Get funding for your Security Initiatives by thinking like a MBA not a CISSP

Security teams often struggle to win budget because they describe risk in technical terms while executives weigh cost, benefit and business impact. The session opens with the different perspectives of security, IT and business leaders, and why each group tends to focus on different concerns. It then argues that a culture built on fear and blame discourages employees from reporting problems, and that optimism bias makes abstract warnings easy to dismiss.

The middle of the talk covers practical steps. The presenters recommend knowing the audience, especially how finance leaders and the board think, and expressing risk in dollar terms wherever possible. Business impact analysis and tabletop exercises let stakeholders experience a simulated outage or breach, which makes their estimates more realistic. Risk scales should be applied consistently across the organization, and dashboards and key risk indicators only help when they answer questions decision-makers actually ask. Framing work through SWOT analysis or a recognized framework, plus a roadmap and governance to handle change, keeps requests credible over time.

The closing advice is to build a collaborative culture, invite objective outside review, admit known weaknesses openly, and draw on finance colleagues' experience with audits and controls. Attendees leave with a method for turning security initiatives into justified, trackable investments.