Paying for Nothing to Happen: Budgeting for Security, Compliance, and Reliability

A vendor the security team wanted, budgeted two years in a row, and never actually bought. When Kevin Goldsmith finally tried to spend the money, his CFO asked what the ROI was, and he didn't have an answer good enough to win the argument. Not long after, a new board arrived and told him he was underinvesting in cybersecurity. Same company, same customers, same risk, completely different verdict.

Every technology leader owns budgets where the best possible outcome is that nothing happens. Security, compliance, reliability, backups, disaster recovery. They're the easiest money in the company to cut and the hardest to defend, because success looks identical to having never spent the money at all. This episode is about how to decide how much to spend, and how to defend the number when finance asks.

Kevin lays out four price tags that other people are already attaching to your risk: the deal price your customers set, the insurance price your insurer sets, the compliance price regulators set, and the survival price you have to estimate yourself. He compares three companies where the right answer ranged from a large security team to a fraction of one person, revisits COVID as the disaster recovery test nobody scheduled, and covers the failure modes that show up again and again, including the raided line item and the backup nobody has ever restored from.

Useful for CTOs, VPs of engineering, and directors heading into a budgeting cycle who need a defensible number rather than a benchmark, and for anyone who has been told in the same year that they're spending too much and not enough.

• Becoming a Business Leader: https://itdependspod.com/episodes/becoming-a-business-leader/
• The Google SRE book, free online at https://sre.google/books/
• Listener Survey: https://forms.gle/JVeKHsHJKhEM3dvK6
• The book: It Depends: Writing on Technology 2012-2022 (https://itdependsbook.net)
• Your host: Kevin Goldsmith (https://kevingoldsmith.com)
• The theme song artist: Answers to April