Your Cybersecurity Dollar

Where do you actually spend your cybersecurity time and money? Salary? Hardware? Training? Consultants? AI?

(Note that this question is not useful unless and until you have an effective, evidence-based Cybersecurity Program up and running.)

Most of us don't actually know the answer to that question. Finding that answer is an interesting exercise that should be part of cybersecurity leader's annual to-do list. You can find out with these deceptively simple steps:

1. Write out your group's priorities
2. Match your budget to those priorities
3. Match your actual spending  to those priorities
4. Match your person hours with those priorities

The fact is that we all have a bit of a gap between what we think we value and what our actions indicate that we value. This gap tends to drift over time without conscious realignment,  so regular checking is a good idea.

But checking is, itself, neither cheap nor easy so only check when you are in a position to actually make good use of the data. If you collect the data and then do nothing with it you will demoralize your team instead of energizing them.

Once you have the data you need to decide what it means. Since this is not a business school study, there is likely no simple answer to the question "how are we doing?" If your actual priorities and your theoretical priorities don't align then you need to figure out why, but you don't need to beat yourself up. Perhaps your actual priorities are just fine and your theoretical priorities need to be adjusted.

Perhaps your actual priorities are an unpleasant surprise and need to be adjusted. This is harder as you have to lead, to change the budget and the tasks on which your team spends their time.

Perhaps your theoretical priorities are out of date and your actual priorities are out of date, in which case both need to be reassessed and adjusted. This is not a great sign, but also a concrete problem to be addressed with budget and personnel assignments.

The data comes first: in order to recognize and respond to your actual situation you must first know what your actions are telling you. If you are very self-aware and adept at avoiding common management pitfalls then you may discover that your actions and values are already perfectly aligned. If your evidence-based Cybersecurity Program (CSP) confirms that you are providing effective and cost-effective cybersecurity, then you are done. (In my case I would make a point of letting my peers know about this glorious triumph, but perhaps you are more modest and more trusting in your colleagues' ability to comprehend your glorious triumph.)

Speaking of your colleagues, there is an extra credit project here: repeat the process, but with your boss's idea of your priorities. That can be a real eye-opener.

Speaking of extra credit, if you do this annually you can compare and contrast your priorities (both actual and theoretical) over time. Are you responding to trends or chasing fads or standing still? At least now you know and that is the first step in being more effective and more cost-effective.

For the adventurous, Pythia Cyber can help you take this a step further which is an investigation into your team dynamics. Who is great at their job and also a good teammate? Who is contributing to overall effectiveness without drawing attention to themselves? Who is a toxic teammate you would do well to remove or retrain? Again, checking your impressions against your team's impressions and both of those against our assessments is going to be eye-opening.

Monitoring systems is hard but we have the NIST CSF to help us do it. Monitoring our behavior is harder and just as important, but there is no rigorous framework to fall back on. That is why Pythia Cyber does behavioral cybersecurity and why we provide the tools that we provide. Making sure that you are doing what you mean to do is hard. We can help. Ask us how.