For decades an imaginary line has separated cybersecurity from “the business”. Most board members and senior executives were not well versed in cybersecurity, nor understood the impact it had on the business, meanwhile many security leaders approached security as a purely technical challenge dictated by technology and regulation. However, following years of near-limitless budgets and unsatisfactory results, the time has come for both security and business leaders to recognize that they have been asking the wrong questions and taking the wrong approach.