The cybersecurity budget is one of the industry’s great enigmas. Each year, leaders fight for increased funding. They present the good/bad/ugly and sometimes successfully secure more budget than the year before.
Over the following year those hard-won dollars often seem to disappear leaving behind more tools, more alerts, and more visible stress for them. Wait, shouldn’t more budget equate to less stress?
Why Money Doesn’t Buy Tranquility
The market is designed to sell. It bombards us with the latest, shiniest, must-have solutions promising to solve all of our problems. Vendors use the same psychological triggers that prompt someone to buy that next pair of shoes even though their old ones look (and work) just fine. This is what experts call Shiny Object Syndrome (SOS) and it can quickly lead to a budget disappearing act.
Money sometimes ends up being spent on problems that you don’t actually have or solutions that don’t fit your environment. Stress increases because security team priorities are misaligned with business priorities. The key is to shift from a “solution-first” approach to a “problem-first” one.
Here are three questions to ask yourself before solutioning for anything:
- Whose Problem is it? Context matters. Who are the stakeholders and what is the impact of the problem? Is this a tactical issue? Is it a business-critical exposure? Something that could affect the end customer? All three are valid, but each requires a different funding strategy and level of buy-in.
- How will we define a successful solution? Success looks different to everyone and it’s often self-defined. Establish measurable goals with each stakeholder so that you have a clear target to work towards along with a way to measure ROI after the spend.
- What are our options? Before you pick up the phone to a vendor, take a deep breath and look at what’s already on your shelf. Don’t given in to SOS! Your existing SIEM, EDR, CSPM, etc. may have modules, APIs, or integrations that could be leveraged to solve the problem… for free.
In a perfect world, every dollar spent in cybersecurity would result in a tangible reduction in risk and, ultimately, a reduction in stress. If a new purchase increases overhead, adds complexity, or becomes a maintenance burden without delivering a new capability, you are trading one kind of anxiety for another.
A budget is a strategic resource. Using it wisely on the right problems can reduce both your risk and stress.