The security team that says ‘no’ three times, stops getting asked. By the fourth problem, the business has routed around them entirely, making decisions without security input, deploying tools without review, and building exposure that the security team will not discover until something breaks.
Mike Coogan, technology executive and Chief Information Security Officer (CISO) with more than two decades of leading cybersecurity and IT transformation across industries, including Brink’s Home Security, has a name for the security culture that produces this outcome. “The department of ‘no’ is intellectually lazy,” Coogan says. “It fails to look at risk holistically, and it damages the relationships that make security actually work.”
Listening Is the Most Underrated Security Skill
When a business stakeholder says they want to drill holes in the network, they are not asking for a security vulnerability. They are expressing a desire to transfer data from a third party with minimal friction. Those are entirely different problems with entirely different solutions, and a security team that responds to the first without understanding the second has failed at the most important part of its job.
Coogan observes that security professionals are internally rewarded for saying ‘no,’ which reinforces exactly the behavior that erodes their organizational influence. Every ‘no’ without an alternative teaches the business that security is an obstacle rather than a partner. There are secure ways to deploy AI, handle authentication, run e-commerce, and manage development,” Coogan says. “The failure comes from shutting down insecure ideas without exploring the underlying goal.” The shift from reactive to consultative does not require a different technical skill set. It requires discipline to ask what the business is actually trying to accomplish before responding to how they described it.
You Can Outsource the Labor. You Cannot Outsource the Accountability
The gap between how C-suites and security teams view AI is costing organizations more than just productivity. It is costing them their competitive position. The organizations that refuse to engage with AI because of its risks are watching competitors who have embraced it move faster, execute more efficiently, and capture ground that becomes progressively harder to recover.
Coogan’s position on AI mirrors his position on security broadly; the cost of inaction is a risk that deserves the same rigorous evaluation as the risk of action. I could rattle off a thousand reasons why AI is a bad idea,” he says. “But the reality is it is being embraced industry-wide, and those who embrace it will move faster. What is the opportunity cost of not leveraging that, and how does it weigh against the cybersecurity cost?” The security professionals who cannot frame that question in business terms are the ones who become disconnected from the leadership conversations that matter.
The accountability principle applies regardless of what is being outsourced. You can delegate the labor to AI. The judgment and accountability for its outputs cannot be delegated, however. When an AI tool produces the wrong answer and the user blames the tool, accountability has not shifted. It remains with the person who chose to rely on the output without verifying it.
The Risk Nobody Is Talking About
Fourth-party risk is one of the most underestimated threats facing business leaders today, and it materializes in ways that are almost impossible to fully map. Organizations source non-core functions to third-party vendors for legitimate financial and operational reasons.
Those vendors then optimize their own operations by outsourcing to fourth parties without the original organization’s knowledge or meaningful oversight. The original organization already struggles to assess the security posture of its direct partners. Its partners’ partners are effectively invisible. “You cannot outsource the accountability,” Coogan says. The security teams that help leadership understand the chain of accountability are the ones earning a seat at the strategy table, rather than being handed a list of ready-made decisions.
Follow Mike Coogan on LinkedIn for more insights on cybersecurity leadership, business-aligned security strategy, and building security organizations.
