/find@mail

Articles, write-ups, and musings concerning the world of cybersecurity and technology.

Soft Skills: Nothing Happened, So Cut the Budget? A Memo on Proving a Negative

 · 887 words · 4 min read · by QiO:~$ ·

Soft Skills: Nothing Happened, So Cut the Budget? A Memo on Proving a Negative

The new VP's logic: no major incidents, so we must be overspending on security. Here's the memo that answers with numbers instead of pleading.

Simulated scenario: This post is based on a hypothetical assignment from a cybersecurity course. The VP, the company, and the situation are fictional; however, the cited breach-cost statistics and professional challenges  are real.

The scenario

A new senior vice president reviews every department's budget and decides the company spends too much on cybersecurity for its size. She recommends an immediate 23% cut, based on informal conversations with companies of similar headcount that happen to be in manufacturing and services, neither of which is our line of business. Her condition for retracting it: someone must prove that the lack of significant attacks is due to our defenses, not because we're an unattractive target. My assignment was to write the memo.

The technical case is the easy part. The harder skill is making it in the language of the person holding the budget: money, risk, and options, without sounding defensive.

The memo

TO: VP Carter
FROM: Cybersecurity Team
RE: Proposed 23% cybersecurity budget reduction

Dear VP Carter,

I understand that you have been discussing downsizing cybersecurity and information security budgets in the coming year with your counterparts. I believe your intention to be fiscally responsible with our organizational budget is correct, and I would like to offer my input on why financial and personnel restrictions within the cybersecurity division could lead to negative consequences.

There seems to be a misconception that the lack of cybersecurity incidents is evidence that our organization is overspending, when in fact, we are victims of our own success. At current manpower and resources, the Cybersecurity team is well-equipped, trained and prepared to secure our network and quickly respond to attacks. In fact, our organization faces hundreds of scans, intrusions and attempted malware deliveries and phishing attempts daily. It is because of our strong position that incidents never become serious or more costly for the organization.

You've asked for proof that our spending, and not our obscurity, is why we've had no significant attacks. Strictly speaking, no one can prove a negative, and I won't pretend otherwise. What I can offer is evidence: the volume of attempts we detect and stop, how quickly we detect and respond, and the near-misses caught early. That same evidence tests the "unattractive target" theory, because a company nobody is interested in doesn't see hundreds of attempts a day.

On the 23% figure itself, headcount doesn't tell us what we should spend. A manufacturer and a service organization hold different data, run different systems, and face different regulatory obligations than we do. What we protect, not how many people we employ, should set the size of the security budget.

Cyberthreats are on the rise against every organization, and every industry on Earth. Our business is no different. We hold valuable data that our customers and stakeholders trust us to protect. Rather than ask what that trust is worth, I'd like to put a number on it. A business impact analysis (BIA) ranks the systems and data we can't operate without and estimates what losing each would cost in downtime, revenue, and regulatory exposure. It would tell you how bad an incident like a ransomware attack could be for us, not for an industry average.

For context, IBM's 2026 Cost of a Data Breach report puts the global average breach at $4.99 million, a record high and a 12% increase over last year. The 2025 edition put ransomware and extortion incidents at $5.08 million on average, and lost business alone averaged $1.38 million. If a major breach occurs and customer data is compromised, the resulting legal disclosures and negative press would mean a PR nightmare, potential liability exposure, and loss of public trust in our brand. I argue this would cost far more than any proposed budget cut would save, and a BIA is how we test that claim instead of just asserting it.

In conclusion, I hope that before making any final decisions in this matter you will meet with our team in the SOC and see for yourself the excellent work we are doing to protect this organization from a constant and continuous barrage of cyberattacks. We are open to discussing ways that we can help the organization sustain its financial footing while also ensuring that no corners are cut when it comes to preventing much more costly disasters.

Respectfully,
[Name]
Cybersecurity Team

Takeaway

The VP's challenge was really a question about how security proves its value, and the honest answer is that it can't prove the attacks that never happened. It can show what it stopped, and it can price what it's preventing. Notice what the memo does not do: it doesn't accuse her, it doesn't dismiss the goal of saving money, and it ends with an offer instead of an ultimatum. In security, the case you can make in someone else's terms is the one that gets funded.

Sources

Read next

Field Notes: What Is STRIDE? A Quick Look at a Practical Threat Model