Mission vs Vision vs Purpose

A few years ago I woke up in a hospital room with a monitor beside the bed drawing a line across a screen every time my heart beat.

I had sold Alpine Security in 2020. I had spent years testing medical devices, writing reports about them, arguing with engineers about them. And in that room, for the first time, I was on the other side of the equipment. The device was not a line item in a submission. It was the thing telling a nurse whether I was fine.

I remember thinking something that had nothing to do with strategy: someone wrote the code in that box. Someone decided how much to test it. Someone decided whether to fix the finding or ship the release.

That is the moment Blue Goat Cyber came out of. Not a planning retreat. Not a whiteboard. A room where the technology was working on me instead of for a client.

I bring that up because most companies write their mission, vision, and purpose statements in the opposite order. They start with the whiteboard, produce three paragraphs of noble language, put them on an About page, and never think about them again.

What most companies actually put on their website

Go read the About page of almost any company in any industry. You will find some version of this:

"Our mission is to leverage innovative, best-in-class solutions to empower our customers and deliver exceptional value while fostering a culture of excellence and integrity."

I have read that sentence three hundred times with different nouns swapped in. It has a specific tell: you could paste it onto a competitor's site and nobody would notice. It commits to nothing, so it cannot be failed, so it cannot be used.

Then, right beneath it, three headings that all say roughly the same thing in slightly different fonts. Mission. Vision. Values. Sometimes purpose, sometimes "our why." The words are treated as synonyms for the general idea that the company is good and means well.

They are not synonyms. They answer three different questions, and the difference is the whole point.

The three questions

Here is the version I use, stripped down to what each one is for.

Purpose is why you exist. It is the reason the work matters if you strip out revenue, headcount, and logos. Purpose does not change when the strategy changes. It usually predates the company.

Vision is the world you are trying to create. It is a future state, not an activity. You should be able to picture it, and you should not be in the picture. Vision is a destination you might not reach, which is what makes it worth pointing at.

Mission is what you do about it, now. It is operational. It names the work, the audience, and the outcome. A mission you cannot hold a decision up against is not a mission, it is a mood.

Statement	Question it answers	Fails when
Purpose	Why do we exist at all?	It could belong to any company in any sector
Vision	What does the world look like if we win?	It describes activity instead of a future state
Mission	What do we do, for whom, starting today?	You cannot use it to say no to something

The test I care about is the last column. A real statement kills options. If your mission does not rule out work you could plausibly take, it is decoration.

Blue Goat Cyber's three, and why they are worded that way

We only do one thing at Blue Goat Cyber, and the statements are written to keep it that way.

Purpose: protect patients. That is it. Two words, and they came from the hospital room, not from a branding session. Everything downstream has to serve a person who is attached to a device and has no idea we exist. Notice what purpose does not mention: FDA, submissions, pentests, revenue. Those are all methods. Methods change. The patient does not.

Vision: a future where connected medical devices are secure by design, trusted in clinical environments, and resilient over time. Three clauses, and each one is doing work. Secure by design means the security shows up during development, not the week before submission. Trusted in clinical environments means the people using the device do not have to think about it. Resilient over time means it holds up after launch, which is where most of MedTech actually fails. That is a world, not a task list, and we are not the hero of it.

Mission: deliver medical device cybersecurity services that reduce review friction, strengthen real-world security, and support FDA expectations across the product lifecycle. This one is deliberately narrow. It says medical device. It says across the lifecycle, premarket and postmarket both. It commits to two outcomes that pull against each other in practice: getting through review and being genuinely more secure. Plenty of firms will do one. The mission says we owe the client both.

Here is how you know these are load-bearing rather than decorative: they cost us money. A financial services firm asks us to run a network pentest, and it is real revenue for work we are fully capable of doing. The mission says medical device, so the answer is no, and we refer it out. A client wants a report that will satisfy a reviewer while a known weakness stays in the product. Vision says secure by design, so the answer is also no.

That is the function of these statements. Not inspiration. Refusal.

Write yours so they can fail

If you are drafting these for your own company, three moves fix most of it.

Start with the purpose, and go find it in your own history rather than in the industry's vocabulary. Whatever made you start this instead of something easier is closer to the truth than anything you will generate in a conference room. Mine was a hospital monitor. Yours is somewhere in the story of why you left the last job.

Write the vision as a photograph of a future you do not appear in. If your name or your product is in the frame, you have written an ambition, not a vision.

Then write the mission until it can lose you a deal. Name the audience narrowly enough to exclude someone. Name the outcome specifically enough that a client could tell you that you missed it. Read it back and ask the only question that matters: what does this stop us from doing?

If the answer is nothing, you did not write a mission. You wrote wallpaper, and wallpaper is what everyone else already has on their About page.

The three statements are not a branding exercise. They are the decision-making layer of the company, written down in advance so that you do not have to relitigate who you are every time money is on the table. Get them honest and they do the arguing for you.