This article is based on the latest episode of CYBR.Signal, where I share the boxing experiences behind these five lessons and what they mean for cybersecurity resilience. Full episode:
, and CYBR.SEC.Media
Those who know me are well aware that, physically, I'm probably the least graceful person on the planet.
Coordination has never been my strong suit. My left and right sides don't always communicate particularly well, and there have been plenty of moments when my brain has issued instructions that my arms and legs have apparently chosen to ignore.
But two years ago, I started taking boxing classes at LFG Fitness in Salem, New Hampshire. And something remarkable happened.
I got better.
Not ready-for-the-ring better. But my coordination has improved dramatically. My endurance is stronger. I've developed upper-body strength that years of walking three and a half miles most mornings never quite delivered.
I've also made new friends, learned to accept a steady stream of corrections from my instructors ("I said lateral lunges, not lateral leans!")
More importantly, boxing has reinforced some lessons about resilience that apply directly to the cybersecurity profession I've spent more than 20 years covering.
Whether you're throwing punches or defending networks, success comes down to preparation, awareness, discipline, recovery, and the willingness to keep learning.
Here are five lessons I've taken from the gym.
1. You can't defend what you can't see
One of the first things you learn in boxing is to keep your hands up and your eyes open.
Drop your guard, lose track of what's happening, or fail to recognize an opening, and you're vulnerable.
Cybersecurity teams face the same problem every day.
Organizations continue to struggle with incomplete asset inventories, expanding attack surfaces, identity sprawl, and adversaries who know how to exploit the gaps between security tools and teams.
The problem isn't necessarily a shortage of security data. Many organizations are drowning in it.
The problem is knowing what matters.
Visibility needs to go beyond identifying devices and collecting alerts. Teams must understand how assets connect, which identities have access to sensitive systems, where exposures create meaningful risk, and how attackers could move through the environment.
A boxer who sees a punch coming has a chance to respond.
A security team that recognizes an attack path before an adversary exploits it has a similar advantage.
The lesson: Visibility is only valuable when it produces awareness that can drive action.
2. It's not the first punch that hurts. It's what happens next.
I don't spar, and I have no intention of getting punched in the face anytime soon.
But boxing classes have provided plenty of opportunities to make mistakes.
I've lost my rhythm, botched combinations, and gotten tired enough that my technique fell apart. Sometimes the instructions are perfectly clear, but my body seems to have other plans.
The question is what happens next.
Do I get frustrated? Do I try to compensate by punching harder? Or do I reset, listen to my instructor, and make the adjustment?
Cybersecurity resilience depends on the same ability to recover with purpose.
Despite years of investment in prevention, organizations still experience breaches, ransomware attacks, service disruptions, and other security incidents.
Prevention matters enormously. But resilience requires accepting that prevention can fail.
When that happens, the organization's ability to contain the damage, communicate effectively, maintain critical operations, and recover becomes the measure of its preparedness.
The same goes for what happens afterward.
A team that restores service but fails to learn from the incident has missed an opportunity to become stronger.
The lesson: An incident doesn't have to define an organization. How it responds, recovers, and improves afterward matters just as much.
3. Don't burn out in round one
This may be the most personally humbling lesson boxing has taught me.
When I started, I assumed the objective was to throw punches as hard and fast as possible until the timer went off.
That strategy lasted about as long as you'd expect.
Exhaustion changes everything. Your form deteriorates. Your hands drop. Your punches become sloppy. The techniques you've been practicing suddenly seem much harder to execute.
Cybersecurity has its own version of this problem.
Security professionals face relentless alerts, expanding responsibilities, constant vulnerability disclosures, and pressure to respond immediately to every new threat.
And too often, organizations mistake nonstop activity for effectiveness.
But a security team operating in permanent crisis mode eventually loses its ability to distinguish genuinely urgent threats from routine noise.
Burnout isn't just a workforce problem. It's an operational risk.
Exhausted analysts make mistakes. Overextended teams miss warning signs. Leaders who treat every issue as an emergency make it harder for employees to recognize the situations that actually require immediate action.
Boxing has taught me that pacing is part of performance.
The same principle should guide security operations.
Prioritize the threats that matter most. Automate repetitive work where it makes sense. Give people time to recover. And build processes that don't depend on everyone operating at maximum intensity indefinitely.
