Certified: The GIAC GSTRT Audio Course

In this episode, we focus on what keeps good work from fading after the initial burst of energy, which is sustaining momentum with cadence, visibility, and recognition that feels real. Most programs start with urgency, but urgency is not a strategy, and it cannot be maintained without burning people out. Momentum is different from urgency because it is steady and repeatable, and it survives leadership attention shifts, incident distractions, and competing priorities. The teams that keep moving are the ones with a rhythm that makes progress visible, a habit of acknowledging the right behaviors, and a communication style that keeps everyone aligned with reality. When these elements are present, work feels like it is moving forward even when it is hard, because people can see what is done, what is next, and what is blocking them. The goal here is to build an operating pattern that makes forward motion the default, not a special event.

Before we continue, a quick note: this audio course is a companion to our course companion books. The first book is about the exam and provides detailed information on how to pass it best. The second book is a Kindle-only eBook that contains 1,000 flashcards that can be used on your mobile device or Kindle. Check them both out at Cyber Author dot me, in the Bare Metal Study Guides Series.

The foundation of sustained momentum is a weekly rhythm that is treated as an organizational commitment rather than a suggestion. Weekly rhythms matter because they match human planning cycles and they provide enough frequency to detect drift before it becomes a crisis. A rhythm can include a short planning checkpoint, a regular progress review, and a time for escalation or decisions, but the key is consistency, not complexity. Protecting the rhythm fiercely means you do not cancel it casually, and you do not allow it to be swallowed by other meetings that can be rescheduled. When a rhythm is frequently moved, teams learn that the work is optional, and optional work is the first thing to be deprioritized under pressure. A stable rhythm creates predictability, and predictability reduces coordination overhead, because people know when issues will be raised and when decisions will be made. Over time, that predictability becomes a quiet form of trust, because teams stop worrying that the initiative will be abandoned.

Weekly cadence also creates a forcing function for completion, because a week is short enough that vague plans become obviously weak. When people know there is a check-in every week, they naturally break work into smaller increments so they have something real to report. This reduces the tendency to carry large, ambiguous work items that remain in progress for months without producing outcomes. The cadence also provides a shared heartbeat across functions, which matters because cross-team work often fails due to mismatched planning horizons. A weekly rhythm does not mean everything moves weekly, but it means the team takes stock weekly and adjusts weekly. That adjustment is where momentum lives, because it keeps the program aligned with reality rather than with outdated assumptions. If you want momentum, you must treat cadence as infrastructure, not as ceremony.

Within each interval, define deliverables that are concrete enough to verify, because deliverables are the unit of progress. A deliverable is not a hope, and it is not a vague intention like improve visibility or harden access, because those phrases do not tell anyone what will be done by the end of the week. Deliverables should be specific outputs or changes that can be observed, such as a completed analysis, a deployed improvement, an updated control implementation, or a decision that unblocks downstream work. When deliverables are vague, progress reporting becomes storytelling, and storytelling is easy to game or misunderstand. Concrete deliverables also make ownership clearer, because people can see who is responsible for what outcome and whether it is on track. This reduces the need for micromanagement, because the work can be managed through observable results rather than through constant checking. In security initiatives especially, where work often spans teams, clear deliverables are how you keep dependencies from turning into excuses.

Deliverables per interval also protect the team from overcommitment, because a week can only hold so much real work. When deliverables are written plainly, it becomes obvious when a plan is unrealistic or when dependencies are unresolved. This is where leadership earns credibility, by cutting scope before the week starts rather than explaining failure after the week ends. It also enables teams to sequence work intelligently, placing prerequisite items early so downstream work is not blocked. The discipline is not about squeezing more work into a week, it is about making the work planned for a week actually finish. Finished work creates belief, because people can see that the program is not stuck in perpetual motion. That belief is a major ingredient in momentum because it keeps teams willing to invest attention. When deliverables are clear, the cadence becomes a cycle of completion rather than a cycle of explanation.

Tracking metrics is the next pillar, and the key is selecting metrics that reflect real outcomes rather than activity. Activity metrics are tempting because they are easy to count, but they often produce misleading signals, such as the number of tickets created or the number of controls documented. Outcome metrics are harder, but they are what tell you whether the organization is actually safer or more reliable. In security work, meaningful metrics often connect to exposure time, time to detect, time to contain, the percentage of high-value assets covered by a control, or the rate of recurrence for specific failure modes. The metric should be sensitive enough to show change over time, but stable enough that it is not dominated by noise. It should also be understandable to the audience that needs to make decisions, because a metric that no one can interpret becomes a decorative number. When metrics reflect outcomes, the program can be steered with evidence rather than with opinion.

