Most IT security teams are excellent at securing things and terrible at explaining themselves.
That gap has a real cost. A team the business sees as the department that says no gets worked around, informed late, and left out of decisions until it’s too late to influence them cheaply. A team the business sees as a partner gets called early, when a redesign is still a comment in a design doc and not a finding in an incident report. The difference between those two outcomes is not more tooling or more headcount, it’s internal marketing. Yes, marketing, the thing security people usually consider beneath them.
Why this is a marketing problem, not a technical one
Security teams tend to assume that being right is enough. If the finding is technically correct, the business should just listen. In practice, nobody automatically listens to a team they don’t understand, don’t see, and mostly hear from when something is being blocked or something has gone wrong. Every other function that wants a seat at the table, finance, legal, HR, invests deliberately in how it is perceived internally. Security usually doesn’t, and then wonders why it’s treated as a cost center instead of a partner. Positioning is not a nice-to-have on top of the technical work, it decides whether the technical work gets heard at all.
The aspects worth developing
A few concrete things, developed deliberately, change how a security team is perceived over time.
A visible identity. A name, a short tagline, a consistent look on the intranet page, the templates, the slide decks. Not for vanity, but so people recognize the team as a distinct, intentional thing, not “the guys from IT who sometimes email us.”
Language the business actually uses. Talk in terms of risk to revenue, to reputation, to a specific project’s deadline, not CVSS scores and protocol names. A finding phrased as “this could delay the product launch by two weeks if it’s exploited” gets a very different reaction than the same finding phrased in acronyms nobody in the room recognizes.
Regular, non-incident communication. If the only time the business hears from security is during an incident or a blocked request, every interaction gets coded as bad news. A short recurring update, wins, trends, what’s coming, keeps the relationship alive when nothing is on fire, so it isn’t purely transactional when something is.
Visible quick wins. Pick a handful of things that are fast to fix and genuinely help the people asking, and get credit for them, publicly. Trust builds a lot faster from “they helped me ship this safely, quickly” than from any awareness campaign.
Champions inside other teams. One person in each business unit who has a real relationship with security and translates in both directions, catches things early, and vouches for the team when it’s not in the room. This scales the team’s presence far past its actual headcount.
Being present before the ask. Show up in project kickoffs and architecture reviews as a default participant, not an approval gate invited at the end. Being in the room early, as a contributor, does more for the “partner” image than any deck ever will.
Leadership sponsorship. Someone senior enough repeating, in front of the business, that security is a partner and not a blocker. This does not replace the work above, but it gives it air cover, and it makes the message land from more than one direction at once.
None of these replace doing the actual security work well. But without them, good work stays invisible, and invisible work gets no credit, no trust, and no early seat at the table.
The logo question: carabiner or lock
Lock to Carabiner
When it came time to actually design a mark for the team, the obvious first instinct was a lock. Locks are the default symbol of the entire industry, every vendor logo, every stock photo of “cybersecurity” has one. And that’s exactly the problem. A lock says: this is the thing that keeps you out, that adds friction, that holds the door shut until someone with a key shows up. It’s not a wrong image technically, security does lock things down, but as an internal brand it reinforces the exact perception a team is trying to move away from. Nobody warms up to the mascot of “no.”
A carabiner does the opposite job with the same underlying idea. It’s still safety equipment, it still exists purely to prevent something bad from happening. But its whole purpose is to let someone climb higher, faster, and take on more exposure than they safely could without it. Nobody looks at a carabiner and thinks “the thing stopping me.” They think “the thing that lets me actually do this climb.” It connects people on a rope team to each other. It’s chosen and clipped in by the climber, not imposed on them by someone else.
That’s the actual pitch a security team should be making internally: not “we lock things down” but “we’re the equipment that lets the business take on more risk, faster, without falling.” A lock protects a static thing that isn’t going anywhere. A carabiner is for people actively climbing, moving, taking on exposure on purpose, which is a much closer description of what a business is actually doing than “vault that needs guarding.” The logo is a small decision on its own, but it’s a good proxy for a bigger one: does your team look like the thing standing in the way, or the thing making the climb possible.
Positioning a security team as a partner is mostly made of these small, deliberate choices, repeated consistently, not one campaign or one clever logo. But the logo is a fair test of whether the team has actually internalized the partner mindset, or is just saying the word “partner” while still handing out locks.
All this approach and reflexion, has been told me before. This is post is only about reflexions, years later, against something which has been learned from someone else before years ago, but still fully make sense now.