How to hold IT security strategy conversations