The CFO reads two quiet years as over-investment and wants your second analyst cut - what do you argue?

## Why the CFO's position is reasonable In a mid-size company with two security people, an annual renewal and no breach in its history, the CFO is applying an ordinary test: what did this money buy? The answer 'nothing happened' is genuinely weak evidence, and a security lead who treats the question as ignorance rather than as a fair challenge will lose. The productive move is to concede the point about the incident count and change what the argument is about. ## Fear is not an argument, and neither is an invented number Two failure modes lose the room immediately. The first is **fear**: industry breach statistics, a competitor's incident, a generic average cost of a breach. These are claims about other organisations, and a numerate CFO discounts them correctly - your base rate is not theirs, and the figure was not derived from your estate. The second, and worse, is **inventing a prevented-breach count**. You cannot count events that did not occur. Asserting a number you cannot derive puts your credibility in play for a figure that will be challenged in the next meeting, and once it collapses, the defensible evidence you presented alongside it collapses with it. ## Argue capability, with evidence that actually exists What you can put on the table, all observable: - **Cases detected and contained**, with the time from first record to containment, and what impact was avoided in each specific case. Two well-documented near-misses beat any industry statistic. - **Coverage in hours**. With two people there is a staffed window; name it. If an alert arrