In 2022 I spent a stretch in a hospital bed with six blood clots in me, watching a Doppler ultrasound I had never tested decide what the doctors would do next.
I had spent three decades on the other side of that machine. I broke into systems for a living. I had written the reports, argued about the findings, moved on to the next engagement. Lying there, the device was not a scope item. It was the thing standing between me and a very bad outcome.
That is where the Blue Goat manifesto came from. Not from a values workshop with sticky notes on a conference room wall.
I bring it up because most companies get this layer exactly backward. They hold the workshop, generate a list of one-word virtues, print them on a wall, and then behave however the quarter demands. Integrity. Excellence. Innovation. Teamwork. Nobody can name a single decision those words ever changed.
The reason is not insincerity. It is that beliefs, principles, and values are three different things, and if you only produce one of them you have produced the useless one.
Three layers, and only one of them is testable
A value is what you care about. It is a priority, and its only real job is to break a tie. Values are worth writing down when they are ranked, because the whole point is what wins when two of them collide.
A belief is what you hold to be true. Beliefs are claims about how the world works. They justify the values. A belief you cannot be wrong about is not a belief, it is a slogan.
A principle is how you behave. Principles are testable. Someone can watch you for a week and tell you whether you followed them. This is the layer almost every company skips, which is why the other two float free.
| Layer | Answers | Test of a real one |
|---|---|---|
| Values | What do we care about most? | It is ranked, so it can lose a tiebreak |
| Beliefs | What do we hold true? | Someone reasonable could disagree with it |
| Principles | How do we act? | A teammate can be reviewed against it |
Stack them in order and each layer makes the one above it usable. The value sets the priority. The belief explains why the priority is correct. The principle turns it into behavior you can be held to. Skip the principles and you get a wall poster. Skip the beliefs and your principles feel arbitrary. Skip the values and nothing resolves when two good things conflict.
What that looks like at Blue Goat Cyber
We keep seven values. One of them is an anchor, and the other six bend to it: patient safety wins every tiebreak. Rigor, integrity, partnership, ingenuity, vigilance, and excellence all sit under it.
Ranking is the part most companies will not do. It is easy to say you value speed and safety. The question is which one you sacrifice at four in the afternoon two days before a submission deadline, and the answer needs to already exist before you are in that room.
Under the values sit beliefs. Ours are written to be arguable, because a belief nobody could dispute is decoration:
- A hacked medical device is not a data breach. It is a patient.
- Compliance is the floor, never the ceiling.
- Security is designed in, never bolted on at the end.
- Cybersecurity is not a brake on innovation, it is the runway.
- Trust is earned through what you deliver, not what you promise.
- The cheapest vulnerability to fix is the one caught in design.
- "Good enough" is not a standard when a life is the variable.
Plenty of serious people in my field would push back on half of that list. Good. That is how you know it says something.
Then the principles, which are the ones we actually get reviewed against. Obsess over critical details. Own the problem and find the solution. Listen carefully, respond clearly. Adapt the approach, never the standard. Escalate safety concerns before they are convenient. Learn fast, learn often. Grow beyond your comfort zone.
Read that fifth one again, because it is the difference between a manifesto and marketing copy. Escalate safety concerns before they are convenient. Convenient is the operative word. Every organization escalates a safety concern eventually. The principle names the timing, which is the only part that is hard.
The scenario is where the standard becomes real
Here is the concrete version. A tester finds an unauthenticated Bluetooth command that can silence an infusion pump alarm. The client's FDA submission goes in two days from now.
The value says patient safety. The belief says compliance is the floor. The principle says escalate before it is convenient. So we notify the program lead that afternoon, put it in the risk register with a clinical hazard analysis, and recommend a hold or a targeted mitigation, knowing what that does to their launch date.
The alternative is available and it is easy. Downgrade the severity so the finding fits neatly into the residual risk table and nobody's calendar moves.
That is the whole exercise. Not the wording on the page. The decision at four in the afternoon.
We have walked away from seven engagements since 2022 where the client wanted a rubber stamp instead of the truth. I do not say that to sound principled. I say it because it is the only evidence that any of this is real. A value that has never cost you revenue has never been tested, and an untested value is a preference.
How to write yours so they mean something
Three moves, and they are all uncomfortable on purpose.
Rank your values. Take the list you already have and order it, then name the anchor that wins every tiebreak. If two of them can never conflict, one of them is not a value.
Write your beliefs so a smart competitor could disagree. If everyone in your industry would nod, you have written a description of the industry, not a position inside it.
Then convert each belief into one principle a teammate could be reviewed against in a quarterly. Use verbs. Name the timing, the audience, or the trade-off. "Escalate safety concerns before they are convenient" survives that test. "Have integrity" does not.
Last thing. Publish them, and publish the part about who you are not for. Our manifesto has a section that says plainly: if you want a PDF that says pass so procurement can close a ticket, we are the wrong shop. That paragraph loses us leads. It is also the reason the clients who do come in already know what they are getting, and the reason nobody has to relitigate our standards mid-project.
Beliefs, principles, and values are not branding. They are the decisions you make in advance so that the version of you who is tired, behind, and being pressured does not have to make them alone.