Security pays in more than one currency
Security teams usually report in one currency: risk reduced. It is real and it is hard to measure. The number moves slowly, and nobody can prove which incident didn't happen.
There are other currencies. Business enablement: a vendor questionnaire that used to hold up a deal for two weeks gets answered in a day, and sales closes faster. Human time: an alert that took an analyst twenty minutes to triage takes two, and the analyst spends the rest on real investigations.
Take a small automation that removes someone's access when they leave a project. Write down what it did. Risk: a class of stale accounts is gone. Time: about an hour a week of manual review is saved. Enablement: access reviews stop blocking the audit. Each line matters to a different person.
I keep a short table for each project, one row per currency. It does two jobs. It makes the case to people who don't think in risk. It also stops me from building things that reduce risk on paper and cost everyone hours.
Take your last project and fill in the three rows. If two stay empty, ask whether it was the right project.