Why your CISO is Losing the Budget Battle (And What to Do About It)

Every year, security leaders walk into budget conversations with the same problem. They know exactly what they need. They can describe the threat landscape in detail, map the gaps in their current program, and articulate precisely what an investment would address. And then they leave the room with less than they asked for, sometimes significantly less or with nothing.

This isn’t a resource problem. It’s a communication problem.

I have seen this firsthand in my career and in my teaching, students and leaders genuinely struggling to make their case. Not because the case isn’t there, but because the way they’re making it isn’t landing. They’re speaking the language of threats when the room only hears the language of decisions.

The Core Misalignment

Executives and board members aren’t ignoring cybersecurity. If anything, they’re more aware of it than ever. The problem is that most budget conversations are structured around what security leaders are worried about, rather than what the business is being asked to decide.

There’s a significant difference between those two things.

A threat briefing tells the room the reality. A budget conversation should tell the room what tradeoff they’re making. Every resource allocation decision is a bet on likelihood, on impact, on priority. When security leaders present a threat landscape without framing the decision, they’re handing executives a problem without a choice. And executives, almost universally, will defer or defer-and-reduce.

What Actually Works

The most effective security budget conversations I’ve observed have three things in common.

First, they quantify the exposure. Not in CVEs or severity ratings, but in business terms. What does a ransomware event cost in this environment? What’s the regulatory exposure if we experience a breach? What’s the reputational impact and how long does it affect revenue? These numbers don’t need to be precise but they need to be defensible and real. “Between $3M and $8M based on industry comparables and our specific architecture” is far more useful than “ransomware is a high-severity risk.”

Second, they frame the decision as a tradeoff. “If we fund this program, we reduce our probability of this category of event by approximately X. If we don’t, here’s what we’re accepting.” Executives make tradeoffs all day. Give them a clean one and most of them will make the right call.

Third, they connect to something the business already cares about. For example, regulatory readiness if compliance is a pressure point. Operational continuity if there’s a board conversation about resilience. M&A due diligence if there’s a transaction on the horizon. Security always connects to business priority, the skill is  finding the thread.

The Underlying Problem

Most security leaders were never trained to make business cases. They were trained to identify risk, implement controls, and respond to incidents. The leadership skills like translating, quantifying, persuading, navigating organizational dynamics are usually developed on the job, through trial and error.

That’s a significant gap, and the industry doesn’t talk about it enough.

The organizations that fund security programs effectively aren’t necessarily the ones with the biggest threats or the most sophisticated environments. They’re the ones with security leaders who’ve learned to speak business executive. That’s a learnable skill, and it’s the one that changes budget outcomes.

A Practical Starting Point

Before the next budget conversation, try rewriting your ask in two sentences: what you’re requesting, and what decision you’re asking the business to make. If you can’t do it in two sentences, you’re not ready to present it yet.

The goal isn’t to simplify the complexity of what you do. It’s to make the decision as clear as possible for the people who have to make it. That’s not a concession. That’s leadership.