Business Case / ROI Pitch Lab
You have ten minutes and one ask: fund a single security investment — EDR, Zero Trust or PAM — in front of a skeptical, CFO-led board. The hard part is not the technology; it is framing the spend as risk reduction you can measure. Show the do-nothing baseline, quantify the loss you buy down, express the return as ROSI, phase the spend to prove early value, and answer “why now, why this vendor” with evidence instead of fear or a logo. Each decision shows you why the board-defensible call wins the budget.
Pair this drill with the free Security Investment Business Case One-Pager — the document that records the case you practise here. Educational drill, not financial or legal advice.
The real job. More noise, a tighter clock.
You are the CISO with ten minutes in front of a skeptical, CFO-led board to win budget for a single security investment. Work 10 board-room decisions — build the case the way a CFO would actually fund it: quantified risk reduction over fear, a do-nothing baseline, ROSI, phasing, and a straight answer to “why now, why this vendor”. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on building and defending the business case for a single security investment (EDR / Zero Trust / PAM) to a skeptical CFO and board.
- The spine of a fundable case is risk reduction you can measure — not fear: a do-nothing baseline (current annualized loss expectancy), the loss you buy down, and the return expressed as ROSI, (risk reduction − cost) ÷ cost.
- You practise the real board traps: FUD openings, false precision, single-option asks, hidden run-costs, "we have never been breached", the "why this vendor" logo answer, and manufactured urgency.
- Each decision reveals why the board-defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not financial or legal advice. Pair it with the free Security Investment Business Case one-pager template.
Frequently asked questions
What is the Business Case / ROI Pitch Lab?
A free, in-browser decision simulation that puts you in front of a CFO-led board, defending budget for a single security investment such as EDR, Zero Trust or PAM. You work through the decisions that make or break the ask — how to open, how to quantify risk reduction, how to show the do-nothing baseline and ROSI, how to phase the spend, and how to answer "why now" and "why this vendor" — and each one has a single board-defensible answer, revealed after you lock in your call.
What is ROSI and how is it calculated?
ROSI is return on security investment. Because security rarely generates revenue, it measures avoided loss: (monetary risk reduction − cost of the control) ÷ cost of the control, where risk reduction is the baseline annualized loss expectancy multiplied by the control’s mitigation effectiveness. It lets a board compare a security control against any other use of the same capital.
Is this financial or legal advice?
No. The lab is an educational drill. The risk-quantification and business-case techniques are summarised for orientation; apply them to your own figures, risk appetite and circumstances, and confirm financial and regulatory specifics with qualified advisers.
Who is it for?
CISOs, security leaders, CFOs, finance business partners and board directors — anyone who has to build, challenge or approve the budget for a security investment and wants to rehearse the conversation before it is real.