Business Analysis: The Most Underrated Skill in Cybersecurity

Most security programs start with a tool, not a process map. Teams turn on a platform, wait for the alerts to make sense, and watch the board ask why risk has not moved six months later. The tool is not the problem. Nobody mapped the business first.

Business analysts already own the skill this gap needs. Elicitation, process modeling, requirements analysis, and stakeholder communication build the foundation every security program requires: what the business protects, where the data moves, and who owns the decision when a system fails.

A security program built on a real process map spends less on unused tools. The team finds the vulnerability stopping revenue, not the one lighting up a dashboard. Uptime holds, because someone mapped the process behind an outage before the outage happened.

In this session, Jerod Brennen draws the direct line between business process analysis and security outcomes: sharper budgets, sharper vulnerability management, and fewer hours lost to incidents good planning could have prevented. Attendees leave with five questions to ask before the next security purchase, plus a case for placing business analysts inside security planning from day one, not called in after an incident.

Security follows the business. Map the business first.

The Common Sense Security Framework: Revisited and Revised

20 years ago, I learned first-hand how disconnected cybersecurity was from any organization smaller than an enterprise.

10 years ago, I took to the stage at BSides Columbus to pitch a different approach to building a cybersecurity program: The Common Sense Security Framework.

This year, I vetted the framework against data from the most well-known, well-established global cybersecurity reports, and you know what?

It fits like a glove.

The CSSF is built on two core beliefs: any program too complicated to explain to your C-suite is broken, and fundamentals will win the day.

Ten years changed both how we conduct business and the threat landscape, but it didn’t change my thesis. The average U.S. data breach costs continue to skyrocket (now $10.22 million), organizations still take too long to find and contain attackers (241 days), and generative AI has tipped the scales in the attackers’ favor with realistic phishing lures and deepfakes.

None of that happened because businesses lacked frameworks. It happened because complexity won and simplicity lost.

So what does the current data confirm we got right a decade ago? What really changed? What does common sense look like with AI, ten more years of board pressure, and a decade of breach reports added to the mix?

I built the CSSF version 2.0 to answer that. Same principles, sharper edges, and ten years of proof behind it.

Now it’s time to share the new CSSF with the world.

Say Yes Faster: Approving AI Without an AI Committee

Mid-market AI governance is a speed problem dressed up as an ethics issue. Leaders assume responsible adoption requires committees, policies, and legal review, so approval takes weeks, even though many of their employees are ALREADY using the tools. So the employees just stop asking. My angle is the reverse of standard governance advice: build the fastest defensible decision path you can, because a two-week yes protects your data far better than a six-week maybe. I want to show what responsible looks like at 200 employees instead of 20,000, where nobody has a Chief AI Officer and the person evaluating the tool also runs payroll.

First, a four-gate approval path with the specific questions asked at each gate, ready to run on the next request in their queue. Attendees leave able to approve or modify an AI request in days (even hours) rather than weeks, with a written record of the decision. Second, kill criteria. Most companies deploy AI tools with no defined conditions for shutting one off. Attendees leave able to write three measurable conditions before launch, which turns an indefinite commitment into a reversible one.

Protect Your People: The Business Ethics of AI

AI writes the tagline your junior copywriter used to write. AI generates the concept art your freelance illustrator used to sketch. AI drafts the report your first-year analyst used to draft. Every one of those tasks moves faster now, but business ethics are struggling to keep pace.

Jerod Brennen has spent 25 years advising leaders on what organizations build, buy, and cut. He’s watched companies adopt AI to save money without asking who earns money today for the work AI now does. He’s also watched leaders build AI adoption plans protecting margin and people at the same time.

In this talk, Jerod asks the questions leaders skip before a new AI tool ships. Whose job does this task replace? What do you owe the person who loses the income? What version of AI adoption still gives your newest hire a way in? You'll leave with a framework for saying yes to AI without saying no to the people who built your business.

The businesses that adopt AI ethically will out-hire, out-train, and outlast the ones that don't.

Originally presented at the Ohio State University's inaugural Institute for Cybersecurity and Digital Trust Annual Cybersecurity Symposium (2026).