Chapter 3 of 12 · Budget cycle
Q3: Are We Spending the Right Amount on the Right Things?
- How do I know if our security budget is enough?
- Are we paying for tools we don't use?
There is no correct figure for security spend. What you can check is whether the money follows the risks the CISO described in Q1.
What you should hear
- How spend maps to the top risks.
- What is committed (licences, contracts, salaries) and what can be moved.
- What the CISO would stop paying for if the budget were cut, and what they would add if it rose.
Red flags in the answer
- The budget is justified only by comparison with other companies.
- Spend has grown each year but nobody can say what risk went down.
- Large tools are owned but not fully used or watched.
The question you might not ask out loud
Should we just match what our peers spend?
Peer figures are a sanity check, not an answer. Two companies the same size can face very different risks. The better test is whether each major line of spend reduces a risk the board cares about.
Follow-up
"If we gave you no extra money next year, what would you stop doing, and what risk would that leave?" The answer shows how well the CISO understands their own priorities.
Why this matters: security spend tends to grow in steps after incidents or headlines, then stay at the new level whether or not it is still aimed at the right things. A yearly look at what each major line achieves keeps the budget tied to the risks.
Ask too about spend outside the security budget. Engineering, IT and business teams often buy security tools themselves. The total can be larger than the line the board sees, and it may overlap.
Rule of thumb:Ask what spend achieved, not how much was spent.