Central Hudson

Danielle Caruso serves as Director of Information Security and Corporate Security at Central Hudson. She leads strategies that strengthen cybersecurity, physical security and risk management, helping protect critical operations while supporting regulatory compliance, business resilience and the secure delivery of essential services.

A s Cybersecurity leaders, we spend countless hours discussing ransomware, identity attacks, zero trust, AI, and the newest and scariest emerging threats. We invest millions in technology designed to reduce risk, drain resources and time into processes and policy, yet typically overlook one of the most effective security controls: psychological safety.

 As security professionals, we often focus on protecting systems while overlooking our people; the protectors of those systems, and that is a grave mistake. The strongest security programs are not built solely on advanced technology.

They are built on teams that trust one another, communicate openly, and feel safe speaking up when something doesn’t look right. Culture is not separate from cybersecurity—it is a critical component of it.

Security Starts With Trust

Psychological safety is the belief that individuals can admit mistakes, ask questions, challenge assumptions, and raise concerns without fear of embarrassment, retaliation, or punishment. In cybersecurity, those behaviors directly influence an organization’s ability to prevent and respond to incidents.

Employees should feel comfortable reporting that they clicked on a phishing email before it becomes a larger incident. Analysts should be encouraged to escalate suspicious activity without worrying about being wrong. Engineers should challenge assumptions, question risky decisions, and offer alternative viewpoints—even when those viewpoints differ from leadership.

When cybersecurity leaders don’t create cultures driven by psychological safety, people stop speaking up. Problems remain hidden longer. Near misses go unreported. Teams become reactive instead of proactive.

Security leaders often measure technical risk, but few measure the organizational conditions that make technical failures more likely.

Organizations that foster this type of openness detect threats faster, respond more effectively, and learn from incidents rather than hide them.

Cybersecurity has become a profession defined by constant urgency. Teams are expected to respond around the clock, defend against increasingly sophisticated attacks, and do more with fewer resources. While resilience is part of the job, psychological safety is not.

Leadership Shapes Culture

Security culture starts at the top.

Leaders establish the environment in which cybersecurity either thrives or struggles. They influence how risk is discussed, whether collaboration is encouraged, how failures are handled, and whether accountability is viewed as learning or blame.

The best cybersecurity leaders are visible, approachable, and engaged with their teams. They listen more than they speak. They create opportunities for honest feedback. They recognize that psychological safety does not reduce accountability—it strengthens it by making accountability possible.

“The strongest security programs are built on teams that trust one another.”

Ultimately, cybersecurity is a people business supported by technology, not the other way around.

As an industry, we should continue investing in AI, automation, identity security, and secure-by-design architectures. But we must invest just as intentionally in the people operating those technologies. A psychologically safe team is more collaborative, more resilient, and better equipped to identify and respond to threats before they become business crises.

Technology alone cannot solve cyber-risk.

Leadership matters. Culture matters. Human behavior matters. This is true collective defense.

Perhaps it’s time we recognize psychological safety for what it truly is: one of the most valuable security controls an organization can implement.