The main thing here is that a company that can't directly tie security to revenue will NEVER value it the way that security people think it should be valued. I

The main thing here is that a company that can't directly tie security to revenue will NEVER value it the way that security people think it should be valued. I can't count the number of times that some wanker used the words "I will sign off on the risk" when they didn't understand the risk that they were putting off on departments that they had no authority over. What they were really saying was, "I can tell you what to do". The truth of the thing is that business doesn't care about something being right if it can save a single penny by doing it wrong...the only way that changes is if the cost of doing it wrong becomes dramatically higher than the the savings gained from cutting corners. The operative word there is "dramatically". See the fines that companies pay to regulators when caught breaking the law as evidence.