Listen to the latest episode of CYBR.SEC.CAST featuring Michael Santarcangelo, founder of ValueSmith, in conversation with hosts Michael Farnum and Sam Van Ryder, and read the related article:
, and CYBR.SEC.Media
Bill Brenner
A company had assembled what it considered a world-class team of cybersecurity risk assessors. The team was highly skilled, its assessments were thorough, and its work was technically sound.
There was just one problem: Nobody seemed to care.
The assessors would complete their work, present their findings to business stakeholders and watch as those stakeholders put the reports in desk drawers. The meetings would end with polite thank-yous, but little evidence that the work had made a difference.
For Michael Santarcangelo, founder of ValueSmith and a cybersecurity veteran with three decades of experience, the situation illustrated a problem that continues to plague the industry.
Cybersecurity professionals can do excellent work and still fail to deliver value that others recognize.
In the latest episode of CYBR.SEC.CAST, Santarcangelo joined hosts Michael Farnum and Sam Van Ryder to discuss why cybersecurity's business value so often gets lost in translation — and what security professionals can do about it.
The business knows what security costs
For years, cybersecurity teams have struggled to demonstrate their contributions to the organizations they protect. They deploy technologies, conduct assessments, identify vulnerabilities and work to prevent incidents.
But much of that work happens behind the scenes. When systems function as expected and attacks are prevented, the business may see little evidence of what security accomplished.
When something goes wrong, however, security gets plenty of attention.
Farnum described that familiar frustration during the podcast, observing that cybersecurity and IT teams are often expected to keep everything working without interfering with business operations.
Santarcangelo sees a more fundamental challenge.
Organizations generally know exactly how much they spend on cybersecurity. The costs are documented in budgets, contracts, staffing plans and technology investments.
The benefits aren't always so obvious.
"Where's the column for the benefit?" Santarcangelo asked.
His explanation comes down to a simple equation: Value equals benefits minus costs.
When business leaders can see the costs but cannot identify the benefits, the calculation doesn't work in cybersecurity's favor.
And simply insisting that security is valuable won't change that.
Value is a dialogue, not a declaration
Santarcangelo believes part of the problem is how cybersecurity professionals communicate their work.
Security teams often assume that explaining what they've accomplished should be enough to establish its importance. They present technical findings, describe the capabilities of their tools and emphasize the risks they've addressed.
But that approach assumes the audience shares their understanding of what matters.
"Value is a dialogue, not a declaration," Santarcangelo said.
It's a distinction he believes cybersecurity professionals need to embrace.
Rather than announcing the value of a particular project, technology or assessment, security teams need to understand what the people receiving that work actually consider beneficial.
That requires asking questions, listening and sometimes challenging assumptions about what stakeholders need.
Santarcangelo argues that this is fundamentally a form of selling, although not in the conventional sense of pushing products or services.
His definition of sales is building relationships and helping people understand and solve their problems.
That applies to security engineers and analysts just as much as it does to consultants, vendors and executives.
Van Ryder agreed, noting that everyone participates in that process, whether they carry a sales title or not.
The objective isn't to deliver a polished pitch. It's to have a conversation that reveals where meaningful value can be created.
Cybersecurity has a signal problem
Santarcangelo takes the argument a step further, suggesting that cybersecurity's difficulty demonstrating value isn't simply a communication problem.
It's a signal problem.
Security professionals may be communicating constantly, but that doesn't mean they're exchanging information that helps stakeholders understand the benefit of their work.
A one-way presentation, regardless of how polished it is, provides little opportunity to discover what the audience actually needs.
Santarcangelo recommends asking probing questions and listening carefully to the answers.
He describes a process of exchanging stories and perspectives until both parties develop a shared understanding of the problem and the desired outcome.
This matters because cybersecurity professionals and business leaders often approach the same issue from different perspectives.
A security team might consider a risk assessment successful because it identified vulnerabilities and produced accurate findings. A business stakeholder might judge that assessment by whether it helped prioritize investments, resolve an operational concern or make a difficult decision.
Both perspectives can be legitimate. But unless the parties establish what success looks like, the security team's work may never translate into a benefit the stakeholder recognizes.
That helps explain why technically excellent assessments sometimes end up in desk drawers.
Doing the work isn't the same as delivering the benefit
Santarcangelo's career has taken him from technical security work into consulting, communication and organizational problem-solving.
He entered cybersecurity in the 1990s after asking questions about systems that were exposing files to people who shouldn't have had access. His academic background was in human ecology, a field that examines the relationships between people and systems.
That combination helped shape his understanding of cybersecurity as something larger than a technical discipline.
Technology problems, he explained, can often be self-proving. Something isn't working, someone fixes it, and the result is apparent.
Demonstrating value across an organization is more complicated.
Politics, organizational constraints, competing priorities and individual expectations all influence whether people recognize the benefits of a particular effort.
And that recognition is essential.
Security teams cannot assume that stakeholders will appreciate their work simply because it was technically correct or difficult to accomplish.
They need to connect the result to something the recipient wanted or needed.
As Santarcangelo put it, the objective is to deliver a benefit that someone else can recognize and acknowledge.
That may require security teams to rethink how they define success before a project even begins.
Instead of focusing exclusively on the number of assessments completed, vulnerabilities identified or technologies deployed, they should establish how those activities will help the organization achieve a meaningful outcome.
That doesn't make technical metrics irrelevant. It means those metrics need to connect to a recognizable benefit.
Making cybersecurity's value visible
The consequences of getting this wrong extend beyond budgets and executive perceptions.
Santarcangelo sees the personal toll on security professionals who work hard, care deeply about their responsibilities and repeatedly watch their contributions go unrecognized.
Over time, that disconnect can leave people questioning whether their efforts matter.
It's one reason he's focused his work at ValueSmith on helping professionals deliver results that others recognize as valuable.
During the podcast, he also announced plans to contribute to CYBR.SEC.Media through a series called Recognizing Cyber Value, exploring the recurring challenges that prevent capable professionals from realizing and demonstrating the benefits of their work.
He has also developed a tool called the Value Delivery Check, designed to help people examine whether they have the necessary elements in place to deliver a result that will be recognized as valuable.
The underlying message is that cybersecurity professionals don't necessarily need to work harder or produce more.
They may need to focus more carefully on which problems they're solving, who needs the results and what those people will consider a successful outcome.
For an industry accustomed to demonstrating progress through technical accomplishments, that requires a shift in perspective.
A completed assessment isn't necessarily a business benefit. Neither is a deployed technology or a dashboard filled with favorable metrics.
Those accomplishments matter when they help someone solve a problem, make a decision or achieve an outcome that matters to the organization.
Cybersecurity has spent decades explaining why its work is important.
Santarcangelo's challenge to the industry is to spend more time understanding what others actually value — and then deliver it.
Because doing valuable work and having that value recognized are two very different things.
