“Security just slows me down.”
I’ve heard it from executives my entire career, and not just about physical protection. It’s the same tone whether it’s an access badge that won’t work, a password policy that forces a reset mid-flight, or the security team insisting they need to “approve” tomorrow’s off-site.
“I don’t need a team just to go for a walk.” “Why do I have to log in three times just to send an email?” “We’ve never needed this before.” “It makes us look paranoid.”
Every organization says they value security. But few have figured out how to make it work with the business instead of against it.
The Hidden Cost of Islands
Here’s the problem: in most enterprises, security is an island. Cyber lives under IT. Legal and Compliance handle policies. Physical lives under facilities (or a dozen different departments).
And the people actually at risk, the executives, live in an entirely different world.
Each of these groups speaks a different language:
IT: uptime, credentials, data.
Legal: liability, policy, discovery.
Security: threats, protection, continuity.
And as a result? Security becomes something that happens to the business, not for it.
That’s why CEOs feel friction every time they travel, log in, or try to move fast. And it’s why, when something goes wrong, the company discovers that no one actually owned the full picture.
The Paradox: Security That Protects but Paralyzes
We’ve built so many controls to protect the business that we’ve made it harder to run the business.
Password rotations and 2FA systems that log leaders out mid-presentation.
Rigid travel-approval processes that make spontaneous opportunities impossible.
Physical access rules that lock out the very people responsible for continuity during a crisis.
Security, when designed in isolation, breeds friction. And friction kills speed, creativity, and sometimes opportunity.
Executives don’t hate security. They hate inefficient security, the kind that doesn’t understand how they actually operate.
The Wake-Up Call
After the killing of United Healthcare’s insurance-unit CEO, I spent months deploying teams across the industry. Every organization had one thing in common: they were scrambling after the incident.
But it wasn’t just a failure of protection.
It was a failure of integration.
No one had aligned physical protection, cyber posture, insurance, and governance into one framework. And when the shock hit, everyone realized too late that their “security” was really just a collection of disconnected parts.
The cost wasn’t only emotional, it was financial. Billions in market value vanished. And when the insurers started asking questions, companies couldn’t prove they had “reasonable safeguards” in place.
Security isn’t about badges or passwords. It’s about protecting continuity, and continuity is a board-level responsibility.
The Blueprint: Security as a Business Function
To work, security has to stop being a silo and start being a system. That means designing it like any other critical business function: with accountability, metrics, documentation, and flexibility.
Governance First Security should be reviewed, approved, and documented at the board level, just like finance and compliance.
Integration Over Isolation Cyber, physical, and operational teams should share intelligence, risk registers, and playbooks. A data breach and a workplace threat have the same end result: brand damage.
Insurance Alignment Treat your insurance policy as a strategic document, not a PDF in a drawer. If your policy requires “reasonable security,” define it, measure it, and document it.
Design for Flexibility Executives don’t live behind desks. Your security model should move at the speed of leadership, travel, late nights, off-site meetings, impromptu decisions.
Measure Impact, Not Activity Security isn’t about how many people you hire or how many tools you deploy. It’s about how seamlessly it protects productivity, reputation, and continuity.
From Compliance to Enablement
Security that simply checks boxes is already obsolete. The companies thriving in this next decade treat security as an enabler of velocity, not a brake pedal.
They build systems where:
Access control integrates with workforce analytics.
Threat intelligence informs business travel decisions.
Policy and tech support creative work instead of constraining it.
Protection teams coordinate with IT and Legal to reduce insurance exposure.
When security is woven into the organization, not bolted onto it, it becomes invisible, and that’s the highest form of efficiency.
The Question Every Board Should Ask
“Does our security program protect how our business actually operates, or how we wish it did on paper?”
If your answer isn’t clear, that’s your next agenda item.
Because the question isn’t whether you’re secure.
It’s whether you’ve built security that can keep up with your business.
Closing Thought
Security will always involve friction. But good security turns that friction into traction, the kind that keeps the wheels on when everything else starts to spin.
The goal isn’t to slow the business down. It’s to make sure it can survive its own speed