The systems were restored. The business recovered. Operations gradually returned to normal, and from the outside it appeared that the crisis had passed.

It hadn't.

Something had changed that could never be restored to the way it was before. It was not the technology. It was the way I thought about leadership.

Before the ransomware attack, I believed that cybersecurity could comfortably coexist with flexibility. I believed exceptions could be made for trusted colleagues, that relationships naturally influenced decisions, and that saying "yes" whenever possible helped build a positive working environment. The events of that weekend challenged every one of those beliefs.

Threat actors do not care whether someone is a senior executive, a trusted colleague or a close friend. They do not recognise trust, loyalty or good intentions. They recognise opportunity.

Without consciously deciding to, I became more disciplined, more cautious and far less willing to make exceptions. Decisions that had once been influenced by familiarity were now guided by a single question: could the organisation afford this risk?

That question quietly became the foundation of every security decision that followed. Sometimes the answer disappointed people. Projects slowed down, requests were challenged, and exceptions that might once have been approved were declined. To some, cybersecurity became the department that always said "no."

I understood that perception, but experience had taught me something that mattered more. Every unnecessary exception increases risk , not immediately, and not visibly, but each one makes the next incident a little more likely.

Looking back, I realised that one of the greatest challenges of leadership is accepting that consistency matters more than popularity. It is easy to say "yes." It is much harder to explain why "no" is sometimes the most responsible answer.

People naturally remember the inconvenience created by governance. They rarely remember the crisis it prevented. That is the quiet reality of leadership: success is often measured by events that never happened.

Over time, I stopped seeing governance as a collection of policies, procedures and technical controls. I began to see it as a promise.

A promise to protect the organisation, even when that protection creates friction.

A promise to remain consistent regardless of hierarchy, relationships or pressure.

A promise to place the organisation's long-term wellbeing above today's convenience.

Looking back, I no longer believe that experience simply increases knowledge. I believe it changes character. Some lessons cannot be learned in training courses, management meetings or leadership books. Some lessons can only be learned by carrying responsibility through the most difficult moments an organisation will ever face. The weekend that changed my life did far more than transform our cybersecurity programme.

It transformed the kind of leader I would become.