Can Security Become a True Business Enabler?
Why it’s time to stop treating cyber security as a cost centre and start treating it as a strategic engine for growth.
By Ami Hofman
“The goal of cyber security isn’t just protection, its progress.”
For too long, cybersecurity has been viewed as the department of ‘no’: no to innovation, no to speed, no to experimentation. But in 2025, that narrative is dangerously outdated. If cyber leaders and executive teams continue to view security as a compliance obligation or worse, a financial drag, they’ll miss one of the most potent competitive advantages of our digital age.
So let’s ask the hard question: Can security become a true business enabler? and if yes, what needs to change?
The legacy problem: cyber security as a sunk cost
Most organisations still view cybersecurity as:
- A cost of doing business
- A reaction to breaches or regulation
- A tech problem, not a business strategy
This mindset has real consequences:
- According to Gartner, only 17% of global CISOs say their security strategy is tightly aligned to business outcomes
- Just 8% of Boards in Australia include members with deep cyber expertise
- Over 70% of security teams say they are not involved in product design or customer-facing innovation
We’ve created a cycle where risk is treated in isolation, not as part of core decision-making. Security is siloed. The business runs fast and when the breach happens? The CISO becomes the scapegoat.
Even worse, security is often decoupled from the very systems it’s supposed to protect. With data, apps, infrastructure and identities all living in hybrid environments, the traditional perimeter-based mindset is simply not fit for purpose anymore.
The shift: from gatekeeper to growth partner
Forward-thinking companies, especially in the US and certain parts of Asia, are flipping the model. Security isn’t slowing them down, but rather enable them to:
- Launch products faster with built-in privacy and resilience
- Earn customer trust as a brand differentiator
- Navigate compliance requirements with confidence
- Protect digital ecosystems and not just IT infrastructure
- Leverage security as a strategic asset in M&A, partnerships, and competitive bids
This requires CISOs to act less like defenders and more like co-creators of value. It also requires boards and executive teams to stop treating cyber as a risk sinkhole.
“If you cyber security team isn’t at the innovation table, you’re already behind”
A new generation of CISOs is emerging, not just technologists, but business enablers who can translate risk into value.
The psychology of the boardroom: mistrust runs deep
We can’t ignore the elephant in the boardroom. In many enterprises:
- CISOs feel underfunded and isolated
- Boards feel uninformed or patronised
- Trust is low and communication worse
Australia is particularly exposed here:
- No formal cyber subcommittees in 90% of listed companies
- Token board reporting (a quarterly slide deck at best)
- Minimal cross-sector collaboration on emerging threats
Board members in Australia are now subject to personal liability in the event of material cyber failures. But do they understand the actual risk profile of their organisation? Not really. Most receive metrics like “number of attacks blocked” or “phishing simulation success rate”, neither of which speak the board’s language: revenue, growth, and enterprise risk.
The U.S. is ahead with mandatory cyber disclosures, active board-level risk charters, and external advisors embedded into audit and governance committees.
What it looks like when it works
Some trailblazers are getting this right:
- Major financial organisations build security into their digital banking experience, promoting trust and usability hand-in-hand.
- Leading telcos use secure network posture as a selling point to enterprise customers.
- Global leaders like Microsoft, Google, and Salesforce integrate security messaging directly into their product value propositions.
In these examples, the cyber team is deeply involved in go-to-market strategy, customer experience design and risk-led innovation planning.
They’ve figured out that customers care deeply about digital trust and that security, if done well, is not just protection, it’s persuasion.
What’s holding us back?
Let’s name the blockers:
- Poor communication – Tech-heavy briefings overwhelm business leaders.
- No shared metrics – Success in security often looks like ‘nothing happened’, hard to tie to business wins.
- Short CISO tenures – Many CISOs last less than 2 years. No time to build trust or influence culture.
- Budget battles – CISOs often lack their own discretionary budget for innovation.
- Lack of cyber fluency – Less than 5% of Australian board members have professional cybersecurity experience
Until these are addressed, the enabling power of security remains unrealised.
From playbook to practice: a few simple steps to enablement
- Embed security in product lifecycle – From ideation to launch. Make security a design input, not a last-minute test.
- Treat Trust as a KPI – Track digital trust metrics alongside sales and churn.
- Align security metrics to business objectives – Not patch counts. Think customer retention, uptime, resilience.
- Upskill Executives – Deliver cyber briefings in business language, not technical jargon.
- Break Down Silos – Position cyber leaders in cross-functional teams (product, marketing, sales).
- Create Cyber-Innovation Funds – Invest in projects that combine resilience with differentiation.
Another powerful move that you might want to consider – appoint a board-level cyber advisor who reports independently from the technology team.
Cyber Is a Midfielder, Not a Goalkeeper
Think of your business like a football ⚽ team. The goalkeeper (old-school security) waits to react. The midfielder anticipates, orchestrates, and sets up the win.
That’s the new role of cybersecurity, not to block innovation, but to pass forward securely, strategically, and fast. Just like in many football teams, when the midfield is missing, the team collapses.
The opportunity ahead
A few predictions for the next 2–3 years:
- More Australian organisations will tie security metrics to ESG and trust frameworks
- Boards will form cyber oversight committees to mirror U.S. practices
- We’ll see joint accountability models between CISOs and business unit leaders
- VC funding will increasingly favour companies with provable security differentiation
We’re already seeing early signs—cyber is making its way into investor decks, IPO roadshows, and procurement checklists.
It’s not just about risk management. It’s about competitive advantage.
The opportunity ahead
A few predictions for the next 2–3 years:
- More Australian organisations will tie security metrics to ESG and trust frameworks
- Boards will form cyber oversight committees to mirror U.S. practices
- We’ll see joint accountability models between CISOs and business unit leaders
- VC funding will increasingly favour companies with provable security differentiation
We’re already seeing early signs—cyber is making its way into investor decks, IPO roadshows, and procurement checklists.
It’s not just about risk management. It’s about competitive advantage.
The opportunity ahead
A few predictions for the next 2–3 years:
- More Australian organisations will tie security metrics to ESG (Environmental, Social, Governance) and trust frameworks
- Boards will form cyber oversight committees to mirror U.S. practices
- We’ll see joint accountability models between CISOs and business unit leaders
- VC funding will increasingly favour companies with provable security differentiation
- We’re already seeing early signs—cyber is making its way into investor decks, IPO roadshows, and procurement checklists.
It’s not just about risk management. It’s about competitive advantage.
Bottomline – Can security really become a business enabler?
Yes – I honestly think it can, but only if we stop asking security to prove its ROI in isolation, and instead measure how well it enables the business to grow safely.
Security is no longer the department of ‘no.’ It’s the function that makes ‘yes’ safe to say.
It’s not about choosing between safety and speed. The best organisations know:
- You can scale AND secure.
- You can delight AND defend.
- You can disrupt AND be resilient.
But only if you let security out of the basement into the boardroom and beyond.