UpTrajectory Review

Sebastian Schuetz argues in Harvard Business Review that firms pour money into compliance tooling, audits, and certifications yet still stumble when a real incident hits. His point is blunt: resilience grows from trust, not from checklists. Colleagues must trust each other enough to report a breach fast, share bad news early, and act on warnings without blame. The teaser gives us one sentence, but the thesis is clear and worth your attention. Compliance has become a product category, and Schuetz is pushing back on the idea that buying it equals safety.

For a small-business operator this lands close to home. You lack a dedicated security team, a general counsel, or a spare quarter to recover from a public breach. Your real defense is the bookkeeper who flags a strange wire request, or the new hire who admits she clicked a link. Compliance buys paperwork. Trust buys speed, and speed is what limits damage when an attack lands at 4 p.m. on a Friday. If your staff fears blame, they will sit on a mistake for hours or days, and that silence is what turns a contained incident into a business crisis.

The piece is new in its framing, not its facts. Security vendors have sold compliance as safety for years, and the research Schuetz cites finally names the gap between passing an audit and surviving an attack. We agree with his skepticism toward audit-driven security theater. We would push further: trust is not a soft culture word. It is an operating practice you can build with clear incident channels, blameless postmortems, and leaders who model the reporting they demand. Culture is what your team does when nobody is watching, and a binder of policies does not shape that.

The second-order effects cut unevenly. Large firms can absorb a slow, bureaucratic response and still survive the headline. A small firm often cannot; one mishandled breach can erase a decade of local goodwill. Trust also shifts cost. Training and honest conversation cost less than a compliance platform, but they demand management attention every week, not a single annual line item. Cheap to start, expensive to sustain. There is also a hiring angle: people who feel safe raising problems stay longer and catch issues earlier, which lowers your turnover and your risk at once.

Watch whether insurers and regulators begin to ask about incident culture, not just controls. A board that punishes the messenger will hide risk until it becomes a claim. Start this week: name one person to receive security reports, promise no retaliation for good-faith flags, and run a short tabletop drill with your staff. Ask each person what would make them hesitate to speak up, then fix that specific thing. Compliance may satisfy an auditor. Trust is what saves your business at 4 p.m. on a Friday.

Takeaway: Build a no-blame reporting habit this week; it limits breach damage faster than any compliance tool.