How to Win Budgets & Influence Stakeholders: Articulate Cyber Value

Jeremy Dorrough opens by describing the budget problem: security tools are expensive, budgets are limited, and leadership wants a clear justification for every dollar. He argues that practitioners often cannot explain the return on their tooling, and that purchases tend to follow hype cycles, internal politics, or end-of-year spending rules rather than measured value. A comparison with a small garage weighing a managed security service makes the point that spending should match the risk actually being reduced.

The middle of the talk covers why common tools fall short in budget discussions. Risk frameworks, heat maps, and color-coded scoring describe program health but do not justify a specific purchase. Dorrough recommends speaking the language of finance: understanding capital versus operating expense, payment terms, the full cost including implementation and operations, and framing benefits as productivity gains, avoided outage costs, or personal liability for leaders. He walks through an annual loss expectancy style return-on-investment model and notes that estimates only need to be directionally accurate. He also points to public breach datasets, the Verizon DBIR and IBM's cost of a data breach report, along with risk quantification vendors and calibration training.

He closes by urging practitioners to do their own homework on the problem before engaging vendors, to compare alternatives, and to use penetration test and tabletop results as evidence. Residual risk will always remain, so the goal is defensible, data-backed decisions rather than appeals to fear. Audience questions touched on budgeting for penetration tests and quantifying subjective risk.