CISOs Should Tie Security Programs to Business Growth, Not Just Risk Reduction

Summary

The article argues that CISOs can strengthen their strategic role by connecting security work to business outcomes, such as faster customer reviews, market access and growth, and by demonstrating current security evidence rather than relying on annual audits.

Key points

• The author says CISOs are often hired for technical and security leadership but evaluated on cost, growth, customer trust and brand protection.
• The article cites surveys finding that security and compliance influence technology buying decisions, while compliance complexity can hurt profitability.
• Annual audits and repeated customer questionnaires can create workload without showing whether controls are working now.
• CISO Dave Brown describes joining sales calls and using an evidence library to shorten security reviews from weeks to same-day responses.
• The author recommends setting measurable security commitments tied to business goals, such as faster questionnaire responses and timely certifications.
• CISOs are advised to report outcomes transparently and show improvement over time.

People

Industries