Shift to Mitigation: Redefining the Cybersecurity Battlefront Today

Summary

• Growing Threats: Attacks keep getting through, so more security leaders focus on limiting damage, not only preventing breaches.
• Expert Insights: Mike Hamilton, a former Seattle CISO, argues defenders should plan to minimize impact.
• Technology and Regulation: New tools and rules shape how organizations respond.
• Collaborative Efforts: Hamilton has long pushed for sharing security resources with small public bodies.

From prevention to damage control

Security strategy is shifting. Attacks are getting more sophisticated and harder to predict, and many leaders now focus on limiting the damage of a breach rather than assuming they can stop every one. It’s a practical change for organizations and governments protecting critical data and infrastructure.

Why walls aren’t enough

For years, security meant building walls to keep attackers out. That alone no longer works. Mike Hamilton, the former CISO of the City of Seattle, co-founder of Critical Insight and now field CISO at Lumifi Cybersecurity, told Fortune in March 2025 that the industry needs to focus on minimizing impact when a breach happens.

Planning for the breach

“You’re not going to ‘win’ this thing. All you can do is minimize impact,” Hamilton said. Some breaches are nearly impossible to stop, so the goal becomes limiting the damage and recovering quickly. An earlier version of this article included other quotes attributed to Hamilton that could not be found in published interviews; they have been removed.

Tools and regulation

New tools offer better detection and response, while regulations like GDPR and CCPA push organizations to meet stricter standards for protecting data.

Rethinking access

Hamilton’s example is simple. Instead of adding another security product and hoping it catches malicious code, remove network access completely where it isn’t needed. AI and machine learning can help analyze threats in real time, but cutting unnecessary access shrinks what attackers can reach.

Sharing the load

Hamilton has also worked to help smaller public bodies that can’t afford their own monitoring. As Seattle’s CISO he helped start PISCES, a program that uses trained students to monitor networks for small communities. A quote in an earlier version describing defense as “a team sport” could not be verified and has been removed.

Public-private partnerships

Programs like that show how pooled resources and expertise can protect organizations that would otherwise go unmonitored.

Limiting the damage

The move from prevention toward damage control is a real change in security strategy. As Hamilton puts it, breaches are likely, so organizations need to plan for them. That means cutting unnecessary access, watching networks closely and practicing recovery, so that when an attacker does get in, the damage stays small.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.