The true value of cybersecurity investments lies not only in the technologies deployed, but also in how effectively they are managed. When assessing an organization's cybersecurity posture, the first consideration is often the technology it uses. Firewalls, endpoint protection solutions, threat monitoring systems, and other security investments are essential components of corporate security. But does having advanced security technologies necessarily mean that an organization is sufficiently protected? I believe the answer lies not only in which technologies are implemented, but also in how they are managed and how effectively they are integrated into organizational processes. My experience in IT infrastructure management, information security, and information systems auditing has reinforced my view that cybersecurity cannot be achieved through technical solutions alone. It requires a comprehensive approach that incorporates risk management, the human factor, operational processes, and continuous improvement. For this reason, I believe cybersecurity should be viewed not simply as a technological investment, but as an integral part of an organization's management approach and operational maturity.

Security Technologies Matter, but So Does Their Effectiveness

An organization may have an advanced firewall in place. However, if security rules are not regularly reviewed, unnecessary access permissions are not removed, or critical configuration changes are not properly controlled, the level of protection may gradually weaken. Similarly, a centralized security monitoring system may collect thousands of security events. Yet, if there are no clearly defined priorities, responsibilities, or incident response procedures, the operational value of that information may remain limited. The objective here is not to question the importance of investing in security technologies, but rather to evaluate whether those investments actually deliver the expected security benefits. The existence of a security control does not necessarily mean that it operates effectively under all circumstances. Proper system configuration is essential, but so are continuous monitoring, regular testing, and adapting security controls to evolving risks. In my view, a strong cybersecurity approach does not end when technology is deployed. Its real effectiveness depends on how well that technology continues to be managed in alignment with organizational needs.

Security Risks Do Not Come Only from External Threats

When discussing cybersecurity, attention often focuses on external attacks. However, internal processes, user access rights, and day-to-day operations can also introduce significant information security risks. For example: Are access permissions from previous roles regularly reviewed when employees change positions? Is access to systems and applications promptly revoked when employees leave the organization? Are privileged accounts properly controlled, with their activities logged and available for review when necessary? Are critical systems merely backed up, or are those backups also validated through regular recovery testing? These questions may appear to relate to routine IT operations. However, the answers reveal important aspects of an organization's security maturity. I consider backup management a particularly relevant example. Successfully completing a backup is certainly an important control. However, organizations also need to verify that critical systems can be restored within acceptable recovery time and data loss objectives. Therefore, we should evaluate not only whether security controls exist, but also whether they deliver the intended results. The question "Do we have the necessary controls?" is important. But so is "Are those controls actually effective?"

ISO 27001: Beyond Certification Toward Sustainable Security

One of the key strengths of ISO/IEC 27001 is that it approaches information security as a systematic management discipline rather than a collection of isolated technical activities. Risk assessment, the selection of appropriate controls, clearly defined responsibilities, performance evaluation, and continuous improvement are fundamental elements of this approach. However, I believe there is an important distinction to consider in practice. Having a documented procedure does not automatically mean that it is effectively followed in daily operations. Likewise, closing an audit finding does not necessarily guarantee that the corrective action will remain effective over time. For this reason, information security management systems should not be treated merely as documentation or certification exercises that receive attention during audit periods. In a well-established security management system, security considerations become part of everyday decisions, whether creating a user account, assigning access rights, implementing system changes, deploying new applications, or engaging with third-party vendors. ISO 27001 certification is an important organizational achievement. However, certification does not mean that all security risks have been eliminated. In my opinion, real success lies in making the practices established for compliance a natural part of daily operations. A strong security culture is demonstrated not only by being prepared for audits, but by maintaining the same discipline even when no audit is taking place.

Security and Business Continuity Must Be Considered Together

In organizations where production and operational continuity are critical, cybersecurity decisions must also account for their potential impact on business processes. Addressing an identified security vulnerability may be a priority. However, the potential effects of applying an update on production systems, business applications, or interconnected services must also be considered. This does not mean that security measures should be postponed. Instead, it highlights the importance of a controlled implementation process based on risk severity and business requirements. Change planning, testing, obtaining the necessary approvals, and preparing rollback procedures are all essential elements of this approach. I believe one of the key responsibilities of effective IT management is to make informed, risk-based, and sustainable decisions that balance security requirements with operational continuity. After all, protecting systems is not the only objective. Organizations must also ensure that their business processes can continue reliably.

The Future of Cybersecurity: Automation and the Human Factor

As cybersecurity technologies evolve, the volume of available data and the range of security events that can be monitored continue to expand. AI-powered analytics and security automation offer significant opportunities to accelerate threat assessment and streamline certain incident response activities. However, the effectiveness of automation also depends on proper design and management. Treating every security alert with the same priority can make it difficult for teams to focus on critical risks. At the same time, automated responses implemented without adequate control mechanisms may negatively affect business continuity, particularly when false positives trigger unnecessary actions. For this reason, I believe that simply collecting more data or automating more processes will not be sufficient for the future of cybersecurity. What truly matters is the ability to turn data into meaningful insights, prioritize the right risks, and manage automated responses through appropriate control mechanisms. Rather than viewing artificial intelligence and automation as complete replacements for human expertise, I consider them tools that can strengthen the decision-making capabilities of security teams. Especially when automated actions may affect critical systems, it is important to establish clear authorization boundaries, ensure that actions remain traceable, and incorporate human approval where appropriate.

Conclusion: Cybersecurity Requires Continuous Management

A strong technological infrastructure is an essential foundation for cybersecurity. However, an organization's security maturity cannot be measured solely by the sophistication of the technologies it uses. The ability to assess risks accurately, evaluate the effectiveness of controls, consistently apply security processes, and adapt to evolving threats is equally important. In my professional approach, I view cybersecurity not as a project that can be completed and set aside, but as an ongoing responsibility that must evolve alongside organizational needs. Threats change, technologies advance, and business processes transform. Cybersecurity strategies must evolve accordingly. I believe the true strength of an organization's cybersecurity posture lies not only in its ability to prevent threats, but also in its ability to understand risks, validate controls, and continuously improve.