By Ann Marie van den Hurk, Mind The Gap Advisory
Every organization has one. The person who always swoops in. Always available. Always solves it. Always saves the day.
That indispensability feels like an asset. It isn’t.
Heroics are expensive workarounds for governance failures. And the organizations that depend on heroes instead of structure are one absence away from finding out.
The hero is a governance problem wearing a cape
When someone steps in to make a decision — when they override the confusion, cut through the uncertainty, and just handle it — everyone exhales. Problem solved. Crisis averted.
And the hero gets rewarded. Quietly, informally, but consistently. People route to them. Leadership trusts them. They become indispensable.
But every time someone steps in to make a decision, the underlying gap goes unfixed. The authority that should have been delegated was not. The escalation path that should be clear remains invisible. The documentation that should exist does not.
The hero becomes the patch over all of it.
Over time, people stop trying to find the right process. They go straight to the hero. And the hero — because they are good at their job and they care — keeps saying yes.
Until they cannot.
Resilient organizations and dependent organizations are not the same thing
When the hero is sick, traveling, or simply unavailable, the organization that looked resilient reveals itself to be dependent.
There is a difference between those two things.
Resilient organizations can absorb the absence of any individual. Dependent organizations cannot.
In a breach, a regulatory action, a supply chain failure, an AI-generated deepfake of your CEO — heroes get overwhelmed fast. The volume of decisions, the speed of events, the pressure from every direction exceeds what any one person can carry.
What holds in that moment is not a hero. It is structure. Documented authority. Clear escalation. People who know what they are empowered to decide and act without waiting for permission.
The World Economic Forum framed it this way in its 2026 cyber resilience report: the challenge in a serious incident is no longer technical. It is organizational decision-making under pressure. When legal, finance, communications, and executive leadership are not aligned, even a technically well-managed incident escalates into a business crisis through delayed decisions, inconsistent messaging, and avoidable reputational damage.
That is the hero trap in operational terms. The organization is not failing because of bad technology. It is failing because authority was never designed. It was personified.
This is how governance drift accelerates
Governance drift does not announce itself. It grows quietly in the ordinary moments when someone steps in so the process does not have to work.
Every heroic save reinforces the pattern. The authority that should have been delegated stays with the person. The documentation that would have made the process repeatable never gets written. The escalation threshold that should be clear stays undefined.
And the organization becomes increasingly dependent on individuals it cannot afford to lose.
Before you celebrate the hero in your organization — or before you accept the role yourself — ask the harder question. What governance failure is the hero covering for?
That is where the real work is.
What assessors and regulators are actually looking for
For organizations working toward CMMC compliance, this is not abstract.
Assessors are not looking for heroes. They are looking for documented, repeatable processes. “We have someone who handles that” is not a control. It is a single point of failure with a name attached to it.
The same standard applies in any regulated environment. Regulators assess whether an organization can identify issues, escalate appropriately, and make defensible decisions under time pressure. A person is not a process. And a process that only works when the right person is in the room is not a process at all.
When someone always swoops in to save the decision, the organization never has to answer who was actually authorized to make it. That question does not disappear. It surfaces at the worst possible moment — when the hero is not there.
What designed authority looks like instead
Designed authority is explicit. It names who decides. Under what conditions. Without having to ask.
It does not depend on any individual being available, willing, or healthy. It is documented, tested, and understood by the people who need to use it — before the pressure arrives.
The organizations that navigate AI and cyber crises with their operations and reputations intact are not the ones with the most capable individuals. They are the ones that built their decision authority structure so that the absence of any one person does not stop the right decisions from getting made.
Heroics are expensive workarounds for governance failures. The goal is not to find better heroes. The goal is to build an organization that does not need them.
If your organization is depending on individuals instead of structure
Governance Gap Map
A 90-minute structured session that surfaces where governance drift has created decision authority gaps — and what that exposure looks like before a mandate, deadline, or incident forces it into view. Written finding delivered within 48 hours.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations across New England, nationally, and globally. mindthegapcyber.com