Build a Cybersecurity Budget Your CFO Can Approve: Start with Real Business Risks.
By Jay Martin, CISO, Blue Mantis
Let me describe a conversation I’ve had more times than I’d like.
It’s November. A CFO asks the IT or Security Director for next year’s security number. The IT director takes last year’s spend, adds a percentage, and sends it over with a short justification that includes the word “threats” at least twice. The CFO trims it. Everyone moves on. Then in March something happens, and the real conversation about priorities finally starts, with no budget attached to it.
I’m not describing this to be critical. The Director in that story didn’t have a better option. The honest version of a security budget starts with a question most organizations can’t answer on short notice: what are we actually exposed to, how do we explain it based on business risk and what would it cost to fix the most pressing gaps?
The mistake isn’t underspending. It’s spending blind.
I’ve seen plenty of security programs with healthy budgets and poor outcomes, and the failure pattern is almost always the same. The money went to tools before anyone fully understood the gaps and risk, how to fully deploy the tools to realize full value and how to maintain the tool based on the latest threats. A vendor had a compelling demo. A headline scared the board. A competitor bought something. None of those are risk assessments. They’re reactions.
The result is a stack of overlapping products, a few critical gaps nobody noticed because no person, process, third-party or tool addressed them, and remediation work that keeps getting deferred because it doesn’t come with a product to buy.
A real assessment inverts this. It starts from your risk appetite, your assets, your threats, and the business impact of losing or exposing each, and only then asks what to spend. That ordering is the whole point.
Why I’m telling you this in October
Timing matters more here than people think. For organizations on a calendar fiscal year, budgetary numbers typically go to the CFO in October / November, and final decisions can slip as late as mid-Q1. That means the window to get real evidence into your request is right now, and it’s closing.
There’s a second clock running too. Cyber insurance renewals are landing on desks, and carriers are asking harder questions and more demanding evidence than they did a few years ago. Compliance reviews are queued up for year end. All three of these, budget, insurance, and compliance, want the same thing: a defensible picture of your current risk and a plan to reduce it.
One assessment can feed all three. That’s not a sales line, it’s just efficient.
The problem with the “full” risk assessment
Here’s where I’ll disagree with a lot of my own industry. The traditional comprehensive risk assessment is valuable, and we do them all day, every day. But it can take weeks, requires a lot of your team’s time, and by the time it’s done the budget cycle has moved on. For an organization that needs numbers in a few weeks, recommending a several weeks-long engagement is the wrong answer, even if it’s the thorough one.
So this year we built something smaller on purpose.
The Rapid Risk Assessment
This is an expedited version of our Security Risk Assessment based on NIST’s Cybersecurity Framework (CSF 2.0), scoped to finish in days, not weeks. It is not a replacement for the full program assessment and I won’t pretend otherwise. What it is, is a credible snapshot of your risk profile, fast enough to matter for this budget cycle.
The method is the same one we use on the full engagement, compressed. We run up to three working sessions with the people who actually know your environment, assess your capabilities against the NIST Cybersecurity Framework, and measure where your controls sit against industry standards and best practice. Alongside that, we run two scans that produce the findings people remember:
- A dark web scan, to find out whether your users’ credentials are already for sale, whether anyone is impersonating your brand or if your data is exposed to cybercriminals.
- An external attack surface scan, to see your organization the way an attacker does: what’s publicly exposed, what’s reachable that shouldn’t be, and where the untrusted points are.
What you get at the end:
- Key risks, ranked by likelihood and business impact rather than by vendor category, including an understanding of AI-related risks such as sensitive data exposure, unauthorized AI use, and excessive access granted to AI tools and agents, expressed in business terms your CFO can understand.
- Control maturity, so you know not just what’s missing but how well what you have actually works.
- Security gaps, including the unglamorous ones: identity hygiene, backup validation, access reviews, logging coverage.
- Compliance posture against the standards your auditors and insurers care about.
- Budgetary estimates for addressing the findings, so your 2027 request has line items with reasoning behind them instead of a percentage increase.
- A short roadmap of what to fix first and what can be phased into next year.
If the findings warrant it, this naturally leads into deeper work: a full assessment, penetration testing, cloud or infrastructure updates, etc. If they don’t, you’ve still got a defensible budget and a clean story for your insurer. Either outcome is better than guessing.
What I’d tell a peer
If another CISO asked me how to approach the next eight weeks, I’d say this. Don’t walk into the CFO conversation with a number and adjectives. Walk in with findings in business risk terms, costs, and a sequence. The budget discussion gets shorter, the approvals get easier, and you stop having the March conversation in March.
And yes, I’m telling you this partly because Blue Mantis offers the assessment. I’m also telling you because I’ve been on the other side of that CFO desk, and evidence is the only thing that has ever reliably worked.
Get a clear picture of your cybersecurity risks before next year’s budget is finalized. See what a Blue Mantis Cybersecurity Risk Assessment covers and request the Rapid option.
