Security spend should follow risk concentration
Spending evenly across the estate protects the average system and leaves the important ones under-defended.
Risk is concentrated: a small number of systems, identities and dependencies carry most of the consequence. Finding them and spending disproportionately there is more effective than uniform improvement, and it is harder organisationally because it means telling some teams they are not the priority.
More on Security leadership and economics
- Security competes for finite organisational attentionEverything else is on the same bench
- Security creates option value during incidentsThe siding was laid years ago
- The cheapest control can be removing the featureUnbolt it and the rest goes too
- Security debt is borrowed future effortStill tied on
- Executive decisions need ranges, not false precisionMeasure the width
- Security strategy means not protecting everything equallyYou only have so much fence