The department of "no" has already lost

I’ll say something that won’t be popular with a lot of security teams: the moment your function becomes the department of “no” is the moment you’ve already started losing. You just can’t see it yet.

It’s a pattern I’ve watched across industries and across borders. Security pushes back on a tool, then a workflow, then the thing a team actually needs to move. After enough no’s, people don’t escalate and they don’t argue; they just stop asking. They keep doing the thing. They simply stop telling you about it.

That’s the real failure mode, and almost nobody clocks it as one.

The breach isn’t where it goes wrong. It goes wrong the moment someone decides it’s faster to work around security than to involve it. By then the visibility is already gone, and visibility was the whole job.

Look at what’s happening with AI right now. Audit tool usage inside almost any company and you’ll find a stack of AI tools in active use, but only a handful have ever been reviewed. The instinct is to read the rest as a discipline problem. They’re not. They’re a verdict: people telling you, without saying it, that the approved path got too slow to bother with.

My view, after twenty years of this, is that security was never meant to be the wall. The strongest programmes I’ve seen aren’t the ones that say no the most. They’re the ones people still walk towards with a half-formed idea, because they expect “yes, and here’s how” instead of a door shut in their face.

The teams still saying no to everything think they’re reducing risk. They’re just moving it somewhere they can’t watch.