Cycling

Controls Are Means, Not Ends

/ Greg Schaffer

I ran a half marathon Sunday. I finished first in my age group. This despite a decidedly unconventional training routine.

For much of my adult life, I’ve been a fairly consistent amateur runner. I’ve never been exceptionally fast, but PRs from years past include a sub-22-minute 5K, a half marathon below 1:40, and a couple of marathons below four hours. I believe my marathon PR was 3:47 at Las Vegas in 2010, but I’m going on memory.

Over the years, I’ve learned how to train. I’ve done the 10-week mileage programs. I’ve logged hundreds of miles preparing for a single event. That’s the proven method. That’s the way you’re supposed to do it.

We say that a lot in information security, don’t we?

For this half marathon, I logged a total of about 17 miles of training runs over 10 or so weeks. Not 17 miles per week. Seventeen miles total. That includes a July 4th 5K event, a couple of fun trail runs, and a seven-mile “wake up” trail run about a week before the race.

Yet I didn’t just survive the half marathon and finish. I won my age group with a respectable time, at least for this 59-year-old male, of 2:18.

How?

I do a lot of cycling, both indoors on Zwift and outdoors mountain biking. My resting heart rate is in the 40s, and my VO2 max remains strong for my age. Those activities have built and maintained an aerobic system capable of handling much more than cycling. Years of running experience, some limited running-specific conditioning, and knowing how to pace myself took care of other parts of the equation.

In other words, I didn’t follow the conventional control. But I still addressed the underlying risks.

Back to information security.

I occasionally see discussions about “compensating controls” in a disparaging sense. One LinkedIn thread I saw recently slammed the very idea of compensating controls, arguing that we shouldn’t need them if the primary control is designed properly.

I think that misses the point.

We should not put the controls first. We should concern ourselves first with the risks we’re trying to mitigate.

Too often, “compensating control” becomes a compliance term rather than a risk-management concept. We start with a prescribed control, discover that we can’t or don’t want to implement it exactly as prescribed, and then ask what “compensating control” we can put in its place.

But why are we starting with the control? Start with the risk.

Back to running. What were my risks? I might have a crappy time. I might not finish. I could hurt myself. I could really hurt myself.

None of those risks inherently says that I must follow a conventional running mileage program to mitigate them. Through experience and conditioning, I’ve found another way to address much of the risk. In fact, I would argue that my approach may be better for me because it reduces the pounding on my knees while maintaining a strong aerobic base.

That doesn’t mean cycling magically replaces every benefit of running. It doesn’t. Just as in information security, one control doesn’t necessarily address every dimension of a risk. My aerobic conditioning addressed one component. Running experience, limited running-specific training, pacing, and knowing my own capabilities addressed others.

The objective wasn’t to comply with a running standard.

The objective was to manage the risks well enough to achieve the desired outcome.

Seventeen miles of running wasn’t the standard way to prepare for a half marathon. But the standard wasn’t my objective. Managing the risks was.

So perhaps we should stop spending so much time debating “primary” versus “compensating” controls. Better yet, stop making controls the starting point for information security. Identify the risks. Understand the outcomes you’re trying to prevent. Then identify the combination of controls that mitigates those risks effectively and provides the resilience the organization needs.

Controls are means, not ends.

That’s how we build high performance, whether we’re talking about running a half marathon or building an information security program.

Photo: The author crossing the finish line at the 2026 Fall Creek Falls Half Marathon. Todd Temple Photography

The Power of Consistency

/ Greg Schaffer

Some time ago, I was asked about what makes a good podcast. There are many elements that I could choose from, but one immediately stands out – consistency.

Afterwards, I pondered my response, realizing that there was more truth behind the simple answer that I needed to unpack. I’ve hosted and produced the Virtual CISO Moment podcast for many years now, with the last three and a half devoted to weekly discussions with information security pros. There have been weeks that I didn’t feel like recording, or when a guest didn’t show, and I could have just let it slide.

But I never did, because I believe in the power of consistency.

