"What are cybersecurity priorities, challenges, and investment strategies for transportation and operational systems in 2026?"

Tell me what's top of mind for you on this topic right now — what are you wrestling with?

Right now, the thing I keep coming back to is the boundary between our SaaS platform and the operational systems our customers run — particularly customers in logistics and transportation. We're not an OT company, but our platform touches scheduling, dispatch, fleet data, and increasingly some customers want tighter API integrations with their vehicle telemetry systems. So the question I'm wrestling with is: where does my security responsibility end and theirs begin, and how do I make sure that interface is actually hardened rather than just contractually handed off? The second thing is vendor consolidation. We've accumulated a handful of security tools over the last three years and some of them are barely integrated with each other. When I think about expanding into more operationally sensitive integrations, I'm not confident our current stack gives me the visibility I'd need. That's a real constraint I'm working through right now.

What's the most important thing you need to understand or solve here?

For us, the core problem is that operational technology and IT security have historically been treated as completely separate domains, and that separation is becoming a liability. When you have systems controlling physical infrastructure — whether that's fleet management, traffic systems, logistics networks — the blast radius of a breach isn't just data loss, it's operational disruption or safety risk. The thing I need to understand better is where the actual integration points are between those OT environments and modern cloud infrastructure, because that's where the attack surface is expanding fastest. Most of the legacy OT vendors weren't designing for internet-connected architectures, and now everything is getting connected because of efficiency and visibility requirements. I don't have a strong view yet on what the right investment split looks like between securing those integration layers versus hardening the endpoints themselves — that's genuinely unsettled for me.

What does 'good' look like to you — and how far are you from that today?

For us, "good" means security is baked into the development lifecycle rather than bolted on after the fact. It means our engineers understand the blast radius of what they're deploying — not just that there's a policy saying they should care. And it means we have meaningful visibility into our API surface, which is our biggest exposure area given how we're architected. How far are we from that? Closer than we were two years ago, but not there yet. The DevSecOps integration is probably 70% of where I want it. The harder gap is cultural — getting engineers to internalize security decisions rather than waiting for the security team to catch things in review.

What would change your perspective on this entirely?

That's a harder question to answer mid-program, but I'll try. The thing that would genuinely shift my thinking is if we started seeing OT and transportation systems get hit in ways that produce sustained, visible business consequences — not just a news cycle, but actual regulatory follow-through and liability that lands on the C-suite. Right now the incentive structure doesn't fully support the investment levels people like me would recommend. If that changed, budget conversations get a lot easier. The other thing — and this is more on the vendor side — if someone actually solved the integration problem between IT and OT security tooling without requiring me to rip out half my stack, I'd reconsider some of my build-leaning instincts. Most of what I've seen so far still asks you to buy your way into a closed ecosystem, and that's where I get skeptical.

What question are you not being asked that you wish someone would ask?

The build vs. buy tension in OT security specifically. Everyone asks about what tools we're evaluating or what our biggest threat vectors are, but nobody asks whether the security tooling ecosystem for operational and transportation systems is actually mature enough to buy from yet, or whether you're better off building detection and monitoring capabilities on top of open standards yourself. In a SaaS context I have strong opinions on that. In OT and transportation systems, I genuinely don't have a fully formed view — the vendor landscape is different and I'm not close enough to it day-to-day. But I'd want someone to push on that question more than they do.

Tell me what's top of mind for you on this topic right now — what are you wrestling with?

Right now the thing I keep coming back to is the gap between how we think about securing our own SaaS platform versus how our customers — some of whom are in logistics and transportation — are securing their operational systems. We sell into that space, so I get visibility into their environments, and the OT/IT convergence problem is real. They've got systems that were never designed to be network-connected, and now they are, and the security posture around those is pretty thin. For us internally, the wrestling match is more about vendor consolidation. We've accumulated tools over the last few years and I'm at the point where I want to rationalize that stack. But for the transportation-adjacent customers we work with, the challenge feels more foundational — it's less "which SIEM do we standardize on" and more "do we even have visibility into what's running on the floor." I don't have deep firsthand experience running OT security programs, so I won't pretend I do, but from what I see on the integration side, the priority gap between operational availability and security is still pretty stark. Those teams are measured on uptime, not on patch cadence.

What's the most important thing you need to understand or solve here?

