The Technical Imperative and the Risk Reality

Information security is often understood through the technologies deployed to protect an organisation: firewalls, encryption, multi-factor authentication, endpoint detection, security monitoring and intrusion prevention. Yet this technical view tells only half the story. Information security is equally a discipline of risk management, in which decisions are guided by the value of information, the likelihood of threats, the consequences of failure and the organisation’s tolerance for risk.

The two perspectives are inseparable, but they answer different questions. Technical security seeks to prevent, detect, contain and recover from threats. Risk management determines which threats matter most, what level of protection is justified, and which residual risks an organisation can reasonably accept. When either perspective dominates at the expense of the other, security becomes ineffective, expensive or even counterproductive.

For African organisations accelerating their digital transformation, this distinction matters. The objective is not to accumulate security technologies or to eliminate every conceivable risk. It is to build resilient institutions capable of protecting information, sustaining essential services and making informed decisions under uncertainty.

Introduction: When Protection Becomes a Paradox

Imagine an organisation that has invested heavily in cybersecurity. It operates next-generation firewalls, deploys endpoint detection and response, runs a security information and event management (SIEM) platform, encrypts sensitive information and enforces multi-factor authentication.

On paper, it is well protected.

Yet an attacker exploits a poorly secured third-party connection, a privileged account is compromised, or a critical business process is interrupted by a misconfigured security control. The technologies are present, but the organisation remains exposed.

Now consider the opposite. An organisation has a clear risk appetite, a comprehensive risk register, regular assessments and detailed board reporting. However, it lacks effective monitoring, runs unpatched systems and cannot detect an intrusion before substantial damage is done.

In the first case, technical sophistication creates a false sense of security. In the second, risk awareness exists without the operational capability to act on it.

Both illustrate the same fundamental problem: information security fails when technical protection and risk management operate as separate disciplines.

This is why information security is a double-edged sword. Its technical and risk edges are complementary, but each becomes dangerous when wielded without the other.

1. The Technical Edge: Building the Defences

The technical dimension of information security concerns the mechanisms that protect systems, infrastructure, applications and data against unauthorised access, alteration, disclosure, disruption or destruction. It is the visible, operational side of cybersecurity, and its purpose is to translate security requirements into controls that reduce the likelihood and impact of incidents.

ISO/IEC 27002:2022 classifies controls by type as preventive, detective or corrective. In practice, it is useful to add a fourth group focused on recovery:

• Preventive controls: firewalls, access controls, secure configurations, encryption and multi-factor authentication.
• Detective controls: security monitoring, audit logging, intrusion detection and behavioural analytics.
• Corrective controls: incident response, malware removal, vulnerability remediation and system restoration.
• Recovery and resilience controls: backups, redundancy, disaster recovery and business continuity arrangements.

Together, these establish layers of protection, so that the failure of one control does not automatically lead to the compromise of the entire environment.

However, technical security has an inherent limitation: no technology, and no combination of technologies, can guarantee complete protection.

A firewall cannot stop an employee from approving a fraudulent transaction. Encryption cannot protect information from an authorised user who misuses legitimate access. A monitoring platform cannot detect what it cannot see: if critical systems are not onboarded, logs are incomplete, or alerts are never investigated, detection fails. An organisation may run an advanced vulnerability management platform and still be breached because remediation is delayed by operational dependencies or management decisions.

The presence of a control is not proof of its effectiveness.

This matters because organisations sometimes measure security maturity by counting products, licences, dashboards and implemented controls, rather than by asking whether those controls reduce meaningful business risk. A security operations centre may generate thousands of alerts a day without surfacing the one incident that matters. A vulnerability dashboard may show impressive scan coverage while critical findings remain open. A compliance report may show that policies exist without proving that anyone follows them.

The technical edge, therefore, is not about acquiring tools. It is about engineering, configuring, testing and operating controls in ways that demonstrably protect the organisation.

2. The Risk Edge: Understanding What Must Be Protected

The risk dimension asks different questions. What are we protecting? Who might threaten it? How could the threat materialise? What happens if a control fails? How much risk is the organisation willing to accept?

