The New Enablers

As cybersecurity pros broaden their reach, speaking the dialect of business is becoming crucial to the success of their efforts

In modern business, the walls between critical functions are thinning. By inviting more input from managers and leaning into cross-departmental collaboration, visionary leaders are turning barriers into breakthroughs. CISOs are learning the best ways to be heard and understood in the boardroom, demolishing their reputation as directors of the “department of no.”

CISOs are focused on cultivating operational excellence while continuously improving their critical role. “The shift is starting to happen as cybersecurity is seen less as a cost center and checkbox in a compliance exercise to more of a business enablement function,” Randall Jackson told Reboot. “It’s front of mind for most of us now, and adopting a secure by design mindset is vital.”

Jackson is Chief Information Security Officer and Head of Infrastructure at Boston-based Income Research + Management (IR+M). The independent, research-driven fixed-income management firm has approximately $128 billion in assets under management and serves 700-plus clients with a 200-plus person team. “Since 1987, we’ve focused on fixed income and delivering strong results with exceptional client service,” he said.

As more corporations begin to recognize the broad importance of the CISO role, direct access to boards is widening. “It used to filter through one or more layers between the CISO and the board and that’s changing pretty rapidly,” he said.

“CISOs have learned that our job isn’t to say no and prevent innovation or progress,” he stressed. Effective communication at multiple levels is key, particularly in the C-suite, and the temptation to spout figures that don’t directly connect to a narrative, such as reciting a list of common vulnerabilities and exposures to the board has to be resisted.

“As opposed to quoting patch metrics and other stats, we should translate our work into money saved by preventing X or Y, or brand damage, or avoiding an incident that needs to be reported to the SEC with all of the scrutiny that goes along with that and the potential fine,” he added. “If you can translate it into the language of dollars and cents, then you have their ear.”

Cybersecurity can be extremely complex, especially for companies that use M&A strategies to build their growth. In a recent blog post Jackson pointed out that M&A isn’t a checklist, it’s due diligence with a flashlight and a hazmat suit. “If you’re anywhere near a deal, a buyer, an investor or lender, you really have to treat cyber like financial controls. Verify. Don’t vibe.”

Speaking of vibes, Jackson noted that cybersecurity has become cool, quipping that he finds the rizz factor hilarious, but great. “I don’t think we’ve reached a saturation point yet and we haven’t even gotten into the crossover with AI,” he said. Having lived through the infamous dot com bubble in the 90s, the current fixation on all things AI feels familiar. “I hope we learned some lessons. There’s a ton of exciting new cyber startups. When the dust settles, I don’t think they’re all going to be around. But hopefully we’re going to be left with a solid roster of the ones who made the cut, and hopefully they made the cut for the right reasons. But cyber is in a really exciting time – there’s no question about that.”

The new storytellers

In Jackson’s view, the ability to capture that excitement by creating compelling stories can move CISOs from control leaders to outcome leaders. “Whenever you’re talking about kill chains and blast radius and such, you need to demonstrate that visually and cut to the chase: Here’s a bad actor literally owning our environment,” he posited. “This is the path between initial access and that happening and wow, it didn’t take long, did it? And that means game over … if we communicate in clear business terms you’ll find that they’re taking you seriously, they’re listening, and chances are you’re going to get approval for that tool or that hire that’s going to help prevent that from happening.”

Amongst the tools that Jackson uses at IRM is Horizon3’s NodeZero autonomous security validation platform. “We’ve used NodeZero for three-plus years to continuously test real world attack paths and verify that fixes actually close the gap,” he reported. “They’re fantastic.”

Cybersecurity is a trust business, and it’s Jackson’s job is to make trust a competitive advantage rather than a cost center. His advice to CISOs looking to take that route boils down to reducing complexity, being secure by default, and proving resilience. “Simple beats, remove the moving parts so failure modes are obvious and fixes are fast. … The safest path is really the easiest path, and evidence over assurances. Make sure you can measure it rather than accepting someone’s word. Show me, don’t tell me.

“It’s our job to show the board, the C-suite, and the stakeholders that cybersecurity is a strategic asset because without security technology they can’t conduct business, period,” he concluded. “One day you may find that instead of it being a cost center, it’s actually a profit center, which is the ultimate hope.”

As of 9/30/25.  The views contained in this report are those of Income Research + Management (“IR+M”) and are based on information obtained by IR+M from sources that are believed to be reliable, but IR+M makes no guarantee as to the accuracy or completeness of the underlying third-party data used to form IR+M’s views and opinions. This report is for informational purposes only and is not intended to provide specific advice, recommendations, or projected returns for any particular IR+M product.