For us, the core problem is that operational technology and IT security have traditionally lived in completely separate worlds, and now those worlds are colliding. In a SaaS context I think about it as: your attack surface is wherever your APIs touch something you don't fully control, and in transportation systems that boundary is enormous — you've got legacy PLCs, fleet telematics, ticketing infrastructure, all potentially reachable. The thing I'd want to solve first is just baseline visibility. You can't protect what you can't inventory. And from what I've seen even in well-resourced organizations, OT asset discovery is still surprisingly immature compared to what we'd expect on the IT side.

What does 'good' look like to you — and how far are you from that today?

For us, "good" means security is baked into how we build and deploy, not bolted on after the fact. DevSecOps in the real sense — not the checkbox version where someone runs a scan at the end of a sprint and calls it done. Pipelines have guardrails, engineers can't accidentally open up a /16 to the public internet without it getting caught automatically, and we have clear visibility into what's actually running in production. How far are we? Closer than most, further than I'd like. The pipeline security piece is solid. Where we still have gaps is in getting every engineering team to internalize security decisions rather than treating it as someone else's problem. That cultural layer is the slow part — tooling I can buy or build, but changing how engineers think about risk takes longer.

What would change your perspective on this entirely?

That's a broad question without more context on which perspective specifically — but I'll take a swing at it. If I saw consistent evidence that OT and operational systems vendors were actually shipping products with security built into the design — not bolted on after the fact, not checkbox compliance — that would shift how I think about the build vs. buy calculus in that space. Right now my default is skepticism toward vendor claims because the track record is poor. Show me architecture, not marketing slides. The other thing that would change my view is if the regulatory environment started producing real consequences rather than audit theater. When companies get breached and it doesn't materially affect them, there's no forcing function. If that changed — if there were actual teeth — I think you'd see security move up the priority stack faster than any industry conference could accomplish.

What question are you not being asked that you wish someone would ask?

That's a good question to end on. I think the one that gets skipped is: "How do you actually maintain security posture when your vendor landscape keeps changing under you?" Everyone asks about threats, budgets, tools — but the operational continuity problem when a vendor gets acquired, pivots their product, or just starts degrading quality is something we deal with constantly and nobody really wants to talk about it in a structured way. We've had situations where a security tool we built workflows around gets absorbed into a larger platform, the API changes, and suddenly we're either rebuilding integrations or getting locked into a bundle we didn't want. That's a real cost, and it compounds across a stack with a lot of point solutions.

Tell me what's top of mind for you on this topic right now — what are you wrestling with?

Right now, for us, the biggest thing is honestly just the gap between how fast we're shipping product and how fast our security posture is keeping up. We're a fintech, so the regulatory pressure is real — but even with that forcing function, it's still a constant negotiation between moving quickly and doing things right from a security standpoint. The piece I wrestle with most is that security tends to get treated as something you bolt on after the fact rather than something that's designed in from the start. I see it in our sprint cycles — a feature ships, and then three iterations later someone flags a gap that would've been a ten-minute fix at the design stage. That pattern is expensive, and it's slow to change culturally. I'll be transparent that transportation and operational systems specifically isn't my direct domain — I'm on the payments and fintech side — so I don't have a strong practitioner view on OT security or fleet systems. But the underlying tension I'd imagine exists there, between operational uptime being the priority and security being a secondary concern, that dynamic feels very familiar to me from my own context.

What's the most important thing you need to understand or solve here?

For us, the core challenge is understanding where security investment actually moves the needle versus where it's just checkbox compliance. In fintech, we're heavily regulated, so there's constant pressure to satisfy audit requirements — but that doesn't always map to what genuinely reduces risk. The harder problem is getting leadership to see security as something that's built into the product from the start, not bolted on after you've already shipped. I don't have a strong view on the transportation/OT side specifically, but I'd assume the tension between availability requirements and security controls is a real constraint there in a way that's different from pure software environments.

What does 'good' look like to you — and how far are you from that today?

For us, "good" means security is baked into the product cycle from day one rather than bolted on at the end. We're a fintech, so regulators and enterprise customers both scrutinize our posture pretty closely, which actually helps push security up the priority stack internally. That pressure from the outside makes the internal conversation easier than I imagine it is at companies where security is purely a cost center debate. Where we fall short is probably the gap between what our engineering teams *think* they're securing versus what's actually exposed. Not because they're careless — they're talented people — but security is genuinely an iceberg, and developers naturally optimize for shipping. Getting consistent security review embedded earlier in the sprint cycle without slowing iteration down is the ongoing tension we're navigating. I'd say we're maybe 60-70% of the way to what I'd call "good," which is honestly not bad relative to peers I've talked to. The remaining gap is mostly process and culture, not tooling.

