When security roles merge, expertise doesn't automatically follow.
Put the word “security” in two job titles and it’s easy to assume the responsibilities are closely related. The reality is that corporate security and cybersecurity are distinct disciplines, each requiring its own body of knowledge and its own leadership.
Over the past several years, I’ve watched companies move corporate security under the Chief Information Security Officer or eliminate the Chief Security Officer role altogether, folding its duties into other parts of the organization. I understand the financial appeal. What concerns me is whether the executives making these decisions fully understand what they’re giving up.
Why the Shift Is Happening
Consolidating executive positions and their supporting teams can reduce overhead, particularly when security is viewed primarily as a cost center. It's easy to put a dollar figure on a position you've eliminated. It's considerably harder to put one on the expertise that walked out the door.
Visibility certainly plays a role. Cybersecurity has become the newer, sexier, more prominent concern, and for good reason. Nation-state threats and attacks against critical infrastructure deserve board-level attention. Cybersecurity likely operates within or alongside IT, benefiting from the resources and organizational reach of one of a company’s largest departments.
On the flip side, corporate security often has a much smaller internal footprint, with services such as guarding outsourced to third-party providers. That smaller footprint can create the impression of a narrower scope, even when the function covers a great deal of ground.
Where the Functions Intersect
There is legitimate overlap between the two disciplines, particularly around access to sensitive information and critical infrastructure.
Consider a secured server room. Cybersecurity has an interest in who can access the systems inside, while physical security manages the doors, credentials, surveillance, and other controls protecting the space. Both functions contribute to protecting the same information.
That intersection, however, is only a small part of what corporate security does. Executive protection, workplace violence prevention, investigations, supply chain security, threat intelligence, travel risk management, and crisis response all require specialized knowledge that extends well beyond information security.
It Starts With People
Almost every company will tell you its people are its most important asset. Whether they truly mean it or not, that’s what they’ll say. What many organizations fail to recognize is the connection between that statement and the function responsible for keeping those people safe.
That obligation extends to the business itself. Consider a logistics company transporting high-value technology. Protecting the shipment also means safeguarding the investment and intellectual property behind it, along with the customer’s trust.
The consequences can be far more serious with consumer products. If someone intentionally contaminated a product and a consumer became seriously ill or died, the value of the product itself would be insignificant compared to the human consequences, potential liability, and lasting damage to the company’s reputation.
Physical security isn’t simply about protecting a can of soda or a laptop. It’s about understanding everything at stake when those assets are compromised.
The Six O’Clock News Test
I often refer to this as the six o’clock news test. If a security incident becomes tomorrow’s headline, what will it reveal about the organization’s preparedness, its decisions, and its ability to protect the people who depend on it?
Imagine an employee who has repeatedly reported threats from a former coworker. The warning signs are there, but no one takes ownership of assessing the threat. Then that individual shows up at the workplace with a weapon.
Suddenly, the questions aren’t about whether the building had cameras or whether the doors were locked. They’re about who knew, what was done, and whether the incident could have been prevented. Those are the questions investigators, attorneys, employees, and eventually the public will be asking.
A cybersecurity executive may be exceptionally qualified to protect an organization’s digital infrastructure and still have little experience managing a situation like this. The concern isn’t whether that executive is capable of leading, it’s whether the organization has placed responsibility for these risks with someone who knows how to recognize them, prepare for them, and respond when something goes wrong.
The Leadership Question
I've spent more than three decades in security, and I wouldn't pretend to know how to configure a firewall. That's why you hire people who do.What I do understand is the broader threat environment, including the motivations and capabilities of nation-state actors, organized criminal groups, and other adversaries. That perspective allows me to assess risk, challenge assumptions, and make informed decisions alongside the specialists responsible for technical execution.
The executive who truly knows both corporate security and cybersecurity is something of a unicorn. In more than three decades in this profession, I’ve encountered very few.
Fortunately, effective executive leadership doesn’t require personal mastery of every specialty. Consolidating both functions can work when experienced leaders are responsible for each discipline and the executive overseeing them has the judgment to establish priorities, allocate resources, and hold those leaders accountable. The organizational structure must reflect the risks being managed, not simply the number of positions leadership wants to eliminate.
Proving a Negative
Corporate security shares one challenge with cybersecurity: it’s difficult to prove a negative. Nobody sees the incidents that never happen, and neither function directly generates revenue.
That creates a trap. The better a security program performs, the less visible its value becomes. Years without a workplace violence incident, a major theft, or a threat against an executive can start to look like evidence the function isn’t needed, when it’s often evidence the function is working. The cost of protection is easy to see. The cost of going without it rarely is, until it’s too late.
I’ve written previously about the December 2024 murder of UnitedHealthcare CEO Brian Thompson, and it’s worth revisiting here. Thompson was killed in a targeted attack while walking to an investor conference in New York City, without a security detail accompanying him. His death brought executive protection into sharp focus, raising questions that extend well beyond assigning bodyguards. Who evaluates potential threats? Who determines when protection is warranted? And who has the experience and authority to act on that information?
The time to determine who owns those decisions is before an organization finds itself answering for them.
The Decision at the Top
Decisions about security leadership should be driven by the organization’s actual risk exposure and the expertise required to manage it, not by how clean the org chart looks. Reporting structures can change, responsibilities can be reassigned, and executive positions can disappear. The threats stay exactly where they were.
Consolidation can save money. Without the right leaders and operational experience, it can also create vulnerabilities that no one sees until the day something goes wrong. When that day comes, nobody will ask how much the company saved. They’ll ask who was responsible for protecting its people, its products, and its reputation, and whether that person was equipped for the job.
That’s the six o’clock news test. Sooner or later, every organization takes it. An organization can eliminate a security position. It cannot eliminate the risks that position was responsible for managing.