Risk management connects technical security to business objectives, financial exposure, legal obligations, operational continuity and institutional reputation. Standards such as ISO 31000:2018 and, for information security specifically, ISO/IEC 27005:2022 provide the methodology.

A familiar conceptual model is:

Risk = Likelihood of an adverse event × Consequence of that event

This is a simplification rather than a universal formula. Real assessments also weigh threat capability, vulnerability, exposure, control effectiveness and uncertainty, and many organisations use qualitative scales rather than numbers.

The central principle is that not all risks deserve equal treatment. A vulnerability on an isolated test server may be less urgent than the same vulnerability on an internet-facing payment gateway. A compromised administrator account creates far greater exposure than a compromised ordinary user account. An outage affecting a critical public service may carry consequences far beyond the cost of restoring the technology.

Risk management helps organisations distinguish between these situations and allocate limited resources accordingly. It also introduces risk appetite: in the language of ISO Guide 73, the amount and type of risk an organisation is willing to pursue or retain in pursuit of its objectives.

Risk appetite does not mean tolerating avoidable weaknesses, nor does it override legal requirements. It provides a framework for explicit, accountable decisions about uncertainty, investment and competing priorities.

Consider a financial institution deciding whether to launch a new digital payment service. The technical team defines the security architecture, authentication, transaction monitoring and encryption. The risk function must also evaluate fraud exposure, third-party dependencies, data protection obligations, operational resilience and the consequences of disruption. The launch decision should emerge from the combined assessment.

Without technical insight, risk assessments underestimate the realities of the threat environment. Without risk insight, technical teams spend heavily protecting low-impact assets while critical business processes remain exposed.

Risk management gives security its priorities. Technical security gives those priorities practical effect.

3. Where the Two Edges Become Dangerous

The double-edged nature of information security is clearest when one perspective overwhelms the other.

3.1. Technology without risk intelligence

An organisation can spend millions on cybersecurity and still miss the exposures that matter most. It may deploy sophisticated tools while neglecting identity governance, supplier access, data classification, recovery testing or privileged account management. It may apply identical controls to systems of vastly different business importance.

The result is security theatre: highly visible activity that creates confidence without producing a proportionate reduction in exposure. The term, associated with security technologist Bruce Schneier, captures the danger of judging protection by how impressive it appears rather than by how effectively it reduces risk.

Technology without risk intelligence also creates friction. Excessive restrictions delay legitimate work, encourage workarounds and frustrate staff. Controls poorly aligned with real threats consume resources that would be better spent elsewhere.

3.2. Risk management without technical capability

The opposite imbalance is equally damaging. An organisation may identify critical risks, assign owners and set remediation deadlines, yet lack the technical capacity to implement the required measures.

A risk register does not patch a vulnerable server. A policy does not, by itself, prevent credential theft. A management committee cannot detect an intrusion by reviewing a monthly report.

Risk identification without implementation becomes an administrative exercise.

3.3. Treating compliance as security

A third problem arises when organisations confuse compliance with security effectiveness. Standards and regulations provide essential baselines, accountability and assurance. But compliance evidence is a point-in-time attestation; it does not rule out compromise. An organisation can satisfy documented requirements on audit day and remain exposed to new attack techniques, changed business processes or emerging third-party risks.

The right relationship is complementary: compliance sets obligations and expectations, while risk-based security tests whether the organisation is adequately protected in its actual operating environment.

For a fuller examination of the distinction between compliance and security effectiveness, see Information Security vs Compliance: https://www.linkedin.com/pulse/information-security-vs-compliance-lukonde-l-chaibela-ktvlf/.

4. A Practical Example: Securing a Payment Gateway

Consider a payment gateway processing transactions for merchants, banks and other financial service providers. Its responsibilities go well beyond protecting servers. It must protect sensitive data, preserve transaction integrity, maintain availability and manage dependencies on banks, cloud providers, processors and other third parties, all while meeting obligations such as PCI DSS v4.0.1 and, in Zambia, the Data Protection Act No. 3 of 2021.

