A security culture is not mature because employees complete annual training.
It is not mature because the organisation has a well-funded SOC, a capable CISO or an expanding stack of cybersecurity tools.
And it is certainly not mature if the rest of the business believes security belongs to somebody else.
Recent conversations with senior UK technology leaders produced an unusually direct test of enterprise security culture: if people still think security is solely the security team’s responsibility, the culture is already weak.
That matters for cybersecurity vendors because it changes what buyers need from the market.
The enterprise is not simply buying more detection, more monitoring or another awareness platform.
It is trying to create an organisation in which secure behaviour, secure architecture and secure decision-making happen as part of normal work.
Vendors that understand that operating model can become part of the buyer’s security culture.
Vendors that treat security as a specialist function may reinforce the very silo the buyer is trying to remove.
Security cannot be delegated to a department
The security team will always retain specialist responsibilities.
It will own expertise that other functions should not be expected to replicate. Threat intelligence, incident response, security architecture, vulnerability management and specialist controls require dedicated capability.
But specialist ownership is not the same as exclusive responsibility.
A finance team handles sensitive information.
HR manages identity-rich employee data.
Marketing connects platforms and customer systems.
Developers create code and integrations.
Procurement introduces suppliers.
Executives approve risk.
Every one of those decisions can change the attack surface.
That is why the discussion repeatedly returned to collective responsibility. Leaders argued that security should be embedded into everyone’s role rather than treated as work performed only by dedicated specialists.
Security culture is not demonstrated by how good the security team is. It is demonstrated by what the rest of the organisation does when the security team is not in the room.
For vendors, that means the buyer’s problem extends beyond the CISO.
A product may be purchased by security, but its success may depend on developers, business users, administrators, suppliers and executives behaving differently.
The sales proposition needs to reflect that reality.
Training is necessary, but training is not culture
Enterprise leaders discussed familiar security-culture interventions: mandatory training, phishing simulations, follow-up education and accountability.
Those mechanisms matter.
But they should not be confused with the outcome.
An employee completing a training module does not prove they will challenge an unusual payment request.
A high score in a phishing simulation does not prove that teams will question a risky SaaS purchase.
An annual policy acknowledgement does not prove that a project team will involve security before connecting sensitive data to a new AI service.
The stronger signal discussed in the roundtable was whether employees actively question security decisions.
That is a very different measure.
It suggests that the organisation has moved from passive compliance to active judgement.
One participant described the long process of building security awareness in an organisation where the culture had not previously been strong. The work took years, not a quarter, and depended on leadership, communication, training and accountability rather than a single technology intervention.
Cybersecurity vendors should therefore be careful with claims about creating culture.
Technology can reinforce behaviour.
It cannot replace leadership.
The human firewall is only half the answer
Security programmes often speak about building a human firewall.
The concept is useful, but dangerous when interpreted too literally.
Humans will make mistakes.
They will click links.
They will reuse poor processes.
They will misunderstand a warning.
They will occasionally approve something they should not.
The senior leaders in the discussion explicitly recognised this and argued for both individual awareness and collective technical protection. Mature security architecture assumes mistakes will happen and reduces the likelihood that one mistake becomes a serious incident.
| Weak security-culture assumption | Mature enterprise approach | What vendors should demonstrate |
|---|---|---|
| Users must never make mistakes | Design controls around inevitable human error | Containment, least privilege and recovery |
| Training is the main defence | Training is reinforced by architecture and tooling | Built-in controls and safe defaults |
| Security owns the risk | Business and technology share responsibility | Clear accountability and role-based controls |
| More friction means more security | Friction is applied where it changes risk | Risk-based authentication and adaptive controls |
| A policy creates compliance | Secure behaviour is embedded into workflows | Templates, automation and visible evidence |
| A tool solves the problem | Tools support a wider operating model | Integration with people, process and governance |
This is commercially important.
Vendors that sell only awareness may be asked how they reduce consequence.
Vendors that sell only controls may be asked how employees understand and use them.
The stronger proposition connects both.
The best security controls increasingly disappear into the workflow
Another recurring theme across the IT discussions was the value of controls that are built into platforms, templates and normal operating processes.
This matters because security culture deteriorates when every safe action requires exceptional effort.
If the secure route is slower, more confusing or materially harder than the insecure route, users will eventually find alternatives.
The same principle appeared in the wider governance conversations, where leaders favoured controls embedded into operational processes rather than relying only on policies and manual enforcement.
That aligns directly with the shift described in IT needs to stop being the gatekeeper.
Security should not become the department that introduces friction after the business has already chosen a direction.
It should help design the route the business can use safely.
For cybersecurity vendors, that creates a clear product challenge.
Can your controls become part of the customer’s standard way of working?
Or does every deployment create another specialist console, another approval queue and another workflow the business has to remember?
Some security friction is valuable
The pursuit of seamless user experience can create another problem.
If security becomes completely invisible, users may also become less conscious of risk.
Roundtable participants discussed this tension directly, including the balance between passwordless or highly seamless experiences and the occasional need for friction that reminds users they are performing a sensitive action.
This does not mean making security deliberately irritating.
It means applying friction intelligently.
A routine low-risk action may require almost none.
An unusual privileged action may deserve a deliberate pause.
