In F1, data doesn't win racesA robust, proven method does.

Every team has the same sensors

A modern Formula 1 car carries hundreds of sensors. Tyre pressure, temperatures, speed, fuel use, how the chassis behaves in every corner: it all flows back to the engineers, during the race and between races.

But all ten teams on the grid have those sensors. And since 2021, they all work under a budget cap. You no longer win by outspending the others.

So why does one team dominate a whole season? Because it runs a loop faster and with more discipline than the rest:

1. Plan: prepare the weekend from what you know. Setup, strategy, hypotheses to test.
2. Do: drive, try, test an idea.
3. Check: look at what the data says. Did the idea work? Where did we lose time?
4. Act: keep what works, fix the rest, and go again at the next race.

This cycle has a name: PDCA (Plan, Do, Check, Act). It wasn't invented in F1. It comes from industry, and it is the engine of every serious management system.

A 1.82-second pit stop is never improvised

In 2019, at the Brazilian Grand Prix, the Red Bull crew changed all four of Max Verstappen's tyres in 1.82 seconds. A world record at the time.

There is no magic behind those 1.82 seconds. There is: - a written procedure: everyone knows exactly what they do, and in what order; - repetition: the procedure is practised hundreds of times; - measurement to the hundredth: every stop is timed, analysed, compared; - continuous improvement: whatever slows things down is fixed before the next stop.

Writing a procedure isn't paperwork. It is what lets you work fast and well, under pressure, without depending on a single person.

The day the loop slows down, you get overtaken

In 2023, Red Bull looked untouchable. In 2024, McLaren took back the constructors' title. The pit stop record? McLaren beat that too, with 1.80 seconds in Qatar in 2023.

The lesson is simple: performance is not a state, it's a rhythm. The moment you stop measuring and adjusting, someone else does it better. Getting your house in order once is not enough. You need a loop that never stops.

And your company? Its data is asleep

Your company has no sensors on its tyres. But it has information everywhere: who has access to what, which AI tools your teams use, which suppliers touch your data, how long it takes to react to an incident.

During my CDO programme at MIT, one course stayed with me more than the others. Its idea fits in one sentence: every company has dormant data. It's there, in the tools, the tickets, the invoices, the access rights, the conversations with customers. And nobody realises what it says about how the business really runs.

That idea matches what I see in the field. Once you put it to work, that data gives you concrete information: - it informs a decision, instead of leaving it to gut feeling; - it shows a trend before it becomes obvious; - it reveals an opportunity for a service or product nobody had seen.

But finding the data isn't the hard part. The hard part is putting it to work, and keeping at it. A one-off reading gives you a snapshot, and the snapshot is out of date the next day. That's the F1 lesson: everyone has data, few make it work at every race.

To make it work, you need a framework. That is where the PDCA loop makes all the difference. It isn't a consultant's idea: it comes from Shewhart and Deming's work in industry in the mid-20th century, and ISO management system standards adopted it. ISO 9001 describes it explicitly, and ISO/IEC 27001 was built on it from its first version in 2005. It is the loop we use at ProHacktiv.

In practice, it isn't a one-time reading, it's a process: discover, test, adjust, evolve, master.

And every lap of the loop gets measured. Without indicators (a few simple KPIs, tracked every month), you can't tell whether you're making progress, or whether it's the process itself that needs fixing. Without that framework, you move case by case and believe you're protected without knowing where you stand. It's like driving a Formula 1 car without looking at the road.

Two standards, one loop

That framework exists, and it is recognised. It goes by two names that are often presented, wrongly, as constraints:

• ISO/IEC 27001, the information security management system (ISMS);
• ISO/IEC 42001, the artificial intelligence management system (AIMS).

These aren't checklists. They are ways of steering, built on the same loop the teams use:

ISO/IEC 27001 and ISO/IEC 42001 now share the same structure, common to all ISO management system standards. The loop is there: plan, implement, evaluate, improve.

What rigour pays back

A team that masters its loop doesn't just gain safety: it gains speed. The same goes for a company.

• You decide on facts, not impressions.
• Your ways of working become clearer, so faster and cheaper.
• You open doors: more and more customers ask for these guarantees before they sign.
• You use AI without fear, because you know what runs, on which data, and with which guardrails.
• You comply with NIS2 and the AI Act almost along the way, because a company that steers itself naturally produces the evidence it is asked for.

Security, AI and your data are not brakes. Mastered, they are engines. Master the loop, master the season.

What incident response taught me

My experience in incident response taught me one thing: on the day of the incident, nothing can be improvised.

A well-prepared incident response team, with the right procedures, tested and known across the whole organisation, changes all four tyres in 1.80 seconds. The same team, unprepared, turns the incident into a disaster. The difference isn't made during the attack. It's made before, in practice, lap after lap of the loop.

So, are you ready?

Secure, Steer & Master.

A question for Monday morning: if you had to name three indicators that tell you, every month, whether your company is better protected than last month, which would they be?