Justifying security costs by quantifying protection results

How many times have we heard a CISO say: “I don’t have enough money for security”. But, what is the right amount of money for security? How is it determined? Who makes that decision?

6 QUESTIONS EVERY CISO MUST ANSWER

THE PROTECTION PROBLEM SPACE VS. THE SECURITY PROBLEM SPACE

WHY EVIDENCE OF SECURITY IS NOT PROOF OF PROTECTION

IS COMPLIANCE HURTING MORE THAN IT’S HELPING?

COMPLIANCE IS OFTEN IN THE WAY OF WHAT WE ACTUALLY WANT AND UNDERMINES…