What Security Leaders Do Before Launching Their Own Practice
Most of the people who leave are good at the work. That was never the problem.
I have been having a version of the same conversation for three years. A security leader, usually somewhere past twenty years in, has done the math. Tenure is short. The job gets heavier every year. They are very good at the work and they know it. And they say some version of: I could do this on my own. They probably could. The security part was never the problem.
What most of them have not built is the option to leave. That is a different thing from the ability to succeed once they have, and the difference is what this piece is about. I wrote a longer white paper on it, with every number sourced and a page of citations at the back. This is the short version. The download link is at the bottom.
The market is stuck, not dangerous
If you have been waiting for a wave of layoffs to justify a decision, the wave is not coming. Layoffs were at 1.0 percent in July, and the Bureau of Labor Statistics called it little changed. What is happening instead is quieter. Quits are down. Fewer people are changing jobs. And the share of US workers who say it is a good time to find a job has fallen from around 70 percent in 2019 to 46 percent this year.
People are staying put. Most of them did not choose to.
Here is the part that matters. Gallup found that when employees feel they have real choice in their work, they are nearly 50 percent more likely to say the job market looks good. Optimism follows options. It does not create them.
So the question is how you build the options while you still have the job. I have six of them.
1. Staying is not the same as choosing
MBO Partners asked traditional workers about their plans. Thirty-eight percent said they definitely will not leave their job this year, up from 29 percent two years ago. Only 11 percent expect to leave for their own practice within two years. In the same survey, a record 40 percent said working for themselves is less risky than a permanent job.
Read those together. More people than ever believe working for themselves is the safer path, and fewer than ever are doing it.
Security leaders show the same pattern with sharper edges. In a 2026 survey of about 560 CISOs, nearly seven in ten said they were open to a career move within the year. Nobody has asked the same question of physical security leaders at that scale, so the cyber number is the closest we have. Being open to a move and making one are different things. The distance between them is the whole problem.
✔ Ask yourself: When was the last opportunity you seriously considered and turned down? If there has not been one, you are not choosing to stay. You have a default, and the default is doing the choosing for you.
2. Your pay follows your options, not your hours
Everyone in this industry says some version of paid for forty, working sixty. For a lot of you it is true. It is also not the average, and the average is worth knowing. Full-time managers in the US work about 43 hours a week, and that number has been falling for twenty years. Both BLS and Gallup land on it.
So if your week looks like sixty, you are not the average. The gap is about 17 hours a week, roughly 800 hours a year, and nobody is paying you for it.
Here is the truth. Whether they should is a different question from whether they will. Your pay is set by whether you can leave. In August, base pay for people who stayed in their jobs rose 3.0 percent. For people who changed jobs it rose 4.7 percent. A 1.7-point premium is not much reward for the risk of moving, which is one more reason people stay put.
“I don't just walk in with a problem, I need to come up with a problem and a solution. And if I present that and executives accept that, then we document it and we move forward with the plan.”
Tim McCreight, TaleCraft, past president of ASIS International
✔ Ask yourself: What was your last raise a response to? If the answer is an outside offer you never had, you negotiated with nothing.
3. Plan A has to be a plan
Plan A is the job you have. Being good at it is the first half of any exit, because what you take with you is what you built there.
The Security Executive Council has studied the CSO role for twenty years, and their read is blunt: CSOs have little upward mobility inside an organization, so advancing usually means leaving. And nobody has measured how much of a security leader's week actually goes to security work. In my conversations, the number that comes up most is about 40 percent. The rest goes to procurement, vendors, budget, and keeping the function staffed.
"You really are business leaders. You're not just security professionals, you're business professionals with security expertise."
Rich Widup, The Widup Group, past president of ASIS International
✔ Ask yourself: What are you personally absorbing that someone else could carry? That list is your risk and your bandwidth at the same time. It is also the first thing you will have to solve when you launch your own practice, because it does not go away. It becomes yours entirely.
4. Five people, not a network
Networking advice is useless because it is never specific. This is specific: name five people who would make a call, an introduction, or a recommendation for you without being asked twice.
There is real science on who those five should be. A 2022 study in Science analyzed 20 million people on LinkedIn over five years and found that moderately weak ties, people who share about ten mutual connections with you and whom you rarely talk to, produced more job moves than either close colleagues or near strangers. Your five are the middle layer most people neglect.
