Doing the opposite

Someone sent me a list this week. Thirty-three things that keep people stuck, split into six groups.

Mindset: fear of failure, perfectionism, procrastination, impatience, limiting beliefs, overthinking, lack of vision, negative self-talk, comparing yourself to others, fear of judgment. Decision and action: indecisiveness, overcommitting to too many things, avoiding responsibility, not taking calculated risks, waiting for the perfect moment, inconsistent effort, not prioritising, being reactive instead of proactive. Social: associating with the wrong people, ignoring mentors or advice, not networking, jealousy toward people doing better than you, needing other people’s approval. Knowledge and skills: thinking knowledge alone leads to success, not learning from your failures, not updating your skills, avoiding uncomfortable learning. Health and energy: poor physical health, poor mental health, not managing stress, lack of discipline, burnout from overwork. And one on its own: blaming external circumstances instead of adapting.

My first reaction was smug, and I am not proud of that. I read it the way you read a horoscope for somebody else. Well, I do the opposite of most of these. Then I made a coffee, came back, and read it again properly.

And the honest answer is that I have done about two thirds of them. Some of them I still do. The ones I beat, I did not beat because I am disciplined. I beat them because something went badly wrong first and the lesson was expensive enough to stick.

That is the part these lists never tell you. You do not read your way out of them.

The perfect moment does not arrive, so I started with a laptop and nothing else

In June 2025, Malaysia announced the PDPA amendment that made appointing a Data Protection Officer mandatory. Most people scrolled past it. I read it twice and saw a gap, companies were about to be told to comply with a law they did not understand, using a role they did not know how to hire for.

The perfectionist move is to wait. Build a proper team first, raise something, write a business plan, then launch. I had none of that. No team, no funding, no client waiting on the other end.

I did the opposite. I built the site myself and started calling it DPO as a service, not because it was a trendy label but because that was exactly the gap sitting in front of me. Tech, legal and governance were sitting in three different silos and nobody was bridging them for the actual buyer. So I did, alone, before I had any real right to call it a company.

Orbix shipped. It is still running, and it did not exist because I waited for the version of it I would have been proud to demo on day one.

Fear of judgment is smaller than it feels

Some of the earliest conversations I had trying to sell DPO as a service were with companies who wanted a certificate to wave at an auditor, nothing structural underneath it. That revenue would have been easy to take, and in the first few months, with no funding behind me, I needed it.

Saying no to it anyway meant a run of uncomfortable conversations with people who thought I was making my own life harder than it needed to be.

Here is what I have learned about the fear of being judged. It is almost never a career. It is almost always a specific conversation, on a specific afternoon, with a specific person who is going to be annoyed with you for about a week.

Those conversations were the whole price. They are also the reason Orbix still sells governance instead of a checkbox, and everyone who was annoyed with me then has long since forgotten.

The thing you are avoiding is usually smaller than the shape of the fear it casts.

Overthinking dies the moment you actually go

I could run a cybersecurity awareness campaign entirely from a desk in Kuala Lumpur, design one generic phishing simulation, and send it everywhere.

Instead we travel to wherever the client’s actual risk is, not just wherever is convenient for us. The person clicking a bad link at a branch office two states away is not thinking about the same things, worried about the same things, or even using the same systems as someone at headquarters. You cannot design for that from a desk. You only see the actual gap by being in the room where the risk actually lives.

I have never once solved a problem like that by thinking harder about it. Every time, the answer was standing somewhere, slightly annoyed, waiting for somebody to come and ask.

Knowledge is not the thing

I have a diploma in fine art. That is the whole of my formal training for a career that ended up building payment infrastructure for state governments.

For years I treated that as a gap to be filled. More courses, more certificates, more reading. And the certificates were fine, but not one of them has ever shipped anything.

What actually changed things was accepting that I am not the smartest person in the room about most of what my company sells. So at Orbix I hired a chief legal and compliance advisor with twenty six years in practice. I hired lawyers who have been at the bar since 1998. On paper, half my team out-credentials me on the thing we sell.

That used to feel like a weakness. It is the opposite. My job is not to be the expert. My job is to build the room the experts sit in, and to know when an answer I am being handed is thin.

If you need to be the cleverest person in your own company, you have built a very small company.

Failure is only expensive if you refuse to read it

Before any of this I had a startup called Repark. The idea was that you could contact a car owner using their number plate. We went through MaGIC, we built it, and it went nowhere.

For a while I told the story as bad luck. Wrong timing, wrong market, no funding.

It was not bad luck. Nobody wanted it. That is the entire post mortem, and it took me an embarrassingly long time to write that sentence honestly.

But once I did, it became the most useful thing I own. Every product decision I have made since starts with the same question that Repark taught me to ask, which is not is this clever but does anybody actually want this, today, enough to change what they are currently doing.

The failure was not expensive. Refusing to read it for two years, that was expensive.

Blaming circumstances, and the vendor who vanished

On a project with a hard deadline, one of our integration partners stopped answering the phone. Eleven days. At the worst possible moment.

There is a version of me that files that under bad luck, and honestly it is bad luck. It is also entirely predictable. On a project with five external dependencies, the odds that all five behave are not good. That is not cynicism, it is arithmetic.

We survived because somebody on the team had been burned before and had quietly built a fallback that was not in the plan and not in the budget.

I now assume, on every project, that at least one outside party will disappear. Not because people are bad. Because they have their own fires, and their fires are not your fires.

The one I got wrong

Not everything in this piece worked out. On that state platform, we had almost no data governance. Audit trails were thin. Access control was looser than it should have been. If you had asked me who inside the organisation could read a given citizen’s payment history, I could have given you an answer, but not one backed by a log.

Nothing happened. We got lucky.

And getting away with it is the dangerous part, because it teaches you the wrong lesson. Under Malaysia’s PDPA as it is enforced today, we would not get lucky. I now run a compliance company, and a large part of why is that exact gap. I am selling the thing I once skipped.

So no, I did not do the opposite of everything on that list. I did the opposite of some of them, usually after doing the wrong thing first and paying for it.

What the list is actually describing

Read those thirty-three things again and you notice something. Most of them are not really thirty-three separate problems. They are one problem wearing a lot of professional looking outfits. Perfectionism is fear with a good haircut. Overthinking is fear with a spreadsheet. Waiting for the perfect moment is fear with a calendar. Needing everyone’s approval before you move is fear with a committee.

This does not hold for the whole list. Poor physical health, burnout, not managing stress, those are not fear wearing a costume, they are just real constraints that catch up with you regardless of how brave you are being about everything else. Lumping them in with perfectionism would be its own kind of dishonesty. But the mindset ones, the decision ones, most of the social ones, those are almost all the same fear, dressed for a meeting.

You do not fix that by reading a list, and you certainly do not fix it by feeling superior to one.

You fix it by starting before you feel ready, having the uncomfortable conversation, going to where the risk actually lives, and letting the thing that goes wrong actually teach you.

Which is slower and less satisfying than a list. But it is the only version that has ever worked for me.