The Challenge Of Integrating Security With Business Risk

Forbes

18-06-2025

Steve Carter is CEO and co-founder of Nucleus Security.
Today's chief information security officers (CISOs) have a much different role to play than their predecessors. Modern CISOs—no longer just gatekeepers of firewalls and threat feeds—are expected to operate as technical experts and strategic leaders. Yet, many CISOs struggle to live up to this expectation.
In an ideal scenario, the CISO bridges the gap between technical teams and executive management, ensuring the security program aligns with the organization's more significant goals. But what often happens is that CISOs become distant bureaucrats in their quest to function as strategic leaders, and that distance can lead to oversimplified assumptions and reliance on shiny technology "fixes" to large-scale problems.
Let's examine these challenges and how CISOs can build cohesive, risk-informed security programs.
In a bid to find that one security solution that will fix it all, many organizations have a "buy more tools" mindset. Over the past decade, this has led to a patchwork of best-of-breed solutions: an endpoint detection and response (EDR) tool here, a vulnerability scanner there—and these days, some kind of magic ticket AI solution—yet, no unifying blueprint for how each tool supports business objectives. The CISO, who should translate corporate goals into a cohesive security strategy, is often too busy or too far removed to enforce that vision.
Without tying these investments back to a genuine risk model—something that weighs not just IT threats but also potential operational disruptions—a company might end up with overlapping solutions that do little to reduce material risk.
This lack of direction is one reason CISO tenures can be short. If leadership sees big spending with unclear results, they'll question the CISO's effectiveness.
Another barrier is executives' tendency to view digital security as an "IT problem." Meanwhile, they understand and invest in preventing more tangible risks like natural disasters, supply chain disruptions or legal liabilities. The truth is that a major cybersecurity incident can be just as damaging to brand reputation, operational continuity and regulatory standing as an earthquake or a missed earnings target.
The problem here is that CISOs rarely own the company's overall risk portfolio. Their purview is typically confined to cyber risk, which leaves them isolated from broader risk conversations handled by CFOs, COOs or legal teams. This siloed setup makes it difficult to compare the chance of a ransomware attack paralyzing operations to the odds of a 7.0 earthquake hitting an office in Los Angeles.
Until CISOs can align cyber concerns with the company's full-risk appetite, cybersecurity will remain an afterthought rather than an integrated business consideration.
Why don't more organizations treat cyber threats as seriously as other hazards? In large part, it's because measuring cyber risk is notoriously difficult. Frameworks like Factor Analysis of Information Risk (FAIR) offer a structured way to estimate potential financial losses, but the data is often incomplete. Unlike insurance industries with actuarial tables dating back decades, cybersecurity lacks the same wealth of historical, standardized metrics.
Often, CISOs must make educated guesses about the frequency and impact of digital threats, which can undermine their credibility in front of the board. Meanwhile, the rest of the company uses more concrete models for traditional risks. That disconnect leads many to relegate cybersecurity to vague line items. In practice, though, a single breach can balloon into a massive financial and reputational crisis.
Ultimately, the biggest frustration for many CISOs is the struggle to integrate security programs with business goals. They need to translate corporate objectives into a workable security plan, complete with threat modeling, risk appetite definitions and ongoing assessments. But what does the translation layer look like for all these technical aspects in relation to business risk? A lot of it still revolves around just spending money on tools without a solid strategy.
CISOs should look to partner with finance, legal and operations leaders to encourage stronger collaboration in identifying and prioritizing risks across the organization. This can help ensure cybersecurity becomes a shared responsibility rather than an isolated IT issue.
Amid an ever-expanding threat landscape and constantly shifting priorities, CISOs must balance strategy, risk management and daily operations, not to mention budgeting and technology investments. It's a big job, made more difficult by the intangible, hard-to-quantify nature of cyber risk.
To succeed, modern CISOs must ensure security investments align with business goals, better quantify cyber risk and embrace collaboration with other business leaders to ensure cybersecurity is prioritized with other business risks. If they can do this effectively, CISOs can evolve from reactive gatekeepers to proactive enablers of overall business resilience.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?