What would change your perspective on this entirely?

That's a fair question. I think what would genuinely shift my thinking is if we started seeing operational technology and transportation systems treat security the way fintech does — where it's baked into product decisions from the start rather than bolted on after the fact. In fintech, a breach isn't just a PR problem, it's an existential one, so security gets real budget and real engineering attention. If I saw that same organizational prioritization happening in transportation — where upper management is actually measuring teams on security outcomes, not just availability — I'd feel a lot more confident about where things are headed. Right now my impression is that it's still treated more as a compliance checkbox than a core product concern.

What question are you not being asked that you wish someone would ask?

That's a fair question to pose back at us. I think the one that doesn't come up enough is: "How do you actually get engineers to care about security before something breaks?" In my experience — even in fintech where security is taken seriously — the harder problem isn't tooling or budget. It's that engineers often overestimate how well they've secured something they built. You get a network rule that opens up way more than intended, or a config that looks fine until it isn't. The technical gaps are real, but the confidence gap is what actually creates the exposure. Nobody in these interviews seems to ask how you close that gap culturally, not just technically.

Tell me what's top of mind for you on this topic right now — what are you wrestling with?

Right now the thing I'm actually wrestling with is how much of our security investment is reactive versus intentional. We're fintech, so cyber is genuinely taken seriously at the leadership level — it's not a cost-center argument I have to fight every quarter. But even with that, a lot of our roadmap gets shaped by whatever audit finding or incident just happened, not by a deliberate strategy we set ahead of time. The transportation and operational systems angle is a bit adjacent to my world, but the underlying tension feels identical — you've got engineering teams who are moving fast, and security considerations get layered on after the fact rather than built in from the start. That "minimal viable product, we'll harden it later" mentality is real, and "later" rarely comes on the timeline people promise. For me specifically, I'm trying to get better at translating risk into terms that actually move decisions — framing it around cost of a breach versus cost to fix it now, rather than red-yellow-green matrices that nobody really acts on anyway.

What's the most important thing you need to understand or solve here?

For us in fintech, the parallel that keeps coming up when I look at transportation and operational systems is this gap between the engineers building and operating things and the security posture they're actually maintaining. That's the core problem — the people closest to the systems often overestimate how secure their configurations are, and security considerations get bolted on after the fact rather than designed in from the start. So if I were thinking about what to actually solve in that space, it's probably: how do you get security thinking embedded earlier in the operational lifecycle, rather than treating it as a compliance checkbox after something's already in production? That's a solvable problem in software; it's harder when you're dealing with physical infrastructure with long replacement cycles.

What does 'good' look like to you — and how far are you from that today?

For us in fintech, "good" means security is woven into the product development cycle from the start rather than bolted on at the end. Not a checkpoint you hit before launch, but something the engineering team genuinely owns alongside the PM and security folks. That's the version I'd want. How far are we from that? Closer than a lot of companies I've seen, but still not there. The gap for us is mostly cultural — engineers are sharp, but security instincts aren't uniformly distributed across the team. Some people will scope something really tightly and get it right; others will make configuration choices that open up more surface area than they realize. Closing that gap is an ongoing effort, not a one-time fix.

What would change your perspective on this entirely?

That's a fair question. I think if I saw consistent evidence that security investments in operational systems were actually moving breach outcomes — like measurable reduction in incident severity or recovery time — I'd weight the conversation differently. Right now a lot of what I hear feels more like compliance theater than actual risk reduction. The other thing that would shift me is if upper management started treating security spend the way they treat engineering headcount — as something that directly enables the product, not just a cost center you fund reactively after an audit finding or a near-miss. In fintech we've made some progress on that framing, but it's genuinely hard to sustain.

What question are you not being asked that you wish someone would ask?

