What Diving in Greece Taught Me About Cybersecurity

The tan has not faded yet. There is still a small pale line where my mask sat, and my ears did that little pressure thing on the descent into Charles de Gaulle airport.

Three weeks ago, I was down in the Aegean Sea, watching the light dance across a reef off some small Greek island whose name I will keep for myself. Voilà—I am back at my desk in Paris, badge on the lanyard, an espresso going cold beside the keyboard, staring at an inbox that filled itself while I pretended, for a few days, that the office did not exist.

And somewhere above the Mediterranean, it occurred to me: I never really stopped doing my job. I was simply doing it in a wetsuit.

Because when you think about it, diving and cybersecurity have more in common than you might expect. Here is what the sea reminded me.

The environment is unforgiving—and preparation matters

A human being is not made to breathe underwater. The sea does not hate you. It is simply indifferent. Underwater, safety is not something you take for granted. It depends on preparation, awareness, and the decisions you make throughout the dive.

Cybersecurity has a similar dynamic. Connected environments introduce risks that have to be actively managed. Security is not a destination you reach and then forget about. Systems change. Threats change. People change.

The lesson from diving is not to fear the environment. It is to understand it, respect it, and maintain the practices that let you operate confidently within it.

Plan the dive, dive the plan

Before touching the water, we did the boring part: gas planning, checking the site, and the buddy check where you go through each other’s equipment out loud. On a calm, sunny morning, it can feel a little excessive.

And then you understand the point. You practice when conditions are good so the process is familiar when they are not.

This is threat modeling. This is the tabletop exercise everyone sighs about before scheduling. This is the incident response runbook that seems like too much—until you actually need it.

Preparation gives teams something valuable when pressure rises: a plan.

The unglamorous preparation is the real job. When something unexpected happens, you want the important decisions to have been considered before the pressure arrived.

Redundancy is not paranoia—it is respect

A diver does not rely on one thing going right. The spare air source you carry is as much for your buddy as for yourself. You have a dive computer. You carry a surface marker buoy. You think carefully about the systems you depend on between depth and the surface.

At the office, we give this a more elegant name: defense in depth.

Layered controls, backups, failover, least privilege. You design systems knowing that individual components can fail, so a single failure does not have to become a larger incident.

Redundancy is not about expecting catastrophe. It is about respecting how systems behave in the real world.

Watch your gauges. Always.

Underwater you become, let us say, slightly obsessive. Air, depth, time, the no-decompression limit—you check them in a loop, almost without thinking.

Situational awareness is not simply a skill you use during the dive. It is part of the dive.

Back in Paris, this reflex simply changes its clothes. The gauges become dashboards, logs, alerts, and threat feeds. The discipline is similar: understand the state of your environment so you can recognize when something changes.

Visibility gives you time to act. And whether you are underwater or behind a keyboard, time and context tend to improve decisions.

The best divers and the best analysts share that same quiet habit: always checking.

Pay attention to what is difficult to see

Some underwater risks are not immediately obvious. A diver needs to understand what is happening even when everything appears normal.

Security teams face a similar challenge.

An attacker can sometimes operate without immediately drawing attention. A misconfiguration can persist unnoticed. Small changes in behavior or access can matter long before they produce an obvious incident.

That is why visibility matters. The goal is not to assume that something terrible is hiding everywhere. It is to understand normal behavior well enough to recognize when something is not normal.

You cannot respond to what you cannot see.

Procedures matter most under pressure

When something unexpected happens underwater, training matters. The instinct to react immediately is powerful, but a practiced procedure gives you something better than instinct alone: a deliberate response.

Security incidents create their own kind of pressure.

Alerts arrive. People want answers. Decisions have to be made quickly, sometimes with incomplete information. That is exactly when the incident response plan, the tabletop exercises, and the clearly defined roles begin earning all the time you invested in them.

The divemaster and the security lead share an important discipline: stay calm, understand the situation, and follow the process.

You cannot eliminate pressure. You can prepare yourself to make better decisions when it arrives.

You never get to feel too comfortable

This is the one I must relearn constantly.

Experienced divers grow comfortable at depth. Experienced security teams become familiar with alerts, incidents, and warnings. Familiarity is useful—it is part of developing expertise—but it can also make unusual things seem ordinary.

Confidence matters. Complacency is different.

The answer is not to remain permanently anxious. It is to keep checking the assumptions that experience makes easy to overlook.

Back at the desk

So. I am back in Paris.

The wetsuit is dry—though not for long. It will be wet again at Les Assises de la Sécurité in Monaco, with my little band of CISO divers, the #CyberDivers.

The inbox is still ugly, and the reef already begins to feel like something that happened to someone else. But I bring one thing back to the office with me, beyond the tan.

Diving and cybersecurity both reward preparation, awareness, redundancy, and disciplined response.

Neither requires heroics. Both ask you to understand your environment, know the systems you depend on, watch for changes, and trust the preparation you did before something unexpected happened.

The sea reminded me of this somewhere down in the deep, sometimes in the dark of a night dive. Paris simply offers a worse view while I practice it.

And if you are a French CISO who also disappears underwater the moment summer arrives, come find us in Monaco. The #CyberDivers always keep a spare regulator for a new buddy.

Now—where did I put the decompression schedule for my inbox?