Security creates option value during incidents
A lot of security investment buys you choices at the moment things go wrong.
Tested backups mean you can decline to pay. Good logging means you can scope the breach rather than assume the worst. Segmentation means you can isolate rather than shut everything down. None of that prevents the incident, and all of it determines how many options you have on the day, which is where the value actually appears.
More on Security leadership and economics
- Security competes for finite organisational attentionEverything else is on the same bench
- Security spend should follow risk concentrationThe same trickle everywhere
- The cheapest control can be removing the featureUnbolt it and the rest goes too
- Security debt is borrowed future effortStill tied on
- Executive decisions need ranges, not false precisionMeasure the width
- Security strategy means not protecting everything equallyYou only have so much fence