It is a common refrain among senior folks in enterprise cybersecurity: “We have to learn to align with the business.” Unfortunately, it seems like we spend most of our time trying to get the business to “align with cybersecurity” and become frustrated when they don’t or can’t. Part of the reason is that we often don’t want to (or can’t) speak like the business. The reality is that cybersecurity is a cost center in organizations. Not only that, it is a cost center where it can be extremely difficult to recognize the value, of which there is plenty. (See my previous article on board-level cybersecurity metrics.)