Security looks like a cost center because it lets itself.

Most security leaders complain that the executive team doesn’t see the value. Honest answer: that’s their failure, not the executive team’s. A good security function is operational excellence — time, money, and depth defended every day, mostly invisible. Think of a fighter pilot in a war. The pilot is the only person anyone sees. But it took the engineers, the runway crew, the weapons team, the researchers — months of rigor and repetition — to put that one person in the sky to fight. Management isn’t going to discover that team. Why should they? They’re paid to ask one question: did we win?

So if you’ve got the operational depth and you’re still seen as cost, you’ve got a visibility problem. Not a value problem. Talk about the IR playbook your engineer wrote — and that it now blocks attack X in two minutes, automatically. Ship a monthly defensive-uplift report. Make the kanban visible. Make every member of the crew visible — not just the one who ran the playbook at eleven on a Sunday night.

Compliance is hygiene or it’s theater. There’s no middle.

Paper compliance looks like 99 of 100 boxes ticked. Then a hands-on practitioner goes one layer deeper into access management and finds four teams handing out permissions four different ways — none of which match the process you wrote up for the auditor. The policy passed. The practice never changed.

Why this happens isn’t mysterious. It takes technical depth to even find the four silos, and most security teams don’t have it. Then it takes a leader willing to pick a fight with all four — to design a process that’s coherent to policy and workable across teams — which is harder still. The path of least resistance is to write the policy, pass the audit, and call it done.

Management then gets the worst possible signal: the first cert was cheap. So the next one will be too. The badges go on the website. The leader keeps selling certifications. The four teams keep doing what they’ve always done. The realization that paper compliance was actively worse than no compliance arrives only after the incident. That’s the bill.

AI in defense rewards the curious. Everyone else falls behind.

Good security minds are paranoid. Great ones are paranoid and curious and willing to tinker. AI is the technological shift that reveals which kind you have. The voices saying “that sounds dangerous, we don’t have a policy for it yet” are about to age out of the field — and they should.

We’ve seen this movie. We were paranoid about cloud. We wanted the castle-and-moat back because on-prem had a clean perimeter. That stance lost. Cloud security got invented around the new shape, and now the same controls applied to on-prem look like running Windows 98 in the era of macOS Tahoe.

AI is moving faster. Running a business is becoming cheaper. The “we don’t have headcount” excuse is gone — what’s stopping security teams from spinning up agents and deterministic automations to clear the backlog of golden processes? Nothing, except the willingness to learn.

The curious will skill up, and they’ll shape how AI security gets done. Everyone else — the ones still drafting the policy that says you can’t use it — will become the cautionary tale.