The Premise
The most dangerous time for any business isn’t during a crisis it is when everything feels calm. That’s when our psychology tricks us into being too relaxed and complacent, paving the road to quietly becoming a casualty.
Psychologists call this Hedonic Adaptation. It is when we quickly get used to “good times” and stop appreciating them. Layered on top of this is Normalcy Bias, which is the assumption that tomorrow will look just like today, so disruption feels unthinkable. Together, they create a dangerous loop of emotional desensitization followed by cognitive denial of risk.
In business, these biases translate into complacency. Leaders feel secure, budgets get trimmed, and in the field of cybersecurity, operational cost is reduced to just another line item. But what happens when the board treats security as a cost to cut, right before the next breach?
According to IBM’s 2024 Cost of a Data Breach Report, Organizations with severe staffing shortages faced an average of US$1.76 million more in breach cost than those with low level or no staffing issues.
As per IBM’s 2025 report, the global average cost of data breach fell to US$4.4 million from the US$4.88 million last year. However, Canada and the United States have had an increase in breach cost even before the end of this year.
Moreover, when looking at the breakdown of the cause behind data breach, majority of the breaches are due to malicious or criminal attack, followed by failures of IT team. The remaining 26% is caused due to human error.
This means that with proper training, manpower, and a good security posture, 77% of the issue could have been prevented while the human error element could be reduced over time through employee training and cyber vigilance.
The Issue
To drive the point further to the spotlight, according to The CISO Report of 2025 by Splunk, 29% of CISOs say they received the required budget for cybersec initiatives to achieve their security goals. Besides the fact that the other 71% of CISOs do not get the needed budget, the report also states that 41% of board members think cybersecurity budgets are adequate.
This makes one wonder based on what information did the board make such a bold assumption? Clearly not a technical one then it must be business or finance related metrics.
What we need to understand is that when it comes to board members, one of their primary goals is to protect and grow shareholders’ return of investment at all times. Couple that with the lack of understanding of cybersecurity and its technicalities results in decisions based on skewed factors.
The same can be said about smaller organizations where they do not have CISO but probably an IT manager/director that reports to the General Manager or Managing Director.
This is not something specific to cybersecurity. Any aspect of the business that does not translate to some kind of monetary return of investment is usually relegated to the bottom of the proverbial to-do list.
Nevertheless, keeping in line with the topic, it is evident form the reports that most decision makers tend to see cybersecurity as a departmental initiative or a component of the business instead of seeing it something that encompasses the entire operation.
How most companies see cybersecurity…
Versus how it should be seen.
But in all fairness, it is equally disingenuous to simply relegate this matter to lack of understanding by the board members without even acknowledging the possibility that perhaps there is a communication barrier between head of cybersecurity and upper management. Perhaps some CISOs are unable to related their concerns and solutions in a way a non technical person would comprehend.
In the same 2025 report by Splunk there is clear correlation between successful breach as a result of budget cuts and what underlying factor was the cause.
The Remedy
As mentioned previously, decision makers or those in charge of budget allocation are not necessarily against spending money when no profit is to be made. But it become a bigger responsibility for those leading cybersecurity initiatives to bring clarity on what is required and how it would benefit the business.
Simply saying something is needed or beneficial is not enough, it is important to outline what that benefit entails in a way that can be quantified. Afterall, When boards sidelines cybersecurity needs, they are also neglecting fiduciary duty, because protecting shareholder value requires protecting resilience.
What needs to be communicated succinctly is the ROI of Security such as:
- Cost of avoidance – how much would a breach cost in terms of customer trust or regulatory fines?
- Revenue enablement – how would proactive security help maintain and grow market reputation or customer trust?
- Operational continuity – how much would it cost the business to go through a downtime, which would also include replacement cost?
Example: Spending $5M on proactive measures that prevent a $50M outage is ROI, even if it doesn’t show up as profit on a P&L.
Therefore, a practical approach for executives in charge of cybersecurity would be to bring business clarity into discussion, thus shifting from a budget oriented mindset.
- Focus on communicating in financial language (e.g. expected loss, cost-benefit analysis, etc.)
- When possible, benchmark against peers to justify your level of investment.
- Tie cybersecurity spending to business outcomes (e.g. customer trust, compliance resilience, etc.)
- Use relevant security KPIs (e.g. time-to-detect, time-to-recover, % of critical assets with controls, etc.)
- Integrate cyber risk into enterprise framework for risk management.
Cybersecurity isn’t a line item, it is an assurance for trust, brand reputation, and business continuity. Boards that treat it as an investment aren’t just avoiding losses, they are buying resilience, confidence, and long-term shareholder value.
The question you should ask yourself: will you wait for a breach to make that investment, or act now while stability is still on your side?
Taleb is a cybersecurity professional who transitioned into the field after a 17-year career in Brand Communication, where he advised multinational organizations on strategic and reputational initiatives. After earning his CPTS certification, he joined RBT Security to pursue a career centered on offensive security.
He is currently focused on strengthening his technical expertise in cloud security, foundational malware development concepts from a defensive learning standpoint, and practical penetration testing, while building the foundation for future specialization in red teaming and adversary simulation.
Taleb aims to leverage his background in communication alongside technical proficiency to connect strategic objectives with hands-on cybersecurity practice.