Cybersecurity is a vast topic, and many kinds of businesses exist with different cultures, drivers, missions, models, and products or services. Facing a general problem statement of “How should security align with business?”, one could easily get lost in the matrix of what to align with what.It can be hard to stay focused on alignment while trying to explain just enough detail about many cybersecurity topics and to share so many good security practices for people, process, and technology. Therefore, this book applies the 80–20 rule (aka Pareto Principlei) to cybersecurity as its organizing framework. To even begin to achieve the promise of cybersecurity, security and business leaders must align to rationalize cybersecurity. They must go beyond the myths – such as the one that cybersecurity is just a technical problem – that still mislead many in the market.Myths aside, basic concepts of Rational Cybersecurity are already conventional wisdom. We’ve all heard that “Security is about people, process, and technology.” But that can sound like overly general advice not calibrated to our type of IT environment or business. And where do we begin? Conventional wisdom advises starting with a security assessment and devising a plan for the security program. As security leaders, you may not need a cybersecurity backgrounder. But stick with me: I’ll keep it short, and I think we’ll find it worthwhile to get on the same page about our overall challenge in defending the business and how it’s exacerbated by some “myths of cybersecurity.”Let’s start with the word “cybersecurity” on which our profession is founded. We often use it synonymously with “IT security,” “information security,” or “security.” What’s so special about it?