"Why would anyone bother targeting us?" might be one of the most expensive questions an organization can ask…
James W. — Decision Intelligence Executive
"Why would anyone bother targeting us?" might be one of the most expensive questions an organization can ask when it's being used to justify doing nothing. I've heard variations of that argument throughout my career, usually somewhere between a CTI assessment identifying a credible threat and a discussion about why remediation needs to wait until the next budget cycle. And I understand the temptation, because preventive security spending is immediate, visible, and relatively easy to question, while the cost of an incident that hasn't happened yet is hypothetical and conveniently absent from the balance sheet.
Unfortunately adversaries don't necessarily care whether we consider ourselves important enough to target. Sometimes we're valuable because of the information we hold, the services we provide, the organizations we're connected to, or simply because we're an accessible stepping stone toward something else. That's where dismissing CTI becomes a business decision, whether leadership recognizes it or not.
When intelligence identifies a credible exposure and the organization chooses to defer remediation, it isn't avoiding a cost. It's accepting a risk whose eventual price may include incident response, forensic investigations, legal expenses, operational downtime, lost revenue, customer attrition, regulatory scrutiny, and months of recovery work. Compare that with the often considerably smaller cost of preventive maintenance, targeted remediation, compensating controls, or architectural improvements before an adversary gets involved.
What bothers me isn't that organizations sometimes accept risk, because there are perfectly legitimate business reasons to do so. It's when they accept that risk without understanding the potential consequences, or dismiss the intelligence because the threat doesn't fit their perception of who would find them interesting.
CTI should help leadership distinguish between theoretical exposure and credible business risk, quantify the consequences where possible, and understand what they're buying with remediation versus what they're gambling by deferring it. And we should be measuring that decision over time, because a vulnerability left unresolved for six months isn't necessarily the same risk it was when the original assessment was written.
I wonder how many organizations would make different decisions if every deferred remediation carried an estimate of the operational and financial consequences of being wrong, alongside the actual cost of fixing it. If preventing a breach costs $50,000 and recovering from one could cost $5 million, are we really saving money by postponing remediation, or just betting the business that nobody notices before we get around to it? CTI may be classified as 'overhead' but if that same 'overhead' saves money in the long run shouldn't we begin to consider it more like flipping a cost center into a revenue generator?
2 reactions · 1 comments