The convenience trap: Why IT can’t own security

David Zey Gerry Pitt

June 16, 2025

In today’s business world, technology is not just a support function, it’s the very backbone of operations, innovation and competitive distinction.

And as technology takes center stage, so does the need to protect it.

Yet many organizations still make the critical error of lumping IT and cybersecurity into the same domain.

This combination might seem efficient on the surface, but it can undermine both disciplines and create significant risks for the business.

Though IT and cybersecurity are deeply interconnected, they are not interchangeable.

Like an architect and a security guard working in the same building, both serve the same organization but have vastly different mandates, tools and goals.

Knowing the difference isn’t just about using the right terminology – it’s key to making smart choices that keep everything running safely and smoothly.

IT: The infrastructure that powers the business 

IT is responsible for the systems and services that run the business.

This includes setting up hardware, managing networks, installing software, handling cloud services and ensuring that everything is running smoothly and efficiently.

IT teams are tasked with maximizing uptime, ensuring access, enabling productivity and supporting the digital tools employees rely on every day.

 Typical responsibilities of an IT team include:

• Provisioning and maintaining physical and virtual infrastructure
• Managing servers, networking equipment, endpoints and cloud resources
• Providing helpdesk support for technical issues
• Configuring enterprise software and collaboration platforms
• Ensuring system availability and backup routines
• Managing access controls and user accounts 

These are foundational tasks without which a business simply cannot operate.

But by design, IT focuses on availability and usability, not security.

That’s where cybersecurity comes in. 

Cybersecurity: The discipline of digital risk management

Cybersecurity, by contrast, is concerned with defending the business from malicious actors and mitigating digital risks.

It’s a discipline built around threat modeling, risk analysis, compliance and incident response. Cybersecurity professionals focus on anticipating, detecting, containing and recovering from threats such as ransomware, phishing attacks and insider breaches. 

A dedicated cybersecurity team typically handles:

• 24/7 network monitoring for anomalies or breaches
• Threat detection and incident response (EDR/XDR)
• Vulnerability management and penetration testing
• Risk assessments and security audits
• Compliance with standards like HIPAA, NIST, PCI-DSS or ISO 27001
• Designing and updating incident response plans

Unlike IT, cybersecurity assumes the system is under threat.

It proactively works to identify weaknesses and put defenses in place, whether through technical controls, training or policy.

It is not merely an add-on to IT. 

It is a distinct discipline that requires a different mindset, different tooling and often a different organizational reporting structure.

Why treating them as one function fails

At many small companies, it’s common for the IT manager to double as the “security guy.”

Though this may work in the early stages, it often becomes unsustainable as the business grows and digital risks increase.

Recognizing when it’s time to evolve this model is a key step in building long-term resilience.

Let’s be honest: convenience is seductive.

It feels efficient to assign security to whoever’s already managing systems.

But the cost of convenience is almost always invisible… until it isn’t.

When a ransomware attack hits or a compliance audit fails, it’s not just IT that’s under fire.

It’s your reputation, your revenue, your relationships.

If that wakes you up a bit, good.

Because the real cost of inaction is never on the IT balance sheet.

It shows up on the CEO’s desk, the client’s inbox and the local news.

Here’s why this approach rarely scales well and often fails to deliver on either front:

Conflicting objectives

IT teams are incentivized to keep systems running and users productive.

Cybersecurity teams, on the other hand, are incentivized to reduce risk, which sometimes means saying no, enforcing restrictions or introducing additional steps like multi-factor authentication.

If both roles sit with the same person or team, those trade-offs are often made unconsciously or get biased toward convenience over security.

Limited expertise

Cybersecurity is a deep and fast-evolving field.

Even the best IT generalists struggle to stay current on threat intelligence, attacker TTPs (tactics, techniques and procedures), regulatory changes or advanced detection tooling. 

Similarly, cybersecurity experts are not always skilled in IT operations, scripting deployments or managing uptime.

Visibility gaps

IT departments often see their own configurations and systems as safe by default.

Without independent cybersecurity oversight, blind spots can persist, such as misconfigured firewalls, over-permissioned accounts or unpatched vulnerabilities that could be easily exploited.

Incident response delays

When an incident occurs, it needs a swift and structured response.

