Security is sold to the upper management in many flavors. Couple of compelling models are:

1. ROI savings model - Security is viewed as a Return On Investment in terms of savings it realizes.

2. Insurance policy model - Security is viewed as a risk reducing instrument.

Though both models are equally compelling, I am more inclined toward the insurance policy model. In both cases we need to do the math to arrive at the cost structure of security, more akin to cooking up numbers.

How about a third model where you don't have to cook up numbers? I would like to call it the "core competence model".

Company-A  takes two long years to streamline its processes to implement security checkpoints in order to ensure confidentiality, integrity and availability with  its product offerings.

Company-B is a competitor of Company-A. Company-B will take at the least 2 years to replicate Company-A's security competence. This will not only mean time, it will have cost Company-B in terms of lost opportunities due to lack of security competence. Moreover, it is may be hard for Company-B to replicate the security competence.

Security has become the core competence of Company-A and hence its competitive advantage.