Matthew Rosenquist argues CISOs must shift from treating security as a technical cost-center to becoming business-risk partners. Legacy CISOs rely on fear to justify budgets and get replaced when they can't deliver value. Modern CISOs need to speak in business terms, understand attacker motivations, and show how security enables revenue.
Chapters
We've got this generation of CISOs now, technical, look at it as a technical problem, look at it as fixable. And that's what they communicate. But the reality doesn't manifest that way. And talk about stress. Yes. So there is an evolution here and it's an evolution of transformation for the CISO. We've got legacy CISOs that talk tech, right? And they're only talking tech. They're not talking business. They only see it as vulnerability management or pen testing, things of that sort. They're not even seeing or can communicate what are the type of people attacking me? What are they going after? What resources do they have? What are their go-to methods? How are they going to evolve? How are they funded? Right. They're not thinking in those terms. They're thinking strictly defensively. So, you know, they need to change in this transformation. It's It's like a cliff that's coming up. We've got 2 decades worth of CISOs, you know, going to the board and going to the CEO saying, I need money, using fear, uncertainty, and doubt to get a big bag of coins with the expectation that it's going to be fixed. And it isn't. And they're asking for 20% increase year over year. That is average. They're not getting it, but they're asking. Whereas they position themselves as an overhead, a cost center. Mm-hmm. Now, business majors here, MBAs, will understand if you have a cost center, right? An organization that doesn't revenue— doesn't generate revenue. Your goal is to reduce the cost, to introduce efficiencies and reduce the cost year over year. Well, cybersecurity increases year over year, and that does not work in the long term. At some point they say, stop enough, right? Yeah. And at that point, you've lost because you have to continually adapt because the attackers are. So at that point, it's time for the CISO to pick up their bags and move to another company because they cannot succeed. So we've built this structure in, and the way we have to move forward is better communication, better collaboration, and for CISOs to transform from technical risk experts to business risk partners, right, to help the organization understand those risks and opportunities. Because again, if you are a technical risk person, you're just there to manage the bad things. You're not actually talking about the potential business benefits. Yes, but if you want continued revenue and investment, you have to contribute to the bottom line, and that will be the transformation.
