Security Exists to Serve the Business
Written in October 2022. Security moves fast, so some details may have changed since.
Most security people I know got into this field because they like finding problems. That instinct is useful. It also gets us into trouble when we forget who the problems actually belong to.
Every company exists to make something, sell something, or serve someone. Security is one of many things that help it keep doing that. Accept that, and a lot of the friction between security and everyone else makes sense.
Risk decisions belong to the business
When I say business context matters more than risk context, I mean the business gets the final call on most risk. Security's job is to make sure the people making that call understand what they're agreeing to.
This isn't a fringe idea. NISTIR 8286, published in October 2020, is all about feeding cybersecurity risk into enterprise risk management, so leaders can weigh it alongside everything else. The 2020 NACD Director's Handbook on Cyber-Risk Oversight tells boards to treat cyber as a strategic enterprise risk and decide which risks to accept, mitigate, or transfer. Notice who's doing the deciding.
What it looks like when we get this wrong
Picture a release promised to a major customer by quarter end. Two weeks out, a review turns up a medium severity issue in a new API. Security says it can't ship. Engineering says it has to. A VP overrides security, and the product goes out with nobody writing down what was accepted or who owns the fix.
Security lost that fight and burned credibility for the next one. A better outcome was right there: ship on schedule, put a compensating control in front of the API, fix it next sprint, and get a named owner to sign off on the gap.
I see a lot of security teams treat every finding like a hill to die on. After a while, people just stop asking them.
The exceptions
There are times when security should push hard.
The first is when someone's life, health, or physical safety is on the line. Think medical devices or industrial control systems. Revenue doesn't outweigh that.
The second is an obvious hole in the defenses. I mean basic, well understood gaps like:
- an internet-facing admin panel or database with no authentication
- unpatched vulnerabilities on exposed systems that attackers are known to be exploiting
- no MFA on admin or remote access
NIST's SP 800-39, Managing Information Security Risk, published in March 2011, frames risk response around the organization's risk tolerance, and a bug that attackers are actively exploiting on your perimeter is well outside anyone's tolerance. Bugs like that should jump the queue. If one is sitting out there, I'd fix it first and argue about schedules later.
Even then, escalate rather than obstruct. Write it up in plain language, say what could happen and how likely it is, and take it to the person who owns the risk. If they won't act, go up a level, and keep going until someone with real authority accepts it on the record. Once a senior leader reads "anyone on the internet can log into this," things usually move fast.
How to get better at this
Learn how your company makes money. Read the annual report, sit in on a sales call, ask finance what worries them. You can't weigh a risk against revenue if you don't know where the revenue comes from.
Translate findings into business terms. "Remote code execution on the order service" means something to us. "Someone could take down checkout during the holiday rush" means something to everyone.
Offer options instead of a flat no. Lay out two or three paths with different costs and risk levels, and let the owner pick. They choose the safer one more often than you'd think.
Document risk acceptance with an owner's name and a date to revisit it. That protects the company, and honestly it protects you too.
Pick your fights. If you spend your credibility on every medium finding, you won't have much left when something truly dangerous shows up.
Where that leaves us
Years on the offensive side can leave you convinced everything is broken. Plenty of things are. The business still has to run, and the people running it are usually making reasonable tradeoffs with the information they have. The security folks I respect most give them better information, flag the few things that can't wait, and help with the rest.