Meaningful metrics also create focus because they reveal what matters and what does not. If you measure something, teams will optimize for it, so the metric must be chosen with care. A good outcome metric encourages healthy behavior and discourages gaming, because it is tied to reality rather than to paperwork. It should also be paired with context so people do not misinterpret normal fluctuation as failure or success. For example, a temporary spike in detection volume might be a sign of improved visibility rather than worsening security, and without context it can produce the wrong narrative. Metrics should be reviewed regularly within the cadence, not quarterly, because delay turns measurement into archaeology. When you review metrics weekly, you can connect them to deliverables, showing how specific work moved a number or reduced a risk. That connection builds trust in the program because it demonstrates causality, not just motion.

Celebrating small wins is not fluff when it reinforces collective identity and signals what behaviors the organization values. Small wins matter because large outcomes can take time, and without intermediate reinforcement, teams lose energy and start to feel that their effort disappears into a void. The celebration should be grounded in real progress, such as a successfully completed rollout, a closed high-risk gap, a resolved blocker that unlocked execution, or a measurable improvement in a key metric. The tone should be professional and sincere, avoiding exaggeration, because exaggerated celebration damages credibility. When you celebrate a win, you also teach the group what success looks like, which helps them repeat it. Collective identity matters because people work harder and collaborate better when they feel they are part of a team that finishes meaningful work. Small wins are how you keep that identity alive between major milestones.

Recognition becomes even more powerful when you spotlight contributors and tie recognition to behaviors rather than to personality or heroics. The behavior focus matters because you want a culture that is repeatable, not a culture that depends on a few individuals working unsustainably. Recognize behaviors such as closing loops on commitments, reducing friction for other teams, documenting decisions clearly, or taking ownership of a hard problem and delivering a practical solution. Spotlighting should also be equitable, ensuring that quieter contributors and operational staff are recognized, not only the people who speak most in meetings. When recognition is consistent and behavior-based, it becomes a reinforcement mechanism, because people know what is valued and can choose to act that way. This is especially important in security programs that require cross-functional cooperation, because recognition can encourage teams to help each other rather than compete. Over time, the program develops social momentum because the desired behaviors become the norm.

Verbal progress snapshots in every standup are a practical way to keep visibility high without turning the meeting into a status theater. The snapshot should be brief and structured enough that listeners can track progress across the group. The focus is on what changed since the last checkpoint, what will change before the next, and what is blocking progress. When everyone gives snapshots this way, the team develops shared situational awareness, and dependencies are surfaced early. Verbal snapshots also help prevent surprises, because issues that would otherwise be hidden in a ticketing system become visible to the group. The goal is not to recite tasks, but to communicate movement and obstacles. This makes the standup a coordination tool rather than a reporting ritual. When snapshots are consistent, the program gains momentum because the team is continuously aligning execution with the cadence.

Progress snapshots also support psychological safety when they are paired with a normal expectation of raising blockers. If blockers are treated as failures, people will hide them, and hidden blockers become schedule slips that appear late. If blockers are treated as information, people will raise them early, and early blockers are easier to remove. This is why escalation paths matter, because a blocker must have a route to resolution. The standup becomes the place where blockers are named and routed, not the place where people pretend everything is fine. When you consistently surface blockers and resolve them, teams learn that transparency is rewarded, which increases honesty across the program. Honesty is a momentum multiplier because it reduces rework and surprise. In a security context, it also reduces risk because issues are addressed before they become incidents.

Removing blockers quickly requires clear escalation paths that people trust. An escalation path is not just a hierarchy, it is a defined way to get a decision, a resource, or a priority tradeoff without weeks of negotiation. Teams need to know who can decide, how quickly they can decide, and what information they need to decide. When escalation is vague, blockers linger and progress slows, and the cadence begins to feel pointless because nothing changes. When escalation is clear, blockers become temporary friction rather than permanent stalls. The escalation path should also be used respectfully, with specific asks and evidence, because escalation that feels punitive will create resistance. In well-run programs, escalation is normal and non-dramatic, and it is used to protect momentum rather than to assign blame. When people believe blockers will be removed, they plan more aggressively and execute more confidently, which increases speed without increasing chaos.