To me, it seems that hose who are successful got that way by patiently doing what they need to do. They realize gratification isn’t immediate, that time and patience and grinding is what is needed to build anything – a podcast, a business, a new habit. Over the course of my podcast’s lifetime, I’ve seen other security podcasts come and go. It’s not that they weren’t of value. Rather, I think the producers of each that ended didn’t see at the beginning the need for consistency and constant dedication.

It’s easy to make a commitment, but it’s difficult to follow through.

In July 2025 I completed a 2200 push up challenge to raise awareness (and perhaps a few dollars) of the needs of veterans. The primary reason for doing it was obvious; I believe in supporting my fellow veterans. But there was another reason: I wanted to demonstrate, and be held accountable for, making a commitment and sticking with it. Every. Single. Day. To that end, I recorded a “first 22” (first 22 push ups of the day) video every day, usually early in the morning. It was more for me than anyone else, because I publicly held myself accountable.

It was not about the number of pushups. It was about showing up and doing the push ups every single day. I could have kicked the 2200 out in a day (or a few) and be done with it, but the opportunity for a lesson on consistency and follow through would have been lost.

It’s not as if there weren’t obstacles. Some days I didn’t feel like doing it. Several times I had to get out of bed to push out the last dozen or two because I forgot to finish during the day. This morning while getting in an early mountain bike ride at Montgomery Bell State Park I came across the obstacle pictured above. There seemed to be no way around it. However, instead of reversing (which would man giving up on the trail), I found a way to push through.

Consistency is not the key to winning and success, but it is one component. Show up every day, especially when you don’t want to. Do the grind, and pay the dues. You will find a reward . That’s the real lesson of the power of consistency.

The Angel on the Road

/ Greg Schaffer / 1 Comment

I am fortunate to be able to ride my bicycle to work when the weather allows for it. At about five miles each way, I get in a cardio workout while saving gas, plus the enjoyment of the outside. I can’t do it every day even if the weather is nice as my schedule does not always allow for it, but I do ride when I can.

IMG_7557This morning I planned to expand my ride to swing by the gym for a short weights workout. For me, it was more about testing the feasibility of the idea than anything else. This increased my mileage to work by only about three miles. It was a beautiful, clear morning, ride temperature about 60 degrees, and light traffic as I planned the journey before rush hour. What could go wrong?

I need to step back to about three weeks ago when I was prepping my road bike for the first ride of the season. I had foolishly left it standing on its tires in the garage instead of putting it up for the winter in the basement on its rack. When I wheeled it away from its parking spot near a stepladder, I discovered the front tire was flat. No problem, as I’ve changed tires (well, tubes) before.

The last time was several years ago.

I began by unhooking the front brake cable and flipping the quick release. Except the quick release did not live up to its name. Despite prodding from pliers, I could not move the release handle. Whatever. My bike shop is a mile from my office. I’d take the bike there on the way to work and get it tuned up for the year. So far, so good.

Except I kept meaning to practice how to change a tire. For several years I promised myself to do so, yet never did. The time caught up with me, of course, on a busy highway on the way to the gym with a front flat. I wrestled with the thing for 45 minutes, finally turning to a YouTube video to figure out what I was doing wrong (oh, inflate the tube a bit, put in tire, mount tire on rim, not my method which I’m not even sure what it was).

I was about 95% done when an SUV pulled over and a woman about my age came over to render assistance. She was a cyclist as well, and in short order we finished the job. I thanked her, calling her my angel. In reality I was really a few minutes away from finishing myself but I appreciated her being there to provide assistance and assurance I was doing the job correctly.

What does this have to do with writing?  Well, yesterday I tweeted about the necessity for writers to strive for excellence in the trade. I’ve seen writer’s tweets that contained embarrassing errors – not typos, minor misspellings, or fat-finger mistakes, but writing “to” instead of “too” or “advise” instead of “advice.” Just because it’s Twitter doesn’t mean we shouldn’t strive for excellence on that platform as well.

I did not achieve excellence in my cycling preparation. A lesson learned. Maybe before I hit the road again I’ll practice what I preach in other aspects of my life.