CISOs: Your Cyber Program Is A Profit Center, Not A Cost Center

SANS Cybersecurity Leadership Summit 2025 CISOs: Your Cyber Program Is A Profit Center, Not A Cost Center Jeff Pollard, VP, Principal Analyst, Forrester Cybersecurity programs - and CISOs - often consider themselves a "cost center" with minimal ability to help the business make money. This session will bust that myth once and for all. This talk will teach CISOs how three factors have converged to make cybersecurity a profit center for their enterprise. Those three factors include: 1) regulatory requirements (the one we are most familiar with) 2) customer / partner requirements (the new one) and 3) cyberinsurance requirements (another newer one). I will then explain how to use these three externalities to showcase how cybersecurity is a profit center for the enterprise. This includes case studies and metrics for CISOs to put this into practice in their program. Case studies include: using customer and partner security requirements - along with customer revenue - to make the case for security spending and prove a true return. Metrics include: using time spent on third party risk management questionnaires to demonstrate how security has a direct impact on contribution to revenue during the sales cycle. Finally I'll wrap up with a few actionable steps to explain what they can do in the next 30, 90, and 180 days to put this into practice with an emphasis on storytelling and presenting to the Board to make sure these contributions don't go unrecognized. View upcoming Summits: http://www.sans.org/u/DuS