If the same person responsible for maintaining systems is also expected to investigate and respond to security events, the response may be delayed, incomplete or incorrectly prioritized.

Compliance and governance failures

Many industries now require a separation of duties between IT operations and security functions.

HIPAA, for example, expects covered entities to conduct risk analyses and implement specific safeguards.

These cannot be effectively self-audited by the same team responsible for deploying and managing the systems.

The vault and the alarms 

Imagine your business as a bank.

Your IT infrastructure is the vault.

It holds the valuable data and processes that power your business.

It needs to be reliable, secure and accessible.

But having a vault isn’t enough.

You also need surveillance systems, motion detectors, alarms and security guards – that’s cybersecurity. 

Both are vital.

But, just as you wouldn’t ask your building manager to conduct forensic investigations of break-ins, you shouldn’t expect your IT department to shoulder the full burden of cyber risk management.

Building an integrated but separate structure 

Separation doesn’t mean isolation.

The goal is to create two distinct but collaborative functions:

• IT owns operations – they maintain the infrastructure, ensure system availability and implement security tools recommended by the cybersecurity team.
• Cybersecurity owns risk – they set policies, monitor activity and audit systems for compliance and threats.

To make this work in practice:

• Have separate reporting lines for IT leadership and security leadership. If the same CIO oversees both, ensure they have separate performance metrics.
• Create formal communication and escalation protocols between IT and security.
• Invest in a virtual chief information security officer (vCISO) if you lack in-house security leadership. 
• Treat cybersecurity risk reviews as a business process, not just a technical checklist.

A cultural shift: From convenience to resilience

Treating IT and cybersecurity as distinct functions can also help shift the organizational culture. 

It clarifies that uptime and speed are not the only priorities and that resilience and risk mitigation matter just as much.

Leaders must reinforce this message.

Security isn’t a box to check.

It’s a mindset that affects procurement decisions, customer communications and internal accountability.

Without strong top-down support for cybersecurity as its own discipline, it can get swept under the rug when IT is under pressure to deliver.

By separating the two functions, you can help foster a culture of accountability on both sides.

IT becomes more intentional about partnering with security.

Cybersecurity gains the independence it needs to push for meaningful changes (sometimes uncomfortable ones) in how the business operates. 

Security is ultimately about trust that’s earned through transparency, consistency and care. 

Treating cybersecurity as a leadership priority models these values across your organization and signals to your partners that you’re building for more than compliance, you’re building for trustworthiness.

Turning cybersecurity into a business strength 

In the modern business landscape, cybersecurity isn’t just about protection, it’s about differentiation.

Your clients, customers and partners want to know their data is safe.

They want assurance that your systems won’t be the source of their next breach.

They want transparency in how you handle threats and manage compliance.

Organizations that can clearly articulate their cybersecurity posture and back it up with action will stand out.

They attract higher-quality partnerships.

They close deals faster.

They recover more gracefully from incidents. 

But you can’t build that kind of trust if cybersecurity is treated as an afterthought under the IT umbrella.

It must be resourced, empowered and held accountable.

This is especially true in manufacturing as the industry continues to be a target for cyber threats.  

Strong cybersecurity isn’t just about protecting your own systems, it’s often required to sell your products.

As supply chains become more connected, buyers expect manufacturers to show they can keep data and operations secure.

A single cyberattack can stop production, leak sensitive information or damage customer relationships.

Treating cybersecurity as a key part of the business, and not just an IT task, can help manufacturers earn trust and stay competitive.

Different tools for different threats

IT and cybersecurity both serve to protect and enable your business but in very different ways. 

IT ensures the environment is functional.

Cybersecurity ensures the environment is safe.

One keeps the lights on.

The other makes sure no one is sneaking in through the back door.

In a world driven by digital connections, trust is the real currency, and it grows when organizations show clarity, take responsibility and genuinely care, not just go through the motions.

As cyber threats grow in scale and complexity, the need for specialized security oversight has never been more urgent.

Companies that clearly separate IT from cybersecurity while fostering collaboration between the two will be best positioned to succeed in a world with digital trust is essential. 

For those who haven’t evaluated the structure of their tech teams lately, now is the time.

Your next big security investment may not be a tool but a decision to treat cybersecurity not as an extension of IT, but as a pillar of business strategy.