The lesson: Sustainable security requires sustainable people.
4. Train like it's real
Knowing how to throw a punch and executing it correctly are two very different things.
I can understand the mechanics of a jab, cross, and hook. But when an instructor starts calling out combinations, everything has to work together.
Hands. Feet. Hips. Breathing. Timing.
And that coordination doesn't happen automatically.
It takes repetition, correction, and practice.
Cybersecurity teams should approach incident readiness the same way.
An incident response plan may look excellent on paper. It may contain clearly defined responsibilities, detailed procedures, and carefully documented escalation paths.
But how well will it work when an actual attack unfolds?
Does the security team know when to involve IT operations? Can leadership make decisions under pressure? Are communications, legal, and business continuity teams prepared to work together?
Tabletop exercises, threat modeling, adversary emulation, and purple-team exercises help answer those questions before a real crisis exposes the weaknesses.
Just as important, exercises need to reflect realistic conditions.
It's easy to execute a response plan when everyone knows what's coming, the systems cooperate, and the scenario unfolds exactly as expected.
Real incidents rarely provide those conveniences.
The lesson: The time to discover that your organization isn't prepared for an attack is during an exercise, not during the attack itself.
5. Keep your chin down, but your eyes open
Boxing has a way of keeping your ego in check.
Just when I think I've mastered a technique, an instructor spots something else I need to correct.
Sometimes the heavy bag itself provides the reminder, swinging back and smacking me when I'm not paying attention.
It's not exactly a knockout punch, but it gets the message across.
Cybersecurity professionals need that same combination of humility and awareness.
The threat landscape keeps changing. Technologies evolve. Attackers adapt. Defenses that worked yesterday may be inadequate tomorrow.
Experience matters, but experience can also become a liability when it hardens into certainty.
The most effective security professionals I've encountered over the years tend to share a few qualities: They remain curious, acknowledge what they don't know, and are willing to reconsider their assumptions.
That doesn't mean operating in constant fear.
It means understanding that confidence and humility aren't mutually exclusive.
Know your weaknesses. Recognize your blind spots. But remain alert to opportunities to improve.
The lesson: Good security requires the confidence to act and the humility to recognize when your approach needs to change.
The most important lesson: Take criticism as an invitation to improve
There's one lesson that ties all five together, and it may be the most important thing I've learned in two years of boxing.
Take criticism.
At the gym, my instructors regularly remind me to keep my hands up, drive from my legs, stop arm-punching, and remember to breathe.
Sometimes I hear the same correction several times in a single class.
It would be easy to get defensive. After all, nobody particularly enjoys being told they're doing something wrong.
But my instructors aren't criticizing me to make me feel bad. They're trying to make me better.
Cybersecurity has a similar challenge.
Organizations invest heavily in expertise, processes, and technology. Over time, teams become comfortable with their methods and assumptions.
When somebody challenges those assumptions, the natural reaction can be to defend the existing approach.
We see it in post-incident reviews, security assessments, vulnerability management discussions, and debates over new technologies.
But constructive criticism isn't an attack.
It's an opportunity to recognize what isn't working and make it better.
That requires a culture where people can question decisions, report mistakes, and suggest improvements without fear of embarrassment or retaliation.
It also requires experienced professionals to accept that they still have things to learn.
After more than 20 years in cybersecurity, I certainly do.
And after two years of boxing, I can assure you that I have plenty left to learn there, too.
Resilience isn't perfection. It's progress.
I'm not a boxer. Not even close.
I don't spar. I still struggle with certain exercises because of a chronically weak back. My coordination, while dramatically improved, isn't going to win me any awards.
But I'm stronger than I was two years ago.
Physically, mentally, and emotionally.
And I've learned that progress rarely happens when everything is comfortable.
It happens when you show up, challenge yourself, make mistakes, accept feedback, and keep working.
The same is true for cybersecurity teams.
Resilience isn't about building an organization that never gets hit. It's about building one that can anticipate threats, withstand disruption, recover effectively, and emerge better prepared for the next challenge.
Whether you're defending networks or throwing jabs, the fundamentals are remarkably similar.
Discipline. Awareness. Recovery. Heart.
And perhaps most important of all, the willingness to recognize that you can always get better.
Because the next correction you receive might be exactly what you need to improve your defense.
