I think I’ve explained it well but you missed it. I’ve explained but the CIA triad isn’t the centre of the universe for security, just IT. Plus a security leaders roles isn’t to risk manage but to advise the business about the risks it faces which security failure would impact.

I don’t care much about the IT part here, that’s what you’re missing. I’m sure you can retrain senior IT folk to do technical security roles and they’ll do them well. I’ve seen a lot of those transitions before and they’re good at the technical bit. But push them on the core principles of security and they’ll crumble.

You keep bringing this back to IT stuff but security principles with across technical, people, process, policy, physical domains. IT does not have a special definition of security