Retrospectives are how you tune cadence and scope without losing momentum, because they create a structured time to reflect and adjust. A retrospective is not a place to complain, it is a place to identify what is helping progress and what is slowing it down, then make small changes that improve the operating system. Tuning cadence might involve adjusting meeting lengths, changing the frequency of certain checkpoints, or refining deliverable definition so planning becomes more realistic. Tuning scope might involve reducing work in progress, clarifying dependencies earlier, or changing the sequence of milestones. The key is that retrospectives produce changes, not just discussion, because discussion without adjustment makes people cynical. When you tune regularly, you show that the program is learning, which increases confidence that effort is not wasted. Retrospectives also protect the team from burnout by making workload and friction visible, which allows leaders to respond before exhaustion sets in.

Transparent progress depends on avoiding vanity updates and instead highlighting risks and decisions. Vanity updates are the kind that sound positive but do not convey real information, and they often hide the work that is actually at risk. When you avoid vanity updates, you give stakeholders what they need to support the program, which is reality. Highlighting risks does not mean sounding alarmist, it means naming what could derail the next milestone and what is being done about it. Highlighting decisions is equally important, because decisions are the pivot points that change outcomes, and stakeholders need to know what has been decided and what is still open. A transparent update makes it possible for leaders to help, because they can remove blockers, adjust priorities, or allocate resources with clarity. When updates are honest, trust increases, and trust is part of momentum because it reduces second guessing and redundant checking. Transparent signaling is not only communication, it is governance.

Pre-committing the next milestones within the cadence is a way to protect time to deliver, because planning without commitment often becomes a wish list. Pre-commitment means agreeing on the next set of deliverables and milestones with enough specificity that the team can defend their calendar. This is important because in most organizations, interruptions are constant, and without a protected plan, urgent requests will consume all available capacity. Protecting time does not mean refusing emergencies, it means making tradeoffs explicit when emergencies arise, so the program does not silently lose its ability to deliver. Pre-commitment also makes dependencies visible, because you can see what must happen before a milestone can complete. When a dependency looks shaky, you can address it early through escalation or sequencing. Over time, pre-commitment trains the organization to respect the program’s cadence, because the program produces results consistently. Consistent delivery is one of the strongest signals of momentum.

Connecting progress signals to business outcomes explicitly is what keeps the initiative funded and prioritized. Teams can feel busy and still lose support if leaders cannot see how the work improves outcomes they care about. When you connect deliverables and metrics to business outcomes, you translate progress into value, such as reduced outage time, reduced exposure to loss, improved customer trust, or improved delivery confidence. This does not require lengthy explanations, it requires consistent linkage, so stakeholders develop the habit of thinking about security work as business performance work. This linkage also protects the team from being seen as a cost center that needs constant justification. When business outcomes move, leadership support becomes easier, and the program is less vulnerable to shifting priorities. The explicit connection also helps teams make better local decisions, because they can ask whether a task moves an outcome or merely consumes time. When progress is tied to outcomes, momentum becomes self-reinforcing because value is visible.

Capacity shifts will happen, and sustaining momentum requires adjusting pace responsibly rather than pretending nothing changed. Capacity can shift due to incidents, staffing changes, new business priorities, or external events, and ignoring those shifts produces silent failure. Adjusting pace responsibly means updating deliverables, milestones, and expectations in a way that preserves integrity. You reduce scope, extend timelines, or re-sequence work, but you communicate the change clearly so stakeholders understand the tradeoffs. This protects trust because it shows you are managing reality rather than performing confidence. It also protects the team because it prevents chronic overcommitment, which is a direct path to burnout and quality decline. A program with responsible pacing can survive disruption because it adapts without collapsing into chaos. Momentum is not constant speed, it is consistent forward motion, and sometimes consistent forward motion requires slowing down to keep the work sustainable.

To conclude, set a cadence now and announce a recognition ritual that reinforces the behaviors you want to see, because momentum grows when rhythm and reinforcement are intentional. Define a weekly rhythm with protected checkpoints, and ensure each interval has concrete deliverables that can be verified. Choose a small set of meaningful outcome metrics and review them consistently, using them to steer decisions rather than to decorate updates. Normalize verbal progress snapshots that include blockers, and make escalation paths clear so blockers are removed quickly. Use retrospectives to tune the operating system, and keep updates transparent by naming risks and decisions rather than performing positivity. Pre-commit milestones so time is protected, and connect progress to business outcomes so support remains strong. When capacity shifts, adjust pace with honesty so trust remains intact. If you build these habits, momentum becomes less about motivation and more about structure, and structure is what keeps real change moving long after the initial excitement fades.