A control can cost more than the risk it reduces
It is entirely possible to spend more preventing something than it would have cost to let it happen.
Saying so out loud is treated as heresy in security, and it is simply arithmetic. The honest version of the discipline includes being willing to conclude that a control is not worth it, which also makes the recommendations you do make considerably more credible.
More on Security leadership and economics
- Security competes for finite organisational attentionEverything else is on the same bench
- Security spend should follow risk concentrationThe same trickle everywhere
- Security creates option value during incidentsThe siding was laid years ago
- The cheapest control can be removing the featureUnbolt it and the rest goes too
- Security debt is borrowed future effortStill tied on
- Executive decisions need ranges, not false precisionMeasure the width