Making the Cybersecurity Budget Case to the Board
Security leaders lose budget conversations for a predictable reason: they answer a business question with a technology answer. The board asks, “Are we safe?” and hears back a list of tools, frameworks, and acronyms. The request gets approved partially, deferred, or traded away against initiatives with clearer business narratives.
The leaders who win these conversations translate. Not by dumbing the content down, but by moving it up a level — from controls to exposure, from tools to trade-offs.
Frame exposure, then options
A board can engage with a statement like: “Our top exposure is business email compromise against our finance workflows. A successful incident in that category costs organizations like ours seven figures. Here are three postures we can fund — what we hold today, a targeted hardening of finance workflows, and a broader program. Here is what each costs and what residual risk each leaves.” That structure — exposure, options, residual risk — turns a funding request into a governance decision, which is exactly the job a board wants to do.
Anchor to what changed
Budgets move when the risk picture moves. Tie asks to concrete changes: a new business initiative (AI adoption, an acquisition, a new market), a shift in the threat landscape, or an insurer’s new requirements. “The business changed, so the risk changed, so the posture must change” is a narrative non-technical executives follow naturally.
Report in the same language you budget in
If you ask for money in terms of risk reduction, report progress in those terms too. A quarterly one-pager — top exposures, posture changes, incidents and near-misses, and what the next dollar buys — builds the credibility that makes the next request easier. Consistency, more than any single presentation, is what turns the CISO from a cost center into a trusted advisor.