That's a fair question to end on. I think people tend to jump straight to technology stacks and tooling when they ask about cybersecurity — what are you buying, what are you deploying. What I'd want someone to ask is "how are you actually getting your engineers to care about this on a day-to-day basis?" In fintech especially, the security posture is only as good as the people building the product. We can have great policies on paper, but if an engineer misconfigures something because they overestimated what they understood about network access rules or cloud permissions, that's your real exposure. The culture and the incentive structures around security matter as much as the tools, and I don't think that comes up enough in these conversations.

Tell me what's top of mind for you on this topic right now — what are you wrestling with?

Right now, honestly my world is B2B SaaS demand gen, so transportation and operational systems cybersecurity isn't something I'm hands-on with day to day. But I do sit adjacent to it through some of our prospecting work — we target mid-market and enterprise buyers, and some of those are in logistics and fleet management adjacent spaces. What I notice from that vantage point is that the buying patterns feel really reactive. The companies we're trying to reach in that space don't seem to have cybersecurity spend mapped out the way a mature enterprise might. It's more like something happens — an incident, a compliance requirement comes down, a vendor audit — and then there's suddenly budget. That makes pipeline forecasting in that segment pretty hard for us. I don't have a strong view on the technical side of OT security or what's happening inside those operational systems specifically. That's not my domain. But from a go-to-market lens, the challenge I see is that security in industrial or transportation contexts still gets treated as a cost center rather than a strategic priority, which compresses the buying cycle into these reactive bursts rather than planned investments.

What's the most important thing you need to understand or solve here?

From my seat, I don't have direct ownership of cybersecurity infrastructure — that's not my domain. But where it intersects with my world is around trust and the buying process. We sell into mid-market and enterprise, and when security comes up as an objection or a procurement requirement, it can stall deals significantly. So the thing I'm most interested in understanding is how security concerns influence purchase timelines and buying committee dynamics. When a prospect's IT or security team gets pulled into evaluating our product, that's a variable I need to plan around. And right now I don't have a great model for predicting when that happens or how long it adds to the cycle. I don't have a strong view on the transportation and OT-specific angle you're researching — that's pretty far from our ICP — so I'd probably be more of a peripheral voice on that topic.

What does 'good' look like to you — and how far are you from that today?

For us, "good" in the cybersecurity sense is when security is actually built into the product and go-to-market process from the start, not bolted on after something breaks. The companies I respect most have made it a real priority at the leadership level — it shapes hiring, it shapes roadmap decisions. We're a Series A, so we're still pretty far from that. We have the basics covered but it's not deeply embedded in how we operate day to day. The bigger gap honestly is on the internal buy-in side. Getting leadership to treat security spend as something other than a pure cost center is a real ongoing conversation. There's always something competing for budget, and without a specific incident or audit finding forcing the issue, it tends to slide.

What would change your perspective on this entirely?

That's a fair question. I think if I saw a major incident — something like a high-profile breach tied directly to an OT or transportation system that had measurable downstream business impact — that would shift how seriously I'd push leadership to prioritize this. Right now the budget conversations around operational security are hard because the risk feels abstract to a lot of decision-makers. The breach stories we do see don't seem to dramatically hurt the companies involved, so it's tough to use them as leverage internally. If the consequences became more visible and concrete, I think the calculus changes pretty quickly.

What question are you not being asked that you wish someone would ask?

That's a good question to end on. I'll say — nobody really asks about the demand gen side of cybersecurity purchasing, which is where I sit. Like, how do security buyers actually get educated before they're ready to talk to a vendor? Because from what I can tell, a lot of these purchases are driven by incidents, audit findings, or compliance deadlines — not because someone saw a clever LinkedIn ad. So if I were selling into this space, I'd want to understand that trigger map a lot better than most vendors seem to. That's where the real pipeline conversation starts.

Tell me what's top of mind for you on this topic right now — what are you wrestling with?

Right now, honestly the topic feels a bit outside my direct lane — I'm in demand gen for a B2B SaaS company, not transportation or OT security. So I'll be upfront that I'm coming at this more as someone who observes the space from a marketing and pipeline perspective than as a practitioner inside it. That said, what I do notice from our side is that security budgets in general are really hard to predict. The buyers we interact with in adjacent security markets talk about how their priorities can shift fast — a regulatory change, an audit finding, an incident — and planned spend gets reshuffled. I imagine that's even more pronounced in transportation and operational systems where the stakes of a breach or disruption are physical, not just data-related. The piece I genuinely wrestle with less directly is the OT-specific side of it. I don't have a strong view on what's happening inside those environments technically. What I can say is that from a go-to-market lens, companies selling into that space seem to have a harder time getting budget justified — it's the classic "security as cost center" problem, and operational teams in transportation probably have competing priorities around uptime and reliability that make security investment a tougher sell internally.

