What being a cop taught me about stopping hackers

Early in my career, I worked as a police officer, and one of the most important parts of the job was proactive policing, being present in neighborhoods before crimes happened. We patrolled streets, built relationships, and made our presence known. Proactive policing works by creating visibility and presence that discourages criminal activity before it starts. Officers on patrol change the environment, alter potential offenders’ decisions, build trust within the community and prepare for response to critical incidents before they happen. The impact is often invisible, yet it is one of the most effective ways to prevent and mitigate harm.

Here is the thing: you can’t measure the burglary that didn’t happen because a patrol car was nearby. You can’t quantify the robbery that never occurred because an officer’s visibility deterred it. There’s no crime report, no arrest statistic to showcase.

But anyone who has walked and driven a beat knows the truth: visibility works. Criminals see the uniform, reconsider their timing or abandon their plans altogether. It reduces crime, strengthens trust and positions law enforcement to act before situations escalate, often preventing harm entirely.

Today, leading incident response teams, I see the same dynamic in proactive Security Services:

• Regular behavioral threat hunting
• Tabletop exercises and immersive simulations
• Executive and technical readiness reviews
• Continuous vulnerability management
• Adversarial simulations
• Threat intelligence-led defense
  (and the list could go on…)

These are our digital patrols, the quiet, consistent presence that shapes an attacker’s decision-making before they breach the perimeter.

In the “boom” paradigm, where “boom” is the breach, encryption event or business-disrupting incident, our goal is simple: catch the threat actor as far left of boom as possible. The farther left we are, the more control we have, the lower the cost and the greater the chance of preventing catastrophic disruption.

In many recent incidents I have worked, the clients who had invested in proactive services were the ones who:

• Detected threat actors early in the intrusion phase
• Contained activity before ransomware deployment
• Avoided full operational shutdowns

You can often tell which organizations have prioritized preparation and which have not. The difference is not just in the outcome; it’s in how far left of boom we intercepted the threat.

Like proactive policing, proactive cybersecurity has a frustrating truth:

• Its greatest successes are invisible
• Its ROI shows up as “nothing happened”

This invisibility makes it a challenging budget conversation for executives. Risk discussions in the boardroom often hinge on tangible metrics, incident counts and hard-dollar impacts. The problem is that the most impactful work in security reduces the very events you measure against.

Executives sometimes perceive risk in terms of current exposure, what they can see, rather than the potential impact that has already been prevented. This can lead to underfunding, because the absence of visible incidents is mistakenly seen as an absence of risk. In reality, the absence of incidents is often (not always, because there are some just purely ‘lucky’ organizations out there, but luck does run out, eventually) the direct result of ongoing, well-funded proactive measures and defenses.

In risk terms, proactive cybersecurity is about risk avoidance, not just mitigation. Avoidance does not leave behind a neat paper trail, but it eliminates potential loss events entirely, and that is the most powerful form of risk management there is.

Just as neighborhoods are safer when officers are present, enterprises are stronger when cybersecurity teams are actively engaged before a crisis.

The best incident is the one that never makes the news because it was detected left of ‘boom’.

Just like the burglary that never happened, its value is immense, yet difficult to fully quantify. Some incidents without impact can be measured, but their significance is often far less visible or pronounced than the disasters they help prevent.  That is the real power of proactive cybersecurity: preventing the threats whose true impact is rarely visible in the metrics. No headlines. No breach notifications. No 2 a.m. crisis calls. The cost of prevention will never outweigh the cost of impact.

And while we may never fully quantify what we have stopped, we know the difference it makes. Every day.