Growth is now the CISO’s top goal, but enablement is still the first thing cut

For years, security teams have been cast as the people who slow the business down.

TAL Australia’s Chief Information Security Officer (CISO), Maryam Bechtel, says the role was always meant to be bigger than that.

“A lot of the time, the mandate of the [CISO] is only seen as, ‘Oh, you just have to reduce the risk of the organisation’, and I think that’s actually wrong”, she told the audience at ADAPT’s 13th Security Edge in Sydney.

Her peers appear to agree.

ADAPT has tracked the goals of security leaders across 13 Security Edge events, and growing the business is now their #1 goal, with developing an AI strategy and roadmap at #2.

ADAPT’s Head of Strategy, Joey Meynink, says the shift shows security teams are no longer legacy blockers.

But the sessions that followed exposed a gap between the goal and the budget.

When money is tight, the work that helps the business move faster is still the first thing to go, and executives still disagree on who owns the AI risk that growth depends on.

In this article:

• Why enablement gets cut first
• What boards should measure
• Linking security to revenue
• Who owns AI governance
• Recovery as part of growth
• Five actions for CISOs
• What the funding split reveals

Three mandates, not enough money

Maryam describes three mandates for a CISO: reduce risk, stay compliant and enable the business.

The third can require investment that does nothing for the first two.

“It’s not going to reduce your risk, and it’s not going to make you more compliant because you’re trying to help the business”, she says.

The trouble starts when the money runs short.

“We have also not [got] unlimited buckets of money lying around”, she says.

“If you don’t have enough money, well, I’m just going to do the first two because [of] compliance, licence to operate, risk… and the third one might get forgotten.”

Her answer is to agree the split with the CIO and CFO up front: what share goes to risk, what share to compliance and what share to enablement.

She says finance is the relationship CISOs most often forget, even though it is central to frank conversations about how much risk buydown the organisation will pay for.

That conversation starts on the back foot.

ADAPT’s research shows CFOs rank risk and compliance, ahead of revenue or cost, as the #1 factor when allocating budget to AI, so finance is funding security’s AI work as a control cost.

Budgets were stretched well before growth reached the top of the list: in 2024, ADAPT found over two-thirds of CISOs lacked the resources to deliver a world-class security service.

If enablement doesn’t get its own line in the budget, it will keep losing to whichever risk turned up that month.

Back to top

Boards are paying for outcomes, not activity

Suncorp Group’s CISO, Keith Howard, says boards spending millions on cyber want to know what they are getting for it.

When he takes on a new role, Keith commissions two independent reviews, one for the board and one for practitioners.

“You can be compliant but not secure. You can be secure but not compliant, and you need to be both”, he says.

The board review uses a recognised framework because directors want a quantitative view.

“It’s not just about the activities, activities, activities. What’s the actual outcome in terms of risk posture, risk appetite?”

He warns boards early not to become obsessed with a NIST maturity score.

“If it’s chasing a number but not actually doing anything for your real posture, that’s a bad use of funds.”

Every dollar spent lifting a score that doesn’t change posture is a dollar that isn’t available for enablement.

Reporting posture against appetite gives directors a reason to back work that will never show up in a framework rating, and that case lands more easily when the CISO has secured executive support before it reaches the board.

Keith is clear about what good risk management can do. “Risk done well is the greatest enabler and the greatest accelerator”, he says.

Back to top

Grading your output

Greg Rattray, former Global CISO at JPMorgan Chase, dealt with around 60 regulators and spent a decade working with US financial regulators to align what they wanted with what actually worked.

He says compliance on its own rarely produces effective security.

“Where I find ineffective cyber, it’s mostly due to the lack of connection to the technology team and the business team”, he says.

“They’re doing things that are compliance-based. They’re not driven by an understanding of what the business produces and how it makes money.”

In most cyber roles, Greg says, the job is helping technology and business teams reduce risk “in a way where they’re grading your output”.

He is also wary of shopping as a strategy.

“I still see in the field a lot of thinking about buying tools as creating capability, and it almost never works that way”, he says.

ADAPT’s Head of Analytics & Insights, Gabby Fredkin, sees the same gap in AI.

As generative AI tools spread through enterprise applications, organisations are finding that individual productivity doesn’t lead to team productivity or business outcomes, he says.

Connecting security to the business also means talking to the board on its terms without diluting the substance.

Intrinsic Security MD Alex Loizou, who led security at Medibank from 2022 to 2025, through one of Australia’s most significant and public breaches, refuses to “dumb it down”.

“There’s no such thing as dumbing down, particularly with that audience, your board, your executive leadership team”, he says.

