There's no doubt that security is a value-add, but its also table stakes.
In my area, SaaS, essential security is presumed - table stakes. In that way, its a defensive move. Offensively, the incremental improvements, vertically oriented enhancementts, transparennt communications, that's all offensive manuvering for the security team.
Just last week, HP SaaS CISO Nir Yitzak sat down with HP Cloud STrategist Christian Verstratae to discuss many of these same issues. That an be viewed here: http://h30499.www3.hp.com/t5/Grounded-in-the-Cloud/Security-and-Software-as-a-Service-discussed-at-HP-Discover-2013/ba-p/610037
Ultimately, its about the company culture, and if security is more or less provided the stick (punishment for failure) or carrot (reward for finding workable solutions). I think there is a place for both in an enterprise (as a customer I don't want too many carrots offered, ass a businessperson, I don't want to discourage innovation).