Key Takeaways

• Institutional investors view physical security as a material business risk and expect companies to prioritize it accordingly.
• Framing security proposals around executive priorities—timing, brand protection, and operational continuity—makes them more persuasive.
• Proposals must link specific enhancements to real threats and to the policies, training, and processes that ensure effective implementation.

It’s probably to be expected that a survey of chief security officers (CSOs) would find that they think physical security should be a higher business priority; and, indeed, a recent global study revealed just that. Of more than 2,300 CSOs surveyed, 82% think companies would be smart to give physical security more attention.

What is likely to come as a surprise, however, is that an even higher percentage of institutional investors—an eye-popping 92%—also think businesses should make security a bigger priority (World Security Report 2025).

“In an increasingly volatile and polarized world, physical security has become a critical strategic imperative, a corporate value driver, and a barometer of a company’s financial health and market perception,” according to the study. “This is powerfully demonstrated in the views of both chief security officers (CSOs) and global institutional investors [and] indicates that institutional investors are even more concerned about physical security than those at the forefront managing it day to day.”

But as practitioners know all too well, it can be an enormous challenge to get top company management to re-prioritize. So, what actions might help company management recognize that the security mission is integral to long-term strategic business objectives?

Using Executive Priorities to Shape Opinions

Global business surveys indicate that it is still common for company security representatives to be somewhat isolated in their organizations, with management holding the view that the security mission is separate from long-term strategic business objectives. Many corporate executives still think of security as purely an operations function, studies show, with fewer than half of the opinion that security contributes to enhancing brand value or helps pursue new business opportunities.

To change how company leaders think of security, a good starting point is to appreciate management’s existing viewpoint, as company leaders tend to examine security from a unique perspective, according to academic research. While no two CEOs will have identical worries, addressing the issues below can help functional managers to prepare answers to questions that top management is likely to ask.

CEOs want to know…

1. Do we have to address it now? Security risks change and situations evolve, so it’s possible to prematurely harden a facility against security threats. CEOs often focus on timing when authorizing the implementation of a permanent security solution. How to address it: Demonstrate short- and long-term strategic thinking when suggesting a security investment. A security manager who wants to pitch for an immediate change needs to explain the unique benefits of doing it immediately or the risks associated with waiting.

Business leaders understand that technology by itself is limited in its ability to solve problems. They want to see an operational plan that will squeeze maximum value from it.

2. How do security enhancements directly speak to the threats we face? CEOs often worry about misunderstanding or misdiagnosing a threat, with the fear that they will waste corporate resources on changes that don’t really make the company safer. How to address it: Any proposal for a security enhancement should include a description of the changes in procedures or strategies that will ensure that the organization will make effective use of it. Business leaders understand that technology by itself is limited in its ability to solve problems. They want to see a plan for compliance, awareness, training, and other strategic and operational issues that are usually necessary to squeeze value from an investment.

3. Are we protected against security events capable of damaging the corporate brand? Risk to brand value is a top reason that many CEOs care about security, studies show. How to address it: Closely align the strategic plan for security with the company’s business objectives to prove that brand protection is foundational to the security operation.

4. Are other organizations doing the same thing? CEOs typically want to know that their organization’s security posture is not an outlier for their industry and region. How to address it: Integrate the many standards and guidelines that now exist for physical security into security risk assessments to show management that the organization’s standards and practices reflect best practices and compare favorably to other organizations.

5. Are security budget requests aligned with our priorities? Senior managers are not of one mind when it comes to judging the need for security; for example, studies have shown that many executives don’t regard past incidents as an effective way to determine how much should be spent on security and instead want to know how much a security failure or problem would cost in terms of interrupting business operations. How to address it: Rather than assuming what will sway management, it is helpful to ascertain exactly what metrics senior management finds persuasive so that security representatives can tailor their data collection and communication with leaders to address those issues.

6. How is the security operation helping our business function effectively? In addition to company security practitioners identifying what they think is needed, it helps if business unit stakeholders drive the security agenda. How to address it: Conduct interviews with department heads and ask them to identify what security services they require for success. That way, when corporate security representatives approach company management, it’s not Security saying what it wants, it’s the business identifying what security services it requires for success.

7. Are we making progress or just conducting reactive problem-solving and playing “whack-a-mole”? Studies show that many companies, including billion-dollar international corporations, do not have long term security plans, instead operating strictly on a problem-fix model. How to address it: Create a master plan for security, a written document outlining long-term security objectives and a roadmap for achieving them. A security master plan provides a foundation for strategic security management, helping organizations draw connections between security functions and the corporate mission. Among many benefits, a security master plan approved by management is a good tool for maintaining consistency by preventing singular events from derailing a thoughtful security approach.