IT security isn't a cost, it's a business decision
As long as security only shows up in the IT budget, it stays an expense. The moment it shows up in the leadership risk register, it becomes a decision.
Most organizations I've worked with didn't have a technology problem. They had an ownership problem: nobody in leadership had explicitly taken on digital risk. Security was "IT's job", and IT has no mandate to decide how much risk the company can afford.
A successful attack isn't measured in affected servers, it's measured in lost production days, delayed contracts, customers asking questions, and fines. All of those belong in the management conversation, not the technical report.
The simple test I offer any executive: if all systems are encrypted tomorrow morning, who makes the first three decisions and how fast? If the answer isn't clear within 30 seconds, security isn't a leadership topic yet.