Every control decision waits for judgement. The answer is to keep the judge and end the queue.
A change request is sitting in a queue. Next to it, a security architecture review. Behind that, a policy exception, three control owners asking, “is this right?”, and an evidence pack waiting to be assessed. Everyone is waiting on the same thing: someone in security to say yes, no, or not like that.
For nearly two decades, that someone was me.
There was always a pile waiting, and after a while you stop seeing it, because busy becomes the state you live in.
I held the queue because there was no other way to make sure things were done right. Security judgement is the one thing you can’t hand to someone who doesn’t have it. Let everyone make their own call and you get the Wild West. So the queue was mine to hold.
And the queue was never going to be fixed by working harder. Headcount is finite, whether your security team is one person or a hundred.
Assurance is always the thing that waits
The obvious cost of the queue is speed, but the one that worries me more is assurance.
Security teams are never idle. There are incidents, alerts, tools to run, improvements to drive and products to ship. Assurance, knowing whether your controls are working, goes to the back of that list. Everyone knows it matters. Nobody has the hours. So it waits, until something forces it: a customer, an auditor, a supervisor or a regulator with teeth.
And while it waits, nobody knows whether the controls are working or whether they stopped months ago. The risk is there either way. You just can’t see it.
The pattern holds everywhere. What differs is where the cost lands.
For some it lands on time: compliance programmes that barely move for years, deals held up waiting on a security approval, evidence piling up for months while nobody finds out whether it counted.
The worst of it lands on security itself. When the wait is long enough, people stop waiting, the change goes in unreviewed because the business must move on, and the queue built to prevent the Wild West is quietly creating it.
What happens when judgement stops queuing
So, what if judgement didn’t have to queue? The same judgement a good assessor would apply, measured against the requirement itself, applied continuously and available to anyone who owns a control the moment they need it.
That’s the engineer who just changed a configuration, the HR lead who owns onboarding, the finance manager who approves new suppliers. They submit what they’ve done and find out straight away whether it’s right, what’s missing and what it takes to meet the requirement, and then they satisfy it.
None of this works without your experts. They are ultimately responsible, so they set the rubric: what counts as evidence, what good looks like, and where the bar sits for each requirement. I said earlier you can’t hand judgement to someone who doesn’t have it. That’s still true. What you can hand over is the standard, and that’s what AI changes: whether the expert must be in the room every time that rubric is applied. Every assessment is made against their rubric and records its reasoning, so anyone can see exactly why something passed or failed, and the expert can review or override any assessment at any time.
The team you were never going to get approved
Expert hours are still scarce and will likely continue to be. We built CyberHeed so that standard gets applied to the routine work continuously, and your experts spend their hours on the decisions that actually need them.
Come and see what your controls look like when nothing is waiting on one person.
Keep the standard, drop the queue, and you get rigour and pace. There was never a trade.
