Securing Buy-In for Security Budgets
summary
Advocates recommend starting with a risk assessment and inventory, then prioritize internet‑facing and high‑criticality systems; leverage existing licenses (for example Microsoft bundled tools) and open‑source before buying new products. Run tabletop exercises and red‑team drills to reveal gaps — a real DDoS lasted 10 days in one case — and measure ROI: a phishing program drops click rate from 40% to under 5%, which funds continued training and supports cyber‑insurance requirements.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 2:13Challenges in security budgeting
- 7:17Using real incidents to justify costs
- 13:19Tabletop exercises for risk awareness
- 18:23Presenting security as an investment
- 23:00Prioritizing security risks effectively
- 27:42Security as a business enabler
- 28:26Conducting a security inventory
- 32:18In-house vs. outsourced security teams
- 35:51Handling security incidents and insurance
- 41:56Funding sources for security budgets
- 46:34Closing remarks and Q&A
related talks
30mEffective security on a tight budget
45mHow to win friends and influence your security team
47mYour Cybersecurity Budget Is a Horse’s Behind
52mContinuous Security
33mSecurity on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)
20mCalcifying Crisis Readiness
40mGetting Cybersecurity Funding from Your CEO: the 5 Critical Steps
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus