Cybersecurity Budgets Rise Amid Challenges in Demonstrating Business Impact

The article discusses the ongoing rise in cybersecurity budgets, yet many security leaders find it difficult to articulate the business impact of their spending. A study conducted by Expel surveyed security and finance executives at large enterprises, revealing a disconnect in how these two groups perceive risk and investment decisions. While both sides acknowledge the importance of cybersecurity, finance leaders express concerns over security teams’ ability to effectively communicate the value of their initiatives.

Security practitioners often define unacceptable risk in terms of compliance failures and reputational damage, while finance teams focus on financial modeling and business continuity. This difference in perspective leads to challenges in communication, as security teams emphasize controls and threat reduction, whereas finance teams seek measurable financial impacts.

Reporting gaps further complicate the decision-making process. Security teams typically report metrics related to incidents and program maturity, but finance leaders indicate that these inputs do not sufficiently support investment decisions. They prefer reports that connect cybersecurity spending to enterprise goals and operational stability.

Despite the positive descriptions of collaboration between security and finance teams, the lack of direct engagement between CISOs and CFOs often results in weaker alignment on priorities and budget expectations. Organizations that facilitate more executive-level interactions tend to report stronger alignment and confidence in cybersecurity’s business value.

Both security and finance leaders anticipate increases in cybersecurity budgets for the coming year, but the expectations differ, with security leaders expecting larger gains. Finance executives emphasize the need for stronger business cases and improved reporting to justify larger investments.

Understanding the Disconnect

The findings highlight a critical need for cybersecurity teams to learn the language of business, particularly in terms of financial impact and risk of disruption. As Greg Notch, Chief Security Officer at Expel, notes, cybersecurity teams must effectively communicate how their operations contribute to key performance indicators that matter to the business.

• Expel: Conducted a study revealing the disconnect between security and finance executives regarding cybersecurity investment and business impact.
• Greg Notch: Chief Security Officer at Expel, emphasizes the need for cybersecurity teams to communicate in financial terms.
• Finance executives: Express concerns over the ability of security teams to explain business impact and prioritize investments based on risk.
• Security practitioners: Define unacceptable risk primarily through compliance failures and reputational damage.
• Finance teams: Focus on financial modeling and business continuity when evaluating risk and investment decisions.