Security Shows Value by Making Spend Defensible

Sooner or later, every security leader hears the same line, usually on a call where the number is already being cut: prove this is worth it.

There are two reflexive answers, and both are losing moves. The first is fear. You lean harder into the story about what happens if the breach lands, about ransomware and downtime and reputational damage. That works maybe the first time and the second, and by the third budget cycle it stops working, because boards get desensitized to fear the same way anyone gets desensitized to a fire alarm that never goes off. The second answer is "best practice." We need X because it is industry standard, because everyone is doing it, because the framework says so. That answer is unanswerable, which is exactly why it gets cut. When a decision cannot be defended with numbers, it gets decided by whoever has the louder objection, and that is usually someone cutting the budget.

The third move: answer in the CFO's currency

There is a third move, and it wins. Answer the question in the CFO's currency.

This is the framing shift, and it is worth being concrete about it. Instead of defending a tool because it is the industry standard, you defend it by showing what it does to a number: targeted loss reduced from X to Y for Z dollars a year, net present value positive. Instead of saying a program is underfunded, you say what underfunding actually costs: 12 percent of this budget drives 80 percent of the expected loss, so the defensibility gap lives in the other 88 percent. Same facts, same spend, completely different conversation, because now you are arguing on the same axis the CFO argues on.

Three things change when you make the switch

First, budget fights stop being fear-based standoffs and become portfolio decisions. When every initiative carries a loss figure, you are no longer negotiating against a vague anxiety. You are allocating against a real curve, and that is a conversation people can actually have in good faith.

Second, you can spot spend-for-spend's-sake instantly. The moment a line item cannot point at a risk number it moves, it is exposed. Not because it is bad, but because it is undefended, and undefended spend is the first thing that gets cut anyway. You might as well find it before the CFO does.

Third, you get credit for what you avoid. This is the part most leaders never capture. When a breach does not happen, or a loss is smaller than it would have been, that is not nothing, and there is a disciplined way to count it. It is called loss variance, and it is how FAIR measures the difference between what you would have lost and what you actually lost. If you cannot measure avoided loss, you are working for free and can never prove it. If you can, you have a number the board understands immediately. Our piece on the loss exceedance curve is the practical way to show it.

The account that closes the argument

I have a favorite version of this. Around $1.9 million of re-scoped controls reduced a mid-market healthcare organization's annualized expected loss by $13.4 million, from roughly $24.7 million down to about $11.3 million. The leader who walked into the boardroom and showed that number did not have to beg for the budget. They stopped asking permission and started operating. The board funded it on the merits, because the merits were stated in the language the board measures.

That is the P&L. And that is the difference between a real vCISO and a glorified auditor. The auditor proves the control was present. The vCISO proves the control was worth it, in dollars, before the money moved. If you want the full argument, see most vCISOs are glorified auditors, and the 30-day sprint that puts this into practice.

The leaders who prove worth on the merits are the ones who keep the budget. That is the whole game.