Excellent series of posts on GRC. I couldn't agree more. In order for security executives to "have a seat at the adult's table", these executives must be able to related their security operations, budget, and achievements back to business objectives, enterprise risk and compliance priorities. Conversely, business needs to stop treating security like a black box and understand that in this day and age, much of an organization's business risks are IT related. GRC and security need to converge and we are certainly seeing that in our customer base. It does seem like CISOs are the ones leading this transformation, not the business.