Optimizing Your Cybersecurity Budget

Strong cybersecurity comes at a price. The exact amount depends on your risk tolerance.

2 Min Read
Optimizing Your Cybersecurity Budget
(Source: Pixabay)

“Money should be no object when it comes to cybersecurity” is a phrase often uttered by people who generally know very little about money and even less about cybersecurity.

Actually, money does matter. It matters a lot. If money didn't matter, even the most modest enterprise could hire a team of experts to work around the clock to build, operate, and maintain a military-grade cybersecurity infrastructure.

The truth is that cybersecurity, like any other business operation, has to follow a budget.

Budget Optimization

Security budgeting can be challenging since the vulnerability landscape changes daily. “We, as a cyber practice, do not believe there is a single magic software or platform,” says Rahul Mahna, managing director, managed security services, at risk and regulatory compliance advisory firm EisnerAmper Digital. He suggested creating a budget that adheres to three distinct visions: past incident reflections (to prevent repeating previous mistakes); current security needs; and future plans.

All cyber events and impacts aren't equal, nor are organizations equally able to defend against and recover from them. “We advise leaders to optimize cybersecurity spend by first working to quantify the risk unique to their organizations in specific dollar terms,” says Andrew Morrison, US cyber risk services strategy, defense, and response solutions leader at business advisory firm Deloitte. Cyber risk quantification allows leaders to calculate expected losses from a cyber event in dollar terms. “Through bespoke modeling and scenario simulation, it's possible to determine fairly accurate estimates of financial loss that could result from a cyber event -- and to help determine how cyber spend should be allocated and prioritized to more impactfully address those specific risks.”

Avoiding Pitfalls

Many organizations start building their cybersecurity budget under the faulty assumption that they will probably never be attacked. They then believe they can safely minimize their cybersecurity investment. “I can think of thousands of companies that felt the same way,” says Alan Brill, senior managing director of the cyber risk practice at governance and risk advisory firm Kroll. Most eventually learned -- the hard way -- that attacks can hit any enterprise at any time.

Read the rest of this article on InformationWeek.

About the Author(s)

John Edwards, Featured Contributor

Technology JournalistA veteran technology journalist, John Edwards has written for a wide range of publications, including the New York Times, Washington Post, CFO Magazine, CIO Magazine, InformationWeek, Defense Systems, Defense News/C4ISR&N, IEEE Signal Processing Magazine, IEEE Computer, The Economist Intelligence Unit, Law Technology News, Network World, Computerworld and Robotics Business Review. He is also the author of several books on business-technology topics. A New York native, John now lives and works in Gilbert, Arizona.

Stay informed! Sign up to get expert advice and insight delivered direct to your inbox

You May Also Like

More Insights