Building a security capability into a business

A four-market group with no coherent, group-wide cybersecurity capability, at exactly the point where customer demand and regulatory pressure made one strategically necessary. Nothing protected the group's own operations consistently, and there was nothing to sell to customers asking for security services.

The opportunity was to build a single group-wide capability, the standards and the plumbing that would let the group deliver security the same way across all four markets, and then sell products and services on top of it. The capability was the enabler. The revenue was the mission it served.

Each market had its own currency, its own regulator, its own customer base and its own technical maturity. The four wanted materially different amounts of the capability: one wanted all ten services, another six, another five, another two.

Building each market its own version would have splintered the design into four divergent builds that could never be governed or scaled. I resolved it architecturally instead: build all ten services once, into one shared design, then let each market switch on only what it needed. No market lost what it wanted. None carried what it did not use. More mature markets could turn on extra services later with no rebuild.

With nothing in-house and a tight launch window, the central decisions were sourcing decisions: build or buy, and which vendor to standardise on. Every option was scored against independent analyst positioning, commercial model, operational fit, and regulatory acceptability in each market assessed with legal counsel.

The highest-scoring option acceptable across all four markets won. Where an option failed anywhere, it was ruled out everywhere. Each decision and its rationale went to a review board and finance committee in writing. Choices leaders can interrogate are choices they will stand behind.

The frameworks, standards and governance I set were adopted as the group's operating baseline for its security business: the reference the group kept delivering and extending against after I left.

A capability that survives the person who built it, and keeps generating revenue, is the strongest evidence it was built as a foundation rather than a one-off.