Spending More on Cybersecurity Won't Save You From a Breach

Cybersecurity budgets continue to grow as organizations adopt new security platforms, expand monitoring capabilities, and respond to increasingly complex threats

An organization may have enterprise-grade security tools, a dedicated security team, and the necessary compliance certifications while still exposing critical systems to preventable attacks. The problem is not necessarily a lack of investment. It may be that the investment is directed toward the wrong priorities, existing controls are not working as expected, or identified weaknesses remain unresolved.

For business leadership, cybersecurity should be treated as a risk management decision rather than a technology purchasing exercise. The objective is to protect critical operations, sensitive information, customer relationships, and the ability to recover from an incident.

The question is whether the money being spent is making the business measurably more secure.

The Difference Between Security Spending and Security Effectiveness

Consider an organization that has invested in endpoint protection, centralized security monitoring, cloud security tools, and compliance programs. These capabilities may provide substantial value, but their presence alone does not establish that the organization's most significant risks are under control.

A compromised employee account, an improperly configured cloud identity, or an authorization flaw in a customer-facing application can still provide an attacker with access to sensitive resources.

The effectiveness of the organization's security posture depends on how well its controls address these risks, how reliably they operate, and whether weaknesses are identified and corrected before they can be exploited.

This distinction is important when evaluating security investments. Purchasing a product establishes a capability; validating that capability establishes whether it delivers the intended protection.

Where Cybersecurity Budgets Go Wrong

1. Investing in Tools Without a Clear Risk Objective

Security products often promise better visibility, faster detection, and greater automation. These benefits can justify investment, but only when the product addresses a defined problem.

An organization might purchase an additional monitoring platform while a critical application remains vulnerable to unauthorized access. The new platform may improve detection, but it does not correct the underlying application weakness.

Overlapping products can also increase licensing costs, operational complexity, and the workload required to manage alerts without proportionately improving security.

Before approving an investment, decision-makers should understand the risk it addresses, the limitations of existing controls, and the criteria that will be used to measure its effectiveness.

The objective is not to minimize the number of security products. It is to ensure that each investment has a defensible purpose.

2. Treating Compliance as Evidence of Security

Compliance is an important part of cybersecurity governance. It helps organizations establish minimum requirements, document controls, and meet regulatory and contractual obligations.

However, compliance does not guarantee that an organization is resistant to real-world attacks.

A company may have a documented access control policy and pass an audit while an application still allows one customer to retrieve another customer's records by modifying an API parameter. The policy exists, but the application does not enforce the intended access restrictions.

This is why compliance assessments should be complemented by technical security testing. Penetration testing, configuration reviews, and access control validation can reveal weaknesses that documentation alone may not identify.

Compliance demonstrates adherence to defined requirements. Security testing provides evidence of how systems behave under realistic attack conditions. Both are necessary, but they serve different purposes.

3. Reporting Activity Instead of Risk Reduction

Security reporting often emphasizes the number of vulnerabilities closed, alerts investigated, devices protected, and assessments completed. These figures help teams track operational performance, but they can obscure the risks that remain.

For example, closing hundreds of low-severity findings has limited value if an exploitable vulnerability in a critical application remains unresolved.

More useful reporting connects technical activity to business exposure. This includes the number of high-impact findings still open, the time taken to remediate critical weaknesses, the effectiveness of access restrictions, and the results of incident response exercises.

Recovery capabilities should also be measured through testing. Maintaining backups is not sufficient if critical services cannot be restored within the organization's recovery objectives.

The distinction is between work completed and protection achieved. Security metrics should help leadership understand both.

4. Finding Vulnerabilities Without Funding Remediation

Security assessments frequently identify weaknesses that require changes across application development, infrastructure, identity management, or operational processes. When remediation is underfunded or delayed, the value of the assessment is reduced.

Consider a penetration test that identifies an authorization vulnerability in a customer-facing application. The finding is documented and assigned, but the development team has no capacity to address it before the next release.

The assessment has identified a genuine risk, but the organization's exposure remains.

Effective security investment must account for the full remediation process: identifying the weakness, assessing its impact, assigning ownership, implementing the fix, and verifying that the vulnerability is no longer exploitable.

Where immediate remediation is not possible, the organization should assess interim safeguards and document the residual risk for appropriate approval.

A completed assessment should not be treated as a successful outcome when significant findings remain unresolved.

5. Overlooking the Relationship Between Vulnerabilities

Individual security findings do not always reveal the full extent of an organization's exposure. Attackers may combine weaknesses across applications, identities, and infrastructure to reach sensitive resources.

For example, a compromised employee account might provide access to an internal application. A weakness in that application could expose a service credential, which may have excessive permissions in the cloud environment.

Each issue may appear limited when considered independently. Together, they could provide a path to a critical business system.