A purely technical approach would prioritise firewalls, encryption, multifactor authentication, network segmentation, vulnerability scanning and monitoring. These are essential, but they do not answer every relevant question. What is the financial impact of a prolonged outage? Which systems are most critical to transaction processing? How much exposure arises from third-party access? Could compromised credentials enable fraudulent administrative changes? How quickly can the gateway recover from a destructive attack? What obligations are triggered if personal or cardholder data is exposed?

A risk-led approach connects each question to a proportionate technical and organisational response.

For example, the risk of fraudulent administrative changes may justify phishing-resistant authentication, privileged-access controls, transaction approval thresholds and continuous monitoring. The risk of prolonged service disruption may require redundant infrastructure, tested recovery procedures, defined recovery objectives and contractual assurance from critical providers. The risk of data exposure may call for encryption, tokenisation, strict access controls and tested breach-response procedures. In each case, the control follows from the business consequence, threat scenario and acceptable level of residual risk.

The distinction is that controls are not selected because they are available. They are selected because they address identified risks and support defined business outcomes. This is the point at which information security becomes a business enabler rather than a purely technical function.

5. Bringing the Two Edges Together

A mature information security programme integrates technical operations and risk governance through a continuous cycle:

1. Understand the business. Identify critical services, information assets, dependencies and legal obligations.
2. Assess the risks. Evaluate credible threats, vulnerabilities, potential consequences and the effectiveness of existing controls.
3. Select proportionate controls. Prioritise measures by risk, regulatory requirement, operational feasibility and business objective.
4. Test and measure effectiveness. Use vulnerability assessments, penetration tests, access reviews, detection exercises, incident simulations and recovery tests to confirm that controls work as intended.
5. Govern residual risk. Escalate significant exposures, assign accountable owners, document decisions, and obtain acceptance at the appropriate level of management.
6. Adapt continuously. Reassess as threats, technologies, business models and dependencies change.

Information security frameworks support this integration. ISO/IEC 27001:2022 places risk assessment and treatment at the heart of the information security management system, while the NIST Cybersecurity Framework 2.0, released in 2024, organises activity around six functions: Govern, Identify, Protect, Detect, Respond and Recover. By making Govern an explicit function in version 2.0, the framework reinforces this article’s argument that technical controls need governance to provide direction, accountability and alignment with organisational priorities.

Useful measures should go beyond counting incidents or vulnerabilities. They should include the age of unresolved critical vulnerabilities, completion of privileged access reviews, detection and containment times, recovery-test outcomes, and the proportion of high risks with accountable owners and funded treatment plans. These indicators tell management whether security investment is reducing exposure and improving resilience, not merely increasing activity.

6. The Strategic Lesson: Security Is About Decisions, Not Just Defences

Information security is not a contest between technology and risk management. It requires both.

Technical teams need the authority and resources to implement effective controls. Risk professionals need enough technical understanding to evaluate exposure realistically. Business leaders need to understand the implications of security decisions and own the risks that fall within their authority.

When these functions work together, organisations can make informed trade-offs between security, cost, usability and innovation. When they operate in isolation, investment is misdirected, risks go untreated, and management receives a misleading picture of the organisation’s resilience.

The most secure organisation is not necessarily the one with the largest cybersecurity budget or the most security products. It is the one that understands what matters most, applies appropriate protections, verifies that they work and responds effectively when prevention fails.

From Security Controls to Resilience

Information security succeeds when its two indispensable edges operate as a single system. The technical edge builds and operates the defences; the risk edge determines where those defences are most needed, how strong they must be and what consequences remain if they fail. Their integration turns isolated controls and assessments into a coherent capability for protecting information and sustaining the organisation’s mission.

Neither is sufficient alone. Technology without risk awareness produces expensive inefficiency and misplaced confidence. Risk awareness without technical execution produces well-documented vulnerabilities that remain unresolved.

For organisations navigating an increasingly digital economy, the path forward lies in integrating both disciplines into a coherent system of governance, implementation, assurance and continuous improvement.

The real measure of information security is not how much technology an organisation deploys or how many risks it records. It is how effectively it reduces the risks that matter, protects what is valuable and sustains its mission when the unexpected occurs.

The two edges must work together: one protects the systems; the other protects the purpose for which those systems exist.