A high-value payment, sensitive data export or new third-party connection may justify additional verification.
Buyers therefore need more than a claim that a product is secure or easy to use.
They need evidence that the user experience changes according to risk.
Security added at the end will always feel like a blocker
One of the clearest cultural failures occurs when security enters the project only after the important decisions have already been made.
The business has chosen the platform.
The commercial sponsor has promised a timeline.
The integration design is underway.
Then security discovers a data issue, access concern or architectural dependency.
At that point, even a legitimate risk control feels like obstruction.
The roundtable discussion argued for security to be integrated into business strategy from the beginning rather than added as an afterthought.
Vendors can materially improve this.
Bring security evidence into the sale before the security review.
Explain identity requirements before implementation.
Make data flows visible.
Show how permissions work.
State what the customer must configure.
Explain what happens when a control fails.
This reduces late-stage surprise and helps security act as an enabler rather than the stakeholder who arrives to stop a deal.
Shadow IT and AI are culture tests
The modern attack surface is increasingly distributed across SaaS, APIs, cloud services, suppliers and AI tools.
Another roundtable in the same programme highlighted shadow IT and unauthorised AI as continuing challenges, with education and accountability identified as important controls.
That is not simply a tooling problem.
It is a culture problem.
Employees often adopt unapproved technology because they are trying to solve a real business problem.
The security question is whether the organisation has made the safe route sufficiently accessible, understandable and useful.
Blocking every tool may suppress visible activity without removing demand.
Allowing everything creates unmanaged exposure.
The mature response combines education, controlled choice, visibility and accountability.
For vendors, particularly AI and SaaS providers, this means enterprise buyers increasingly need administrability as much as functionality.
Can the customer discover usage?
Can it control identities?
Can it restrict data?
Can it see third-party access?
Can it enforce policy without relying on every employee remembering the rules?
Security buyers are increasingly buying resilience, not another tool
The cultural argument also changes how cybersecurity vendors should position value.
The buyer does not ultimately want another dashboard.
It wants fewer damaging incidents, faster response, stronger recovery and more confidence that the organisation can continue operating when people or systems fail.
That is why UK cyber budgets are shifting toward resilience, not more tools is such an important framing for vendors.
The same principle sits behind Stop selling compliance. Start selling business continuity.
One discussion also noted increased security investment after a competitor suffered a breach.
That example should not be treated as a market-wide benchmark, but it illustrates a familiar enterprise dynamic: risk becomes easier to fund once leadership can see the operational consequence.
The stronger vendor does not wait for fear to create urgency.
It connects the control to the business consequence before an incident occurs.
What a healthy security culture actually looks like
Enterprise vendors should listen for behavioural signals, not only security maturity scores.
A healthier organisation is more likely to show signs such as:
- employees asking security questions without being prompted
- business teams involving security before selecting technology
- leaders treating security risk as a business decision rather than an IT problem
- technical controls protecting users when human judgement fails
- phishing simulations being followed by meaningful education rather than punishment alone
- security requirements being translated into language business teams understand
- secure templates and approved paths reducing the need for manual review
- suppliers being held accountable for access and security behaviour
- teams understanding when friction is intentional and why it exists
These signals matter commercially because they reveal how a buyer is likely to evaluate and adopt a security product.
A highly centralised security team may need stronger orchestration and visibility.
A distributed organisation may care more about standard controls, delegated administration and consistent evidence.
A business struggling with awareness may need technology that makes good behaviour easier rather than simply generating more alerts.
What cybersecurity vendors should change
Stop selling only to the security team
The CISO may be the commercial owner, but adoption often depends on the rest of the enterprise.
Show how the solution affects business users, developers, operations, HR, procurement and executives where relevant.
Make secure behaviour the easiest behaviour
Products that require constant specialist intervention will struggle to become part of normal business operations.
Automate the common path and reserve human attention for meaningful exceptions.
Prove how you reduce consequence, not only probability
Buyers know people will make mistakes.
Explain how segmentation, least privilege, containment, recovery and monitoring reduce the damage when they do.
Give the buyer language the business can understand
Senior leaders discussed the value of simplifying security communication and using familiar real-world analogies.
A proposition that cannot be explained outside the security function will be harder to defend when budgets compete.
Bring the evidence before the review
Do not wait for the formal security questionnaire to reveal architecture, identity, data handling, auditability and incident-response details.
Early evidence builds confidence and prevents late-stage deal friction.
Security culture is an enterprise operating model
The most important lesson from these enterprise conversations is not that every employee needs to become a cybersecurity specialist.
They do not.
It is that every part of the organisation needs to understand the security responsibility attached to its decisions.
Security teams provide expertise.
Leadership provides priority.
Technology provides guardrails.
Business teams provide context and ownership.
Employees provide judgement.
The culture succeeds when those responsibilities reinforce one another.
For cybersecurity vendors, this creates a more valuable role than simply supplying another defensive tool.
The opportunity is to help the buyer embed security into the way the enterprise actually operates.
The Leadership Board gives technology vendors direct visibility into the concerns, operating challenges and active priorities shaping conversations with senior enterprise IT leaders.
If your security proposition helps enterprises make secure behaviour part of normal business operations, The Leadership Board can help.