Security teams may work in different disciplines, but the risks they manage rarely stay within those boundaries. So why do organisations still struggle to connect the findings, responsibilities and decisions that matter?
A recent article by Garry Bergin, Co-Chair of The Security Institute’s Converged Security Special Interest Group, questioned whether we spend too much time debating what to call converged security and not enough time addressing the problem itself.
It made me think about why, after years of talking about convergence, so little seems to have changed in how security work is organised.
There is broad agreement that cyber, physical and personnel security need to work together. Yet an IT or cyber team might commission a penetration test, corporate security a physical security review and HR an assessment of employee screening. Each has its own scope, budget and owner, with findings usually considered by the function that commissioned the work.
There are good reasons for this. Security requires specialist expertise and clear responsibilities. The difficulty comes when a finding in one area changes the significance of something identified elsewhere.
The gaps between assessments
A cyber penetration test might identify a vulnerability that is difficult to exploit remotely but relatively straightforward to reach from inside a building. A separate physical security review might find weaknesses in visitor management, while information about employees or suppliers is already publicly available.
Individually, each assessment may be accurate. But considered together, the findings could reveal a very different level of exposure.
Publicly available information could help someone impersonate a legitimate visitor, weaknesses in access control could provide a route into the building and to a network switch, and the technical vulnerability could then become easier to exploit.
Nothing about the individual findings has changed, but their significance has.
This is why I think the discussion around convergence can become too focused on whether security teams sit together or report to the same person. Structure matters, but it shouldnt necessarily change how risk is assessed.
An organisation can have several accurate views of individual weaknesses without understanding how they might be used together.
When the scope becomes part of the problem
There is a challenge for consultants here too. Security work is commissioned against a defined scope, but risks don’t always sit neatly within it.
Consultants cannot investigate everything outside an agreed scope, nor should specialists be expected to make judgements beyond their expertise. But they should recognise when a finding has wider implications and make those limitations clear to the client.
Otherwise, an organisation can commission several good pieces of work and still be left to make the connections between findings produced by different specialists; often those connections are not made.
We also need to think about the questions being asked when security work is commissioned. Assessing whether a system is vulnerable is different from understanding whether someone could compromise an organisation’s operations.
Both are legitimate exercises, but they don’t provide the same assurance. That distinction matters when organisations use findings to decide where to invest and which risks to prioritise.
Recognising a risk is not the same as owning it
Even when security teams understand how risks connect, agreeing what to do about them can be difficult.
An organisation can have good communication between its teams and still struggle to address risks that cross departmental boundaries. Understanding the problem is one thing. Agreeing who owns it, who pays to address it and who has the authority to accept the consequences is another.
This is where convergence becomes a leadership and governance issue.
Risks that sit within one function can usually be managed through existing structures. Those that cross functions are harder, particularly where the vulnerability sits with one team, the operational consequence with another and the budget somewhere else entirely.
Without clear accountability, even a well-understood risk can remain unresolved.
We should look at our own ways of working too
The security industry needs to examine its own role in this.
If we believe organisations need a more joined-up understanding of security, we should question whether the way services are scoped, commissioned and delivered actually supports that.
That doesn’t mean making every engagement broader or expecting every specialist to work across disciplines. It means recognising when the boundaries of an assessment prevent a client from understanding the wider risk.
Clients also need to consider what happens after assessments are complete. Who looks across the findings? Who considers whether weaknesses identified in different areas could form part of the same attack route? And when addressing a risk requires several departments to act, who makes the decision?
Perhaps the more useful question isn’t whether an organisation has adopted converged security, but whether its approach allows it to recognise and respond to risks that cross traditional boundaries.
If the answer is unclear, changing reporting lines or adopting the language of convergence is unlikely to make much difference.
We don’t need everyone in security to become a generalist. We need to make better use of the specialist expertise we already have and ensure the connections between different areas of risk aren’t lost along the way.