And the people you have lost touch with are not gone. When executives reconnected with contacts they had not spoken to in three years, those dormant ties gave them more useful information than their active network did. Trust was still there.
This is the same idea behind effortlo's professional chain of trust. Before an expert joins the platform, named people in the industry put their reputation next to that expert's work. The five people in this section are those people. If you cannot name them now, you will not be able to name them then.
✔ Ask yourself: Can you write five names right now? If you cannot, that is the assignment. Add two more you have not spoken to in three years.
5. One sentence, not a résumé
People pay for what you do better than anyone. That is my argument, not a statistic, and it is the one thing I say to every expert who joins effortlo.
They do not pay for what you are half decent at.
The market it describes is bigger than it looks from inside a corporate role. Thirty-six percent of employed Americans now run a side business, and a third of those are selling consulting to companies. Most of them are competing on a résumé. A résumé is a list. A market position is a sentence.
Roughly one in eight employed Americans is already selling expertise while holding a job.
What people running their own practice say is hardest, from the same survey: unpredictable income, keeping a pipeline, and marketing themselves. Every one of those gets easier when the offer fits in one sentence, because a sentence can be referred, searched, and priced.
✔ Ask yourself: Can you say what you are best at in one sentence someone would pay for? Read it to a person outside your company. If they can repeat it back, it is a market position. If they cannot, it is still a résumé.
6. Plan B is a list of things that exist
An intention does not count. Plan B is built when these things exist:
✔ An offer you can say in one sentence.
✔ Five named people who would move on your behalf.
✔ Something to point to beyond a résumé: a body of work, a reputation outside your own company.
✔ Income from somewhere other than your employer, even a little.
✔ The infrastructure. The entity, the contract, the invoicing, the insurance. This is the part nobody plans for and everyone gets hit by, because it is exactly the work you did not do in-house.
It is also more common than it looks. The number of Americans MBO counts as full-time independent workers doubled from 13.6 million in 2020 to 27.6 million in 2025, and the professionals among them who sell services to businesses reached 11.5 million, up 55 percent since 2020. The people building this are not outliers anymore.
When you move from internal as an employee to external as a consultant, you're able to have a little more non-biased transparency. Externally, you can say: this is what I think is the best practice. I wouldn't do that. I recommend this.
Jill Frack, Fracktional Solutions
✔ Ask yourself: For each item on that list, what does done look like? Five names written down is done. A rate on paper is done. If you cannot describe done, it is not built.
The numbers security leaders should know
Layoffs and discharges rate 1.0 percent, little changed. (BLS JOLTS, July 2026)
Full-time managers average 43 hours a week, down from 45.5 in 2005. (BLS Current Population Survey, Table 23)
US workers who say it is a good time to find a job: 46 percent, down from about 70 in 2019. (Gallup, State of the Global Workplace 2026)
Nearly seven in ten CISOs open to a career move within the year. (IANS Research and Artico Search, 2026)
Full-time independent workers, as MBO counts them, rose from 13.6 million to 27.6 million between 2020 and 2025. (MBO Partners, State of Independence 2025)
Thirty-six percent of employed workers have a side business; a third of those consult to companies. (MBO Partners, State of Independence 2025)
What I mean by Plan B
Everything here is something I have watched people do, or fail to do. The ones who moved well did not move fast. They built the five names, the one-sentence offer, and the thing to point to while they still had a badge. When the moment came, it was a choice.
That is what I mean by Plan B: an option, built in advance, that you may never use. The people who have one negotiate differently, lead differently, and when they leave, they leave on their own terms.
The full white paper has all of this with every number sourced, three charts, a section on the evidence that cuts against the argument, and a page of citations with sample sizes. It is written for the version of you that wants to check the math.
If you want to talk about any of it, I will be at GSX September 14 through 16. Grab a time: https://bookings.myeffortlo.com/#/steve
Steve Lisle is the Founder and CEO of effortlo. Effortlo is the world’s only marketplace built exclusively for trusted security resources, giving security experts a discreet way to promote their skills and connect with customers. Effortlo is transforming how companies address security challenges by offering instant access to credible, capable professionals - validated through a professional chain of trust - and empowering customers to move fast through transparent, streamlined processes that eliminate friction and deliver results when it matters most.
Do you want to learn more about how effortlo helps companies solve security challenges? Schedule an introduction.
Comments