Topic starter
30/07/2026 10:49 pm
TL;DR: Cybersecurity initiatives often stall because cross-team pushback, weak executive sponsorship, and misaligned incentives block adoption more often than technology gaps, according to Illumio’s analysis. The practical lesson is that security programmes succeed when they align on outcomes, not just controls, and when leaders keep the organisation engaged through delivery.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “3 Practical Ways to Win Buy-In for Your Cybersecurity Projects”.
Key questions
Q: How should security teams get buy-in for cybersecurity projects in siloed organisations?
A: Start by understanding each team’s roadmap, budget pressure and operational concerns before presenting the security plan.
Q: Why do strong security projects still stall after approval?
A: Because approval does not remove day-to-day friction.
Q: What are the main signs that a cybersecurity initiative is losing support?
A: Watch for delayed meetings, repeated objections about existing tooling, shifting ownership, and teams treating the project as low priority once the initial decision is made.
Practitioner guidance
- Map stakeholder incentives before proposing the project Identify who owns budgets, operations, uptime and user impact, then document where the security initiative helps or disrupts each group.
- Secure an executive sponsor with delivery authority Choose a sponsor who can clear roadblocks, reinforce priorities and keep cross-functional teams accountable after approval.
- Translate the initiative into shared operational outcomes Frame the project around recovery time, reduced disruption and lower ticket volume so other teams can see direct value.
Bottom line: Cybersecurity project success depends as much on organisational alignment as on technical design, especially when multiple teams own the systems involved.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:55 pm
Buy-in is part of cybersecurity control effectiveness, not a soft extra. A project that cannot secure cross-functional commitment will usually underperform even when the technical design is sound. That is especially true in identity and access work, where enforcement touches business processes, operations and user experience. Practitioners should treat adoption friction as a delivery risk with security consequences, not as a communication problem to resolve later.
A question worth separating out:
Q: How can security leaders make cybersecurity risk easier for non-security teams to act on?
A: Use a concrete story, not just a control description. Show what disruption, recovery delay or containment failure would look like for the business, then tie the security change to that outcome. People usually respond faster when they can picture the operational impact.
👉 Read our full editorial: Three ways cybersecurity projects win buy-in in siloed organisations