What's the most important thing you need to understand or solve here?

Right now, my biggest challenge is attribution — understanding which channels and touchpoints are actually moving pipeline for us. We sell into mid-market and we're starting to push upmarket a bit, so the buying cycles are getting longer and murkier. In terms of cybersecurity specifically for transportation or operational systems — I'll be straightforward, that's not really my domain. I don't have a strong view on that. My world is more around demand gen for a B2B SaaS product, so my security exposure is mostly internal stuff like compliance questions that come up in procurement cycles with enterprise prospects.

What does 'good' look like to you — and how far are you from that today?

For us, "good" would mean having clear attribution across every channel contributing to pipeline, a CAC we can defend to the CFO, and a demand gen engine that doesn't require me to rebuild it every quarter when something stops working. How far are we from that? Closer on some things than others. The attribution piece is still messy — we've got multi-touch models running but nobody fully trusts the numbers, so there's still a lot of gut-feel in budget decisions. CAC is tracked but the benchmarks we're comparing against feel loose for our stage and segment. The channel mix is actually in decent shape right now, but I know from experience that what's working today probably looks different in six months.

What would change your perspective on this entirely?

That's a broad question given where we are in the conversation. I'd say if I saw a major breach that actually traced back to a transportation OT system — something that caused real operational disruption and made national news in a way that stuck — that would probably shift how seriously companies budget for this. Right now it feels like the risk is acknowledged but the urgency isn't quite there at the budget level. The "it won't happen to us" mentality is still pretty durable until something actually happens. I don't have a strong view beyond that.

What question are you not being asked that you wish someone would ask?

That's a good question to end on. I'd say nobody really asks me about the vendor selection process from a marketing lens — like, what actually gets a cybersecurity vendor into our consideration set in the first place. Everyone wants to talk about features and threat landscapes, but from where I sit, the real bottleneck is that our CISO has the next 12 months pretty much mapped out already, and if you're not in that plan, you're fighting for unplanned budget. So the more interesting question for me is: what triggers a vendor to jump the queue? Usually it's an audit finding, a compliance deadline, or something that becomes a board-level concern. I'd love someone to ask me more about how those trigger events shape buying cycles, because that's where demand gen strategy actually gets interesting.

Tell me what's top of mind for you on this topic right now — what are you wrestling with?

Right now, the thing I keep coming back to is the justification problem. We're a SaaS company, not a transportation operator, so my direct exposure to OT and operational systems security is limited — but I sit in enough cross-functional budget conversations to see the pattern. Security teams struggle to make the case upward, and when the business hasn't visibly suffered from a breach, the default answer from leadership is to defer spend. For us specifically in 2026 planning, the question is less about what threats exist and more about which investments we can actually tie to a business outcome or compliance requirement. That's what moves budget. I don't have a strong view on the transportation sector specifically, but I'd imagine the dynamic is similar — availability and uptime are the metrics leadership cares about, and security has to speak that language or it just doesn't get funded.

What's the most important thing you need to understand or solve here?

For us, the core question is really about where cybersecurity spend actually moves the needle versus where it's just compliance theater. We're a SaaS company, not a transportation operator, so I'll be candid that OT and operational systems security isn't my day-to-day — but the underlying tension I see across industries is the same: security is still treated as a cost center by a lot of leadership, and that makes it hard to prioritize systematically rather than just reactively. What I hear from peers in more infrastructure-heavy sectors is that the planning horizon is genuinely short, because incidents, audits, and regulatory shifts can completely redraw your priorities mid-year. So the real challenge isn't identifying the right investments in theory — it's building enough organizational alignment that you can actually execute on them when something unexpected forces a reprioritization.

What does 'good' look like to you — and how far are you from that today?

For us, "good" means having a clear line of sight from every security investment to a measurable risk reduction — not just a compliance checkbox or a vendor dashboard that says things are green. Right now we're probably a 6 out of 10 on that. We have the tools, we have policies, but the gap is really in how well we can quantify and communicate that picture to the C-suite in a way that actually influences budget conversations. The harder part is that security keeps getting treated as a cost center internally, even when I'm pushing back on that framing. Getting leadership to see it as something other than a money pit is an ongoing process, not a solved problem.

