What Cybersecurity Leaders Can Learn from Naval Operations

Cybersecurity leaders operate in environments where complex technology, evolving threats, and critical decisions intersect. Organisations must manage uncertainty, maintain situational awareness, and ensure that the right information reaches the right people at the right time.

These challenges are not unique to cybersecurity.

In September 2026, I participated in the Royal Canadian Navy's Canadian Leaders at Sea (CLaS) program aboard HMCS Max Bernays, an Arctic and Offshore Patrol Ship. Invited by the Commander of the Royal Canadian Navy, I spent several days sailing from Prince Rupert to Vancouver, observing naval operations and learning from members of the Ship's Company.

As RAdm Jason Armstrong, Chief of Naval Capability, explains: "Modern naval operations remind us that resilience is fundamentally a human enterprise, enabled by technology but built on trust, disciplined communication, and empowered expertise."

Although naval operations and corporate cybersecurity are very different environments, my time aboard the ship showed me how these principles apply to managing technology and risk.

Communication Must Be an Operational Discipline

One of the most striking aspects of my experience was the Navy's approach to communication.

Aboard a naval vessel, information must move accurately and efficiently between people performing different responsibilities. Communication is structured so that information is delivered and received consistently, reducing ambiguity and supporting timely decisions.

In corporate environments, we often talk about communication, but the Navy demonstrates what happens when communication becomes an operating discipline rather than simply a leadership aspiration. Information needs to be concise, understood, and actionable.

This principle is particularly relevant to cybersecurity.

During a security incident, technical teams may be investigating suspicious activity while executives assess operational implications and determine whether customers, regulators, or other stakeholders need to be informed.

If those groups communicate inconsistently, valuable time can be lost clarifying information, responsibilities, and priorities.

Organisations should establish clear reporting structures, escalation procedures and decision-making responsibilities before an incident occurs. Technical findings must be communicated in ways that allow business leaders to understand their significance and act appropriately.

Effective communication is not simply about sharing more information. It is about ensuring that the information being shared supports informed decisions.

Strong Leadership Depends on Trusting Expertise

A modern naval vessel is a complex operating environment. Its successful operation depends on people with specialized knowledge working together toward a common objective.

No single individual possesses every skill required to operate the ship.

What impressed me was the professionalism of the Ship's Company and the degree of trust required across different roles. Leaders must understand their responsibilities while recognizing and relying on the expertise of others.

RAdm Armstrong describes the importance of that trust: "More information isn't necessarily what enables us to achieve the mission. It's more important to get the right information to the right person, with the authority and confidence to act. In the RCN, sometimes that person is a junior sailor. Leadership at sea means building the expertise and trust within the team that allows our sailors to make the right call."

The same principle applies to cybersecurity governance.

Boards and executive teams face increasingly complex decisions involving cybersecurity, artificial intelligence, operational technology, critical infrastructure and geopolitical risk. Directors cannot reasonably be expected to possess deep technical expertise in every area.

Their responsibility is to ensure appropriate expertise is available, ask informed questions, and establish governance structures that support effective oversight.

Technical specialists, in turn, need clear authority, defined responsibilities, and opportunities to communicate risks without unnecessary organizational barriers. They should understand which decisions they are authorized to make independently and which require escalation.

Cybersecurity becomes more effective when leadership provides direction and accountability while allowing qualified professionals to apply their expertise.

Situational Awareness Requires People, Processes and Technology

Spending time on the bridge of HMCS Max Bernays was a particular highlight.

Observing how the team worked together, how responsibilities were understood, and how information moved between personnel demonstrated the importance of maintaining a shared understanding of the operating environment.

I was also fascinated by the technology aboard the ship and the integration of communications, sensors, information systems, and human expertise.

Technology provides important capabilities, but its value depends on how effectively people interpret and act on the information available.

For cybersecurity leaders, this distinction is critical.

Organisations invest in security monitoring, threat detection, vulnerability management, and other technologies to improve visibility into their environments. However, collecting information is only one part of maintaining situational awareness.

Security teams must be able to distinguish meaningful risks from routine activity, understand potential operational consequences, and communicate findings to the appropriate decision-makers.

Leadership must also recognize that situational awareness extends beyond technical systems. Business dependencies, third-party relationships, workforce capabilities, and operational priorities all influence an organization's exposure to cyber risk.

A useful question for executives is not simply whether their organization has security tools in place, but whether those tools, processes, and people collectively provide the information needed to make sound decisions.

Leadership Lessons Beyond the Ship

The Canadian Leaders at Sea program gave me a deeper appreciation for the professionalism, technical expertise and teamwork required in modern naval operations.

I am grateful to the Royal Canadian Navy for the opportunity to participate, and particularly to Commander Ryan Bell and the entire Ship's Company of HMCS Max Bernays for welcoming us aboard and generously sharing their knowledge and experiences.

Ultimately, what I took away from my time aboard HMCS Max Bernays is that resilience is not built through technology alone. It depends on capable people, clear communication, trusted leadership, and the ability to make informed decisions under pressure.

For organizations navigating an increasingly complex cybersecurity landscape, those principles are just as important in the boardroom as they are at sea.