Security budgets fail in a predictable way: the CISO presents a list of tools and threats, the CFO hears costs without outcomes, and the number gets shaved until it fits last year’s envelope plus inflation. Both sides leave frustrated, and the gap gets rediscovered during the next incident.
The CISOs who break this cycle speak the CFO’s native language: return per dollar. Not fear, not benchmarks, but a model that says "this initiative removes this much risk for this much money", backed by their own data.
Risk reduction as a unit of account
Start with your register. Each top risk carries a scenario, a likelihood and a business impact range: the ransomware outage, the vendor data spill, the payment fraud path. Each proposed initiative maps to the risks it treats and by how much, in the same units.
Now every line item in your budget has a numerator. The EDR renewal is not "a tool we have had for years"; it is the control holding two high risks inside appetite. The identity cleanup is not "hygiene"; it is the single largest reducer of attack-path exposure on the board.
- Model initiatives against named risks from your own register, not industry averages.
- Express reduction in the impact currency the CFO already uses.
- Show the cost of the "do nothing" option with the same rigor as the ask.
- Rank the portfolio by reduction per dollar, and be seen cutting your own weakest items.
The credibility move nobody expects
Volunteer a cut. Somewhere in your stack is a control treating a risk that has genuinely shrunk. Naming it, and returning its budget, does more for your credibility than any threat statistic, because it proves the model runs in both directions.
“The strongest budget argument a CISO can make is a model the CFO can audit.”
From annual battle to standing agreement
When risk reduction per dollar is computed from a live register, budget season stops being an annual performance and becomes a quarterly review of a portfolio. The conversation shifts from "why do you need this" to "which risks do we want to buy down next". That is a conversation security wins.
