With AI adoption and cloud-based infrastructure redefining operations, enterprise cybersecurity functions have shifted from a defensive necessity to a core accelerator for digital transformation and growth, but many CISOs still have difficulty getting a seat at the table when it comes to discussing business strategy.

According to EY’s 2025 EY Global Cybersecurity Leadership Insights Study, only 13% of Chief Information Security Officers are consulted early in the process when urgent strategic decisions need to be made, despite the value that cyber roles can add.

EY’s study found that cybersecurity functions contribute a median of $36 million (£26.7m) in enterprise value to each business initiative they support, with the greatest impact seen in technology adoption (55%), enhancing brand trust and reputation (54%), driving business innovation (45%).

Added to that, nearly three-quarters (73%) of firms with more advanced cybersecurity functions, those that see CISOs and other security execs involved earlier and more deeply in business decisions, believe their ability to add value through cyber will grow in the future. 

These companies are also more likely to help roll out AI (48% vs 31%) and improve customer experience (53% vs 42%), a combination which, as the report notes, could be key to maintaining client trust, with 64% of consumers worried how their data might be used in AI systems.

CISOs are simplifying stacks, and saving cash

Not only are they adding value, security teams are actively trying to save time and money for their firms.

For example, 37% of organisations use over 50 cybersecurity tools, but many CISOs and security leaders are taking steps to simplify tech stacks and reduce tool sprawl, cutting costs and increasing productivity. 

Almost a quarter (23%) said they had completed a technology rationalisation effort in the last two years, with another 41% undertaking one, while 18% have simplified their tech platforms.     

Most companies reported that the savings created go back into beefing up their cyber defences, with 74% using them to fix control gaps and 46% expanding their attack surface coverage.

Moreover, 68% reinvested at least some of those savings into innovation and AI, suggesting that firms with more integrated cyber functions are setting themselves up to stay ahead of the emerging tech curve.

“Most organisations who are positioned to outpace their competitors in AI rollout, technology innovation and decision-making at scale are embracing a unified technology platform approach,” said Dan Mellen, EY global and US cyber chief technology officer.

Undervalued and underheard

Although the study found that most cybersecurity functions have been involved in at least one value-adding initiative, more than half (58%) of CISOs and cybersecurity execs said it was difficult for them to articulate the value of their role beyond risk mitigation.

That could be one reason that cybersecurity budgets are shrinking. According to EY, over the last two years, security budgets as a percent of annual revenue have decreased from 1.1% to 0.6%.

Recommended reading

• Two-thirds of CISOs Have Had Budgets Slashed Due to AI
• Half of Cybersecurity Professionals Expect to Burnout Within the Next Year
• Cyber Leaders Reveal Compliance and Boardroom Struggles

Here again, though, firms that embed cybersecurity as a core aspect of their business do better, requiring on average 10% smaller budgets, and are less likely to cite budget pressure as a key challenge, helping them to assist other core functions and encourage growth.

“Cybersecurity isn’t just about protecting new product and service value — it’s about creating it,” said Jeremy Pizzala, EY Asia-Pacific cybersecurity consulting leader.

“When cybersecurity teams are embedded early in product development, they help build trust into core offerings. That trust becomes a differentiator in the market and a catalyst for growth.”

Thankfully, the role of CISOs and their security counterparts is starting to be better recognised.

Last month, research from Gartner revealed that 85% of CEOs believed cybersecurity to be critical for business growth, while according to an Infosecurity Europe, cybersecurity budgets could soon be on the rise, with three-quarters of organisations expecting to plough more money into cyber functions this year.

Don’t Miss Scotland’s Biggest Tech Event!

Join us at DIGIT Expo West on 5th June at the SEC Glasgow. Get leading industry insights across AI, Cyber Security, and Data, and grow your network at Scotland’s largest gathering of tech leaders – with 1500+ attendees, 50+ speakers, and 50+ exhibitors.

Register your FREE place now at www.digitexpowest.com