Budget the Risk, Not the Wish List

It's November. In a lot of companies, next year's numbers are getting locked in right now.

If your security budget is a list of tools, it's going to lose. Leadership sees a cost, and costs get cut.

A budget that holds up is a list of risks with price tags attached. Here's how to build one, tactical to practical.

Start with what would stop the business

Forget products for a minute. Sit down with operations and finance and answer one question: what would actually stop us from doing business? Usually it's some version of these:

• Ransomware that takes down the systems you run on

• A fraudulent wire or payment that goes out the door

• Customer or employee data exposed

• A key system or supplier down for a week

Pick your top three. Everything in the budget should connect to one of them. If a line item doesn't, ask why it's there.

Put a number on each one

You don't need a perfect model. You need a defensible estimate, built with the people who know the numbers.

• What does one day of downtime cost in lost revenue and idle payroll?

• What would recovery cost, including outside help?

• What are the legal and notification costs if data is exposed?

• What do you lose if key customers walk?

Write down your assumptions. Finance will respect a rough number with clear assumptions more than a precise number with none.

Fund the basics first

The flashy stuff can wait. Before you buy anything new, make sure these are paid for and working:

• Multi-factor authentication on email, remote access, and admin accounts

• Backups attackers can't reach, with restores you've actually tested

• A patching process with one person accountable for it

• A current inventory of your systems, accounts, and data

• Logs that someone actually reviews

Cut before you ask

Nothing builds credibility like giving money back. Before you ask for one more dollar:

• Pull license usage for every security tool

• Cancel or consolidate anything nobody logs into

• Look for tools doing the same job twice

• Check renewal dates so nothing auto-renews by accident

Set money aside for a bad day

Incidents don't wait for a budget cycle. Line these up in advance:

• An incident response firm on retainer

• Outside counsel who handles breaches

• A communications plan and someone to run it

• Time and money for a tabletop exercise

Show the trade-off

This is the part most people skip. For every item, give leaders a clear choice: "This costs X. It reduces this risk. If we cut it, here's what the business is accepting."

Then let them decide, and write the decision down. A cut stops being an IT line that got lost in a spreadsheet. It becomes a business decision, made on purpose, by the people who own the risk. That's how it's supposed to work.

Your next step

This week, block one hour with finance. Bring your top three risks and a rough price on each. You'll have a better budget conversation than any tool demo will ever give you.

What's the one line item you'd defend to the end?

Views are my own.