Security’s impact on the business should hold more focus in high-level conversations — versus ignoring weaknesses or devising ways to pin blame on individuals.