Communicating Security Value: We Are Failing

March 25, 2025

Why is it that decades in, cybersecurity still struggles to communicate its value to the business?

We have dozens of standards and frameworks and methodologies. Excellent books about quantifying cyber risk. Countless webinars and papers written on this very topic. Yet we still struggle to justify our existence.

I'm not saying there aren't good ideas around. I am saying, however, that the way we as an industry have consistently failed to communicate and implement them with any consistency is where the value perception gap exists.

Not to get too deep into economic theory but... to be blunt, most cyber practitioners seem to operate on the assumption that security has intrinsic value that should be readily recognized by the buy side of the equation. When it's not, cyber folks get upset.

Ironically, cyber vendors, especially VC-funded startups, understand the critical importance of perceived value, and their PR and marketing budgets reflect it.

In my long career in cyber I've only seen a handful of CISO orgs with a dedicated full-time internal comms team that went beyond rah-rah posts during cyber awareness month and phishing posters in the breakroom.

Most cyber practitioners find it beneath them to have to "convince" someone of the need for security: shouldn't it be obvious why you need us, they scoff?

Guess what: it's not obvious at all. Not when we ask business leaders to accept our fuzzy risk math and scary stories as "justification" for our existence while they try to balance their budgets and figure out their risk posture and what to do about it.

Sorry to tell you, but your scawwwy stowwwies about APT XYZ or FunkySquirrel from Whogivesacrapistan are getting old, and nobody wants to hear virus stats at board meetings.

Stop acting like the business owes us a living or their eternal gratitude because "they need us on that wall." Deliver value, be clear about why, how, where, and how much, and be absolutely sure it's understood by the folks with the checkbooks.

That, or accept Semper Inutilis as our industry motto.

hashtag#cybersecurity hashtag#leadership hashtag#risk hashtag#strategy