Attack-path analysis helps identify these relationships and determine which combinations of weaknesses create the greatest exposure. This enables security teams to prioritize remediation based on the resources an attacker could reach and the potential consequences.

For organizations with complex application and cloud environments, understanding these paths can be more useful than managing vulnerabilities solely by severity score.

Allocating Security Budgets According to Risk

A more effective investment process starts with business-critical assets and the risks that could affect them.

Identify Critical Business Operations

Determine which applications, data, and infrastructure are essential to revenue, customer service, regulatory obligations, and business continuity. Assess the consequences of their compromise or unavailability.

This provides a basis for prioritizing security investments according to business impact rather than treating every asset equally.

Establish the Current Exposure

Use threat modeling, vulnerability assessments, penetration testing, cloud configuration reviews, and identity assessments to understand how attackers could reach critical resources.

Prioritization should consider exploitability, exposure, potential impact, existing safeguards, and the effort required to reduce the risk.

Compare Investment Options

Evaluate proposed investments against the risks they address, implementation and operating costs, operational requirements, and expected improvements.

For example, an additional monitoring capability may be justified if a critical detection gap exists. However, if an exploitable authorization flaw presents a more immediate business risk, remediation may deserve priority.

The decision should reflect the organization's overall risk profile rather than a general preference for new technology or reduced spending.

Verify the Results

After implementing a control, determine whether it has achieved the intended outcome. Retest vulnerabilities, validate access restrictions, assess detection coverage, or exercise recovery procedures as appropriate.

Where possible, compare results against a baseline established before the investment.

This gives leadership a clearer view of whether the expenditure improved security and whether further work is required.

Review Priorities Regularly

Business applications, cloud environments, third-party integrations, and threat conditions change over time. Security investments should be reassessed as these changes affect the organization's exposure.

A budget that was appropriate for the previous year may not address current risks. Periodic reviews help ensure that resources remain aligned with business priorities and unresolved security gaps.

Measuring the Business Value of Cybersecurity

Calculating cybersecurity return on investment is difficult because prevented incidents and avoided losses cannot always be measured directly.

Counting blocked attacks or vulnerabilities fixed does not establish the amount of financial loss avoided. Financial estimates can support decisions, but their assumptions and uncertainty must be made explicit.

A more defensible assessment considers several factors.

Risk reduction: Has the likelihood or potential impact of a material incident decreased?

Operational resilience: Can critical services continue or recover within established recovery objectives?

Control effectiveness: Have technical tests confirmed that the intended protections work?

Operational efficiency: Has the investment reduced response times, unnecessary workloads, or overlapping capabilities?

Business requirements: Does the investment help satisfy customer security requirements, contractual obligations, or regulatory expectations?

These factors provide a practical basis for comparing investments without assigning speculative financial returns to every security control.

The aim is to understand the risks being reduced, the costs involved, and the evidence supporting the decision.

The Additional Cost of Poorly Planned AI Adoption

AI introduces further considerations for security investment. Organizations may purchase AI-powered security products to improve detection and investigation, or deploy autonomous agents to perform operational tasks.

Both can provide value, but their effectiveness depends on implementation, integration, and appropriate controls.

An AI agent connected to internal applications, repositories, or cloud services may have access to sensitive data and the ability to execute actions. If its permissions are excessive or its tool integrations are poorly secured, the deployment can introduce risks that were not present in the original workflow.

Before investing in these capabilities, organizations should define the intended use case, establish measurable performance criteria, assess data access requirements, and determine how incorrect or unauthorized actions will be contained.

The evaluation should include both the benefits of automation and the additional security responsibilities it creates.

AI adoption should be driven by a demonstrable business need, supported by security controls proportionate to the system's access and potential impact.

Questions to Ask During a Security Budget Review

A useful budget review should establish whether spending is aligned with the organization's most consequential risks.

Leadership should be able to determine which critical exposures remain unresolved, why remediation is delayed, and what evidence demonstrates that existing controls are effective. The review should also identify overlapping capabilities, underfunded security requirements, and changes in risk since the previous planning cycle.

Where a proposed investment is expected to reduce risk, the business case should explain how that improvement will be evaluated. Where significant residual risk remains, responsibility for accepting it should be clearly assigned.

These practices make security investment decisions more transparent and connect technical priorities to business accountability.

Conclusion: Measure What the Investment Achieves

Cybersecurity effectiveness cannot be determined by budget size, the number of products deployed, or the completion of compliance assessments alone. These factors provide context, but they do not establish whether critical business risks are adequately controlled.

A sound investment strategy connects spending to defined risks, validates the effectiveness of controls, funds remediation, and reassesses priorities as the business changes.

For NullFortis, this is the central principle of security validation: identify what an attacker could reach, determine which weaknesses create meaningful business exposure, and verify that remediation changes the outcome.

The important measure is not how much an organization spends on cybersecurity, but whether that spending reduces the risks that matter most.