In the first article in this series, I argued that AI governance is becoming a board-level security issue.
In the second, I proposed starting with the consequence of an AI use case rather than the model or provider. The consequence helps determine the level of assurance required, while governance determines whether AI should be authorised to create that consequence at all (@Kamilla Harcej).
This third instalment considers the wider commercial role of security.
Security is often described as a business enabler. The phrase is widely used, but it is not always clear what it means in practice.
It does not mean approving every proposal, weakening controls to meet a deadline or accepting risks simply because revenue is attached to them.
It means helping the organisation make informed decisions, satisfy customer expectations and move forward without creating unmanaged exposure.
Security Is Already Part of the Commercial Process
For many organisations, particularly those selling technology or services to larger enterprises, security is no longer confined to an internal control environment.
It appears throughout the commercial lifecycle:
during customer due diligence;
in requests for proposals;
through security questionnaires;
in contract negotiations;
during implementation and onboarding;
in continuing customer assurance; and
when incidents, vulnerabilities or material changes occur.
A capable security function can help buyers gain confidence more quickly.
An immature or poorly organised function can create delays, inconsistent answers and avoidable uncertainty. Evidence must be assembled repeatedly. Contractual commitments are made without understanding their operational implications. Sales teams struggle to explain how risks are managed. Customers receive different answers depending on whom they ask.
At that point, security is not merely failing to enable the business. It is introducing commercial friction.
The Objective Is Not to Remove All Friction
Some security friction is necessary.
A material risk should not disappear because a contract is valuable or a delivery date is approaching. Customers are entitled to ask difficult questions, particularly where their data, operations or regulatory obligations may be affected.
The objective is therefore not frictionless security.
It is proportionate, predictable and purposeful friction.
That also means avoiding unnecessarily “gold-plated” solutions. The strongest or most expensive control is not automatically the right one. Controls should be proportionate to the consequence, regulatory obligation and credible threat - not selected simply because they represent a theoretical ideal.
Over-engineered controls can consume scarce resources, delay delivery and reduce organisational agility without producing a commensurate reduction in risk. A simpler control that is well understood, consistently operated and properly evidenced may provide more reliable assurance than a more sophisticated solution that is difficult to sustain.
A well-designed security function therefore distinguishes between:
controls that are genuinely required;
· controls that may be beneficial but are not justified by the risk;
evidence that demonstrates those controls are operating;
issues that need remediation;
risks that may be accepted by an authorised decision-maker; and
requests that add little assurance relative to their cost.
This allows the organisation to move deliberately rather than oscillating between obstruction and uncontrolled approval.
What Security as a Commercial Enabler Looks Like
Commercial enablement begins before a customer sends a questionnaire.
Security requirements should influence service design, architecture, operating processes and contractual positions from the outset. It is considerably easier to demonstrate a control that was designed into the service than to invent a justification after a customer has identified a gap.
The organisation should also maintain a reusable body of current assurance material. Depending on its business and risk profile, this might include:
independently validated certifications and assurance reports;
clear descriptions of the control environment;
architecture and data-flow information;
privacy and data-processing documentation;
incident-management and resilience arrangements;
vulnerability-management summaries;
standard contractual security positions; and
approved responses to frequently raised customer questions.
This is not simply a document repository. The evidence must be owned, maintained and traceable to controls that operate in reality.
The same principle applies to AI governance.
A statement that the organisation uses AI responsibly is of limited value without evidence showing which use cases are permitted, who authorised them, what data may be used, how outputs are reviewed and how significant consequences are controlled.
Engage Early, Not at the Approval Gate
Security cannot enable a proposition it only sees immediately before launch or contract signature.
Early engagement allows security teams to identify viable routes rather than merely describing problems. A proposal might be acceptable with additional monitoring, restricted data use, human review, a contractual limitation or a staged deployment.
This is where risk-based governance becomes commercially useful.
Risk tiering helps determine the depth of review, evidence and oversight required. It prevents low-consequence activity from becoming trapped in unnecessarily heavy governance while ensuring that high-consequence activity receives meaningful scrutiny.
However, tiering does not make the decision.
Governance still determines whether the organisation is prepared to authorise the proposed outcome, under what conditions and who will be accountable.
That distinction prevents risk scoring from becoming an automated substitute for judgement.
Commercial Enablement Requires Boundaries
A commercially aware security function must also be willing to say no.
When the answer is no, the reasoning should be clear and defensible.
It should identify:
the material consequence;
the control or evidence that is missing;
the organisation’s risk boundary;
whether an alternative route exists; and
who is authorised to accept any residual exposure.
A vague objection such as “security will not approve this” creates frustration.
A clear statement that the proposal would expose regulated data to an unapproved service, without an enforceable retention position or adequate human oversight, creates the basis for a decision.
This is not obstruction. It is governance.
Measure More Than Compliance
Traditional security metrics remain important, but they do not fully demonstrate commercial contribution.
A security function acting as an enabler should also understand:
how long customer assurance takes;
where reviews repeatedly become blocked;
which control gaps delay onboarding;
how often non-standard contractual commitments are requested;
whether approved evidence is being reused effectively;
how many exceptions become permanent workarounds; and
whether security involvement is occurring early enough to influence design.
These measures connect security activity to business execution without reducing security to a sales support function.
The aim is not to claim ownership of revenue. It is to show how effective governance reduces buyer uncertainty, supports enterprise procurement and prevents avoidable security issues from delaying or undermining commercial activity.
Trust Must Be Operational
Security becomes commercially valuable when trust can be demonstrated rather than asserted.
That requires sound controls, credible evidence, clear accountability and decisions that can withstand scrutiny.
The strongest security functions do more than protect the organisation.
They help the organisation pursue opportunities without losing control of the risks, understand which opportunities are supportable, identify what must be true for them to proceed and determine where the boundary should remain firm.
The technology matters.
The commercial opportunity matters.
But neither should bypass the governance decision.
Security enables the business when it makes the safe, supportable path clear and helps the organisation travel that path with confidence.
Personal commentary. Views are the author’s own.