What would change your perspective on this entirely?

That's a broad question without more context, but I'll take a shot at it. If I saw consistent, quantifiable evidence that security investments were actually moving business outcomes — not just reducing incidents, but demonstrably protecting revenue or accelerating deals — that would shift how I think about prioritization. Right now security in most orgs, including mine, still largely gets framed as cost avoidance, and that makes budget conversations harder than they need to be. The other thing that would change my view is if the regulatory environment became more prescriptive and consistent. Right now there's enough ambiguity that companies can still roll the dice on minimum viable compliance. If the accountability structures tightened — real consequences, not just fines that get absorbed — I think you'd see investment strategies change pretty quickly.

What question are you not being asked that you wish someone would ask?

The budget conversation that doesn't happen enough is around how you actually prioritize across competing security needs when you don't have unlimited resources. Everyone asks what your top threats are, or what tools you're evaluating — but nobody really digs into the tradeoffs you're making and why. Like, in my world, it's not "should we invest in security" — it's "which of these five things do we fund this quarter when we can only do two of them." That's where the real decision-making lives, and it's rarely what researchers or vendors want to get into.

Tell me what's top of mind for you on this topic right now — what are you wrestling with?

Right now my biggest challenge is honestly justifying security spend in a way that resonates with our leadership. I sit in marketing, not IT, but we touch a lot of vendor integrations and data pipelines, so I get pulled into these conversations more than you'd expect. The core tension is that security still gets framed as a cost center — and when there's no visible incident, it's hard to make the case for proactive investment versus just patching things reactively. The other thing I'd flag is that our planning cycles feel mismatched with how security risk actually works. We'll put together a 12-month roadmap and then something shifts — a new compliance requirement, a vendor gets acquired — and the whole thing needs to be revisited. So there's this frustration where you invest time in planning and then the ground moves anyway.

What's the most important thing you need to understand or solve here?

For us, the core challenge is that cybersecurity spend is almost impossible to plan with any real confidence. You can have a 12-month roadmap and then a compliance requirement shifts, or there's an incident somewhere in your vendor ecosystem, and suddenly you're reallocating budget mid-cycle. That unpredictability makes it really hard to justify long-term investment commitments to leadership. The second piece — and this is more of a structural frustration — is that security still gets treated as a cost center rather than a business enabler. I don't have a strong technical background, so I'm largely relying on our security team to translate risk into business terms, and that translation is often weak. When you can't quantify what you're actually buying down, it's a hard conversation at the VP level.

What does 'good' look like to you — and how far are you from that today?

For us, "good" means having security posture that's actually measurable — where I can walk into a budget conversation and show the business what risk we've reduced and roughly what it cost to reduce it. Not a red-yellow-green dashboard that nobody can tie to actual outcomes. How far are we from that? Farther than I'd like. The quantitative risk measurement piece is genuinely hard, and a lot of what we have today is still qualitative. We've got the foundational controls in place, but the gap is really in proving value upward — translating what the security team does into terms that resonate at the leadership level. That's a communications and metrics problem as much as a technology problem.

What would change your perspective on this entirely?

That's a broad question — change my perspective on what specifically? But I'll take a swing at the general framing. If I started seeing hard evidence that security investments in operational systems were producing measurable, quantifiable outcomes — not just "we didn't get breached" but actual cost avoidance numbers tied to specific controls — that would shift how I think about prioritization. Right now a lot of the ROI case is built on hypotheticals, and that makes it hard to defend budget in a serious business conversation. The other thing that would genuinely move me is better integration between security thinking and product or operational roadmaps from the start, rather than retrofitting. I see too many cases where security gets layered on after the fact because the original build was optimized for speed to market. If that dynamic changed structurally, I'd have a different view on where the leverage points are.

What question are you not being asked that you wish someone would ask?

That's a fair question. I think the thing that doesn't come up enough is: who actually owns the outcome when something goes wrong in an OT or transportation system context? In a SaaS environment, accountability is reasonably clear — it traces back through the product and engineering org. But in operational technology, you've got a patchwork of vendors, system integrators, and internal teams, and when there's an incident, everyone points at everyone else. The governance question feels more important than most of the technology questions, and I rarely see it framed that way in these conversations.