned IT administrators to patch their systems at once, and the US Cybersecurity and Infrastructure Security Agency gave federal agencies a three-day patch window while other organizations were left to create their own timeline.

McGlasson says the shops that handled the event well were not always the ones with the best tools.

“They were the ones that already knew who patches, who tests, and who calls the shots before the advisory ever dropped.”

— Chris McGlasson, founder of ClearStack Advisory

He adds that agility is a muscle, built through repetition.

The numbers behind the advice

The recommendations include a handful of specific figures and timeframes that illustrate how the practitioners think about pace and scale:

• 30-plus repositories scanned by automated security tools at Softline Solutions
• at least quarterly strategy reviews recommended by CompTIA's Randy Gross
• twice a year incident-response rehearsals recommended by ClearStack Advisory's Chris McGlasson
• three-day patch window given to federal agencies by the US Cybersecurity and Infrastructure Security Agency during the Citrix NetScaler episode

What this means for security teams

The advice, taken together, points to a common pressure: the interval between discovering a threat and acting on it is where many defenses fail. The practitioners describe automation, zero trust, and rehearsal not as separate projects but as ways to shrink that interval. For businesses, the implication is that tools alone may not close the gap; the organizational questions of authority and rehearsal appear repeatedly. This suggests that teams reviewing their own readiness might start by mapping who can make critical decisions quickly and whether automated responses are bounded by reversible actions. It could also mean that the value of a security strategy lies less in the document and more in how often it is exercised.