“Let’s be blunt: they’re not dumb people. They’re just not cyber SMEs.”

Alex used analogies from a house renovation he was doing at the time to translate real cyber language, because directors were being asked questions in that language.

Between Greg’s decade answering to regulators and Loizou’s experience briefing a board mid-breach, the lesson is the same: security earns its place in growth decisions by explaining risk in business terms instead of merely simplifying it.

If business owners are grading security’s output, they should help set its enablement targets.

The structure around that relationship is now a barrier in its own right, with ADAPT’s research showing fragmented or inconsistent operating models have entered the top barriers for security leaders at #4.

ADAPT’s Senior Research Director, Matt Boon, says funding and staffing gaps haven’t changed in years but the operating-model barrier has, and wants blended security, technology and business teams.

“This is a team sport more than ever”, he says.

Back to top

AI governance has reached #1 without an owner

AI will test the growth mandate first.

ADAPT’s research shows AI governance is the CISO’s #1 security priority and #1 constraint, yet only 2% of CIOs think the CISO should own it.

The controls are thin too. Only 7% of CISOs have defined controls and ownership in place for governing AI agents and non-human identities, and large enterprises score just as low.

Without an agreed owner, every new AI deployment becomes a negotiation, and the CISO gets pushed back into the gatekeeper role the growth goal was meant to retire.

Once agents can act on systems and data, an unowned non-human identity is an operational risk with nobody accountable for it.

The priority has climbed quickly.

Meynink says AI governance ranked #14 among security initiatives last year and #5 earlier this year before reaching #1.

The conversation has also become more practical.

Fredkin says ADAPT runs about 100 roundtables a year, around 25 of them on AI governance.

Twelve months ago, those sessions centred on who owns governance, algorithmic bias and ethical responsibility.

Now they focus on model visibility, shadow AI and what access agents have to change data or reach sensitive data.

“The good thing about this is a lot more tangible, and it’s a lot more addressable”, he says.

Questions about agent access are easier to assign than questions about ethics.

Someone has to decide which agents can reach which data, and answer for it when they do, which gives the executive team something concrete to allocate.

Keith’s approach is to keep AI capability and controls close together, even if the next step means building observability for agent identity first.

Meanwhile, Matt suggests that governance be treated as an architecture requirement.

Back to top

Who recovers on a bad day?

The growth mandate is arriving alongside faster attacks.

ADAPT’s research shows the pace of evolving threats jumped from the #8 barrier CISOs face to #3 in a single research wave, and cyber resilience is now their #2 concern after AI.

Rattray says boards need to prepare customers for digital disruption, and that the CISO can’t carry it alone.

“Resilience is not the responsibility of CISOs in large measure”, he says.

In the tabletop exercises he runs, the key moment comes when the CEO turns to the CIO and asks, “How fast can we actually recover all these services that we’re about to lose?”

CIOs often have return-to-operations targets, he says, but have never tested them.

Planning horizons are shrinking as well, because cyber risk is moving faster than enterprise decision-making.

Howard says the old three-year cycle no longer holds.

“There are no real kind of tomorrow problems. They’re all kind of thick and fast.”

Suncorp now runs a monthly prioritisation session based on threat intelligence.

David Gee, author, former CISO and ADAPT Advisor, says leaders need to tell the board when a bigger risk emerges and deprioritise older work to make room for it.

The business can only take on digital dependency it can recover from.

Tested recovery capacity, owned with the CIO and business leaders, is part of what makes growth safe to fund.

Back to top

Recommended actions for CISOs

Turning enablement from an intention into practice means changing how security is funded, reported, governed and tested.

1. Split the security budget into risk, compliance and enablement, and agree the mix with the CIO and CFO before the next planning round.
2. Report posture against risk appetite to the board, and decline investment whose only effect is to move a framework score.
3. Set enablement targets with the business and technology owners security supports, so they grade the output.
4. Agree AI governance ownership across the executive team, including who owns non-human identities and agent access to sensitive data, before agents move into production.
5. Run recovery exercises with the CIO and business leaders against the scenarios that matter most to operations.

Back to top

The funding split is the first test of the growth mandate

Growing the business has reached the top of the security agenda.

Whether it stays there depends on decisions that came up again and again at Security Edge: how much of the budget is set aside for enablement, how security reports to the board and who owns AI risk once agents act on their own.

As Bechtel puts it, the third mandate is the one that gets forgotten when money runs short.

CISOs who settle that split with their CFO before the next planning round will find out quickly whether the growth mandate comes with the funding to match.

Back to top