What is a "security driver", and how does it differ from a strategic business driver?

A security driver is a reason the organization must protect itself — compliance, avoiding business disruption, competitive advantage, protecting intellectual property, ensuring physical safety, or limiting liability.

Where a business driver describes what the company wants to achieve (growth, innovation, value), a security driver describes what it must protect or avoid losing. Examples: compliance with regulations like the EU General Data Protection Regulation (GDPR) or the Payment Card Industry Data Security Standard (PCI-DSS); avoiding downtime and lost productivity; protecting trade secrets and brand reputation; and limiting legal and regulatory liability. Tip: The strongest security business cases tie a security driver directly to a business driver — e.g. "protecting customer data (security) preserves the customer trust our revenue depends on (business)".