Many finance leaders continue to categorise cybersecurity as a cost centre – an unavoidable expense for managing “what ifs” rather than a driver for “what’s next”. This is a problem, says Jigar Sagar, entrepreneur, investor, government advisor and founder of Triliv.
Historically, we’ve justified cyber spending through a technical lens, focusing on things like firewall updates or the number of threats blocked. CFOs, however, justify their existence through revenue, ROI and strategic growth.
It’s time we addressed this blind spot. When cybersecurity is woven into a company’s strategy from the start, when it becomes part of the plan forward rather than an afterthought, it stops being a defensive expense and becomes a measurable value driver. This is why forward-thinking finance leaders are beginning to treat security like any other strategic investment that requires clear alignment with business priorities and, more importantly, defensible economic outcomes.
Why cybersecurity still looks like a cost centre
If it still looks like a cost centre, it’s because of the language barrier. We tend to talk about security in terms of technical outputs, such as patch cycles and threat indicators. That’s geek speak. And while those metrics may get the IT team excited, they feel worlds away from the board’s focus on market expansion or capital efficiency. This gap only gets wider when we talk about value as “losses avoided”. Who likes to measure things by “bullets dodged?”
This is not just my opinion – EY’s 2025 Global Cybersecurity Leadership Insights study found that 58% of security executives struggle to explain their worth in business terms beyond risk mitigation, even when they’re involved in major strategic projects. It’s time to change that conversation and bridge the gap between protection and performance.
Cybersecurity role in creating measurable business value
Cybersecurity is not just a digital padlock – it drives genuine value. But timing is everything. The previously mentioned EY study makes this abundantly clear, showing that when security is baked into strategic initiatives right from the get-go, it contributes between 11% and 20% of the total value created. We’re talking about a median impact of US $36 million per project, whether you’re navigating a merger, expanding into new markets or overhauling your digital infrastructure.
This brings into question the traditional “security as a cost centre” mindset. It proves that security isn’t just there to play defence – it’s a proactive partner in growth. Despite this, only 13% of CISOs report early consultation on strategic decisions. It makes little sense. When security leaders are brought in as an afterthought, that potential value evaporates. But when they have a seat at the table from the start, they provide the stable foundation necessary to execute bold moves with confidence.
Reframing the CFO’s conversation
The real problem for most CFOs is that they can’t break out of their traditional way of viewing finance, and they believe standard cyber metrics tell them nothing about the health of the business. It’s clear that we need to move past the “technical checklist” mindset and start treating security as the strategic investment it is. This means shifting our focus toward outcome-driven data and value benchmarks. At the end of the day, success isn’t about how many tools you’ve deployed but about how effectively those tools protect the financial results that keep the company running.
When you look at it this way, security performance starts to align naturally with financial goals. Take “uptime” for example. Instead of a dry percentage, a security team should be talking about the specific revenue saved by preventing a system crash during a major sales surge. You might also look at how much capital was preserved through early detection, or how much faster a product hit the market because security was a facilitator rather than a bottleneck.
These aren’t just IT stats – they’re core business outcomes. By focusing on this kind of tangible impact, leadership can build a narrative that holds up under scrutiny from shareholders and regulators. It moves the needle from “how many attacks did we block?” to “how is our resilience driving our commercial success?”
Moving from abstract risk to business reality
Of course, one practical way to connect cybersecurity with business goals is through a contextual, outcome-oriented framework, such as aligning cyber efforts to business scenarios and use cases.
This approach feels familiar to CFOs, much like the playbooks already used for other investments: prioritising spending where failure could trigger financial ripple effects, then balancing that against the long-term rewards. For those less steeped in technology, it has a way of demystifying security, transforming vague threats into clear, board-level priorities that resonate.
Case Example: Retailer’s cyber ROI win
A global retailer, drawing from recent EY-inspired analysis, wove security into its cloud migration from the start. Early modelling flagged a projected US $2.8M annual hit from supply-chain breaches; a targeted US $800K investment in AI-driven monitoring slashed that exposure by 70%, safeguarding US $1.96M while speeding vendor onboarding by 15%. The outcome? A 12% uplift in overall project value, spotlighted right in the CFO’s board presentation.
Why CFOs should lead the cyber investment conversation
CFOs are uniquely positioned to lead this conversation because they’re already the experts in translating risk and investment trade-offs into enterprise strategy. When they stop viewing cybersecurity as a technical silo and start framing it in terms of financial impact and business objectives, they can take a much more proactive role. This shift in focus elevates cybersecurity to the level of high-level governance and risk discussions that investors and boards prioritise.
Ultimately, forward-looking CFOs are beginning to see cybersecurity as a strategic capability tied to performance. By treating it as a core component of the business’s health, they aren’t just protecting the status quo – they’re influencing the company’s valuation and its edge in the market.
Demonstrating strategic value – not just protection
This strategic orientation leads to measurable effects that change the trajectory of a business. Organisations that involve cybersecurity early in the decision-making process don’t just protect their investments, they unlock higher value creation from their strategic initiatives. It’s the difference between building a high-performance car with the brakes already integrated into the design versus trying to bolt them on while you’re already speeding down the highway.
For the CFO, this approach does more than just secure the perimeter – it strengthens their credibility with boards and investors by linking cybersecurity metrics directly to business outcomes. The entire narrative is then shifted from a technical status update to a true performance conversation. When reporting aligns with enterprise goals, it demonstrates that security isn’t a hurdle to be cleared, but a strategic capability that supports the company’s broader success.
From blind spot to strategic advantage
Cybersecurity rarely appears as a simple line item on an income statement – but neither do brand value, customer trust or reputation. The challenge lies in quantifying its true worth. Much like these other intangible assets, well-managed security does more than shield the business; it unlocks growth, dampens volatility and underpins long-term performance.
For CFOs, the opportunity is clear: it is time to reframe cybersecurity. By moving away from the narrow view of a defensive cost centre, leaders can begin to treat it as a deliberate investment in business outcomes. This shift requires a new vocabulary, one that translates technical resilience into financial agility and market confidence.
When that reframing happens, cybersecurity stops being a burden to justify and becomes a strategic lever to pull.
