Security competes for finite organisational attention
Security is not competing with insecurity. It is competing with the product roadmap, the audit, the migration and the reorganisation.
Treating it as self-evidently important means losing to things with clearer deadlines and owners. Accepting that attention is the scarce resource changes how proposals are framed: fewer asks, sequenced, with the cost to other work stated rather than hidden.
More on Security leadership and economics
- Security spend should follow risk concentrationThe same trickle everywhere
- Security creates option value during incidentsThe siding was laid years ago
- The cheapest control can be removing the featureUnbolt it and the rest goes too
- Security debt is borrowed future effortStill tied on
- Executive decisions need ranges, not false precisionMeasure the width
- Security strategy means not protecting everything equallyYou only have so much fence