Executive decisions need ranges, not false precision
A board can act on "somewhere between two and eight million, most likely around four". It cannot interrogate "£4,237,891".
The range carries the uncertainty with it, which is information rather than weakness. The precise number invites either acceptance or dismissal, and when it later turns out to be wrong, as it will, it damages the credibility of the analysis that produced it.
More on Security leadership and economics
- Security competes for finite organisational attentionEverything else is on the same bench
- Security spend should follow risk concentrationThe same trickle everywhere
- Security creates option value during incidentsThe siding was laid years ago
- The cheapest control can be removing the featureUnbolt it and the rest goes too
- Security debt is borrowed future effortStill tied on
- Security strategy means not protecting everything equallyYou only have so much fence