Brian Hackney on speed versus safety, orphaned automations, and why less oversight works

First Principles is a conversation series where I ask engineering and security leaders the questions that usually go unasked: how their teams actually behave, what they can't see, and what they've learned the hard way.

In this conversation, Brian and I talked about what government work taught him about rules and risk, what changes when a company outgrows its own security, who owns an automation after the person who built it leaves, and why he believes self-service and less oversight make security stronger.

Watch on YouTube

Key moments

1. Two cultures, two sets of rules

   In government, information is separated into tightly controlled environments, sometimes physically cut off from each other. In business, losing information costs money but rarely carries national security stakes. That opens the door to more velocity, and more risk, and security teams have to learn to adjust to that balance.

   Government culture and corporate culture are day and night differences in how human behavior adjusts to culture.

2. When a company outgrows itself

   As a company grows into new regulatory requirements or investor expectations, the way it worked before stops being enough. The adjustment can be jarring, and security isn't the only part that has to bend: IT and the business have to adjust too. He sees it as a healthy step that moves security from something negotiated to something that comes first.

   What was optimal before is no longer optimal.

3. Who owns an automation when its builder leaves

   This problem existed with service accounts long before AI. An automation runs quietly until its builder leaves, and then a hidden manual step, such as a key or a particular process, turns out to be what kept it alive. His answer: guardrails on every script and automation, oversight above the individual at the team level, and alerts that survive a person leaving or a team changing. He also sees AI helping by spotting the difference between normal and new behavior and surfacing it to a human.

   Someone would leave, and the company would find out too late that there were manual processes necessary to keep that automation running.

4. Letting people bypass a security rule

   Giving people options works on the surface, but underneath it is a form of oversight that keeps security out of the business's way while keeping the company safe. The hard part is getting the details right, such as who needs read access and who needs more.

   I believe the future is going to show that self-service is how cyber has to run.

5. What dashboards don't show you

   He leans toward fewer metrics and less oversight. His job is to make sure his team stays within the lanes of the road, and to step in when someone drifts, while leaving room for his people to optimize their own work.

   The minute you start having too much oversight, you choke out innovation.