A Worked Example: Comparing Cyber Investments Under a Fixed Budget

A fixed budget does not make the cheapest security project the best choice. It makes the tradeoff explicit: which risk response can the business deliver, what exposure remains and who accepts it?

Cybersecurity investment prioritization should compare options against the same business scenarios, not add together vendor scores that measure different things. Cost matters, but so do implementation capacity, dependencies and the evidence supporting the expected effect.

The following portfolio is entirely fictional. Its dollar amounts are planning assumptions, not market prices, client results or estimates of guaranteed savings.

TLDR

• Describe the business scenario before ranking products.

• Use a common cost basis and show the work outside the purchase price.

• Check dependencies and team capacity before selecting a portfolio.

• Keep uncertainty visible instead of inventing a precise return.

• Record the risk left untreated and the decision to revisit it.

Start with the constraint

Assume a fictional company has a $240,000 first-year budget and one delivery team with limited change windows. Its priority scenarios are unauthorized privileged access, a prolonged order-processing outage and slow detection of an intrusion.

Management has already identified control gaps for each scenario. The exercise is to select an achievable response, not to assume every proposed product addresses the gap. Validate the current state before accepting a vendor's claim about risk reduction.

NISTIR 8286B links prioritization and response to enterprise objectives, risk strategy and a risk register. That gives the comparison a common frame. It does not supply the company's values or remove the need for judgment.

Compare options on the same basis

These first-year totals include the fictional project's implementation and training allowance. They do not represent a complete multiyear cost assessment. Renewal costs, internal effort and future commitments would also need review before a real approval.

Fictional option	First-year assumption	Intended effect and key constraint
A: Privileged access cleanup	$140,000	Reduce unmanaged privileged access; depends on reliable identity ownership and application support.
B: Recovery improvements	$100,000	Improve recovery of order processing; depends on an agreed service target and a successful end-to-end test.
C: Detection expansion	$180,000	Improve visibility for defined intrusion scenarios; depends on telemetry coverage and response capacity.

The costs are deliberately simple so the decision can be inspected. A real proposal should show ranges, scope exclusions and confidence in the assumptions. Treat a narrow quote as a quote for its stated work, not proof of the full cost to operate the capability.

Choose a portfolio, not a shopping list

A plus B uses the full $240,000 assumption. C alone leaves $60,000. Neither result proves that one portfolio is better. The decision turns on the company's priorities, current gaps and ability to complete the work.

If A and B need the same team in the same change window, their combined price fits while their delivery plan does not. Sequence the work, reduce scope with an explicit consequence or reassess the portfolio. Do not call an undeliverable combination funded risk reduction.

Equally, C may be the stronger response if current evidence shows a pressing detection gap and the company already has workable privileged-access and recovery controls. This example does not establish that evidence. It shows why a universal ranking would be false precision.

The downtime cost model can inform the outage scenario. Keep delayed revenue, permanent loss and recovery costs distinct, and do not count the same consequence twice across projects.

Show what would change the decision

Ask for sensitivity cases. What if identity cleanup takes twice the planned effort? What if the recovery test reveals an unsupported supplier dependency? What if detection coverage cannot be used because no team can respond?

Do not multiply a guessed loss number by a guessed improvement percentage and present the result as a reliable return. Where quantitative analysis is supportable, show the scenario, ranges, assumptions and uncertainty. Where it is not, use a structured comparison and state what evidence is missing.

A conditional approval can be useful: release the next phase only when a dependency is resolved or a test demonstrates the intended outcome. Define that condition before purchase, including any contractual commitment the first phase creates.

Record the exposure left behind

Every portfolio leaves something undone. Record deferred work, the remaining scenario exposure, its business owner and the trigger for reconsideration. A procurement decision is not automatically an authorized risk acceptance.

Review results after implementation. Did access actually become controlled? Did the service recover within its target? Can the response team use the new detection? Completion of a project milestone is weaker evidence than a tested change in the intended outcome.

Sources

NIST, NISTIR 8286B: Prioritizing Cybersecurity Risk for Enterprise Risk Management; NIST, Cybersecurity Framework 2.0, GV.RM and GV.RR. All company circumstances, costs and portfolio choices above are fictional editorial examples.

Frequently asked questions

Should the board approve individual products?

That depends on its delegated authorities and the significance of the decision. The board's useful focus is the risk tradeoff, resources and accountability, not choosing a product without the operating evidence.

Is the unused budget in option C a reason to choose it?

No. Unused budget may preserve flexibility, but it does not establish that C addresses the most important gap. Compare the intended outcome and remaining exposure.

Can qualitative rankings be useful?

Yes, if criteria, evidence and uncertainty are explicit. They become misleading when labels conceal unsupported precision or are compared across incompatible scoring systems.

What should happen after funding?

Assign delivery and risk owners, confirm dependencies and define outcome tests. Revisit the decision when facts or constraints change, not only when the next annual budget begins.

Closing

Ask management to bring one deliverable portfolio, one credible alternative and the exposure each leaves behind. A clear tradeoff is more useful than a long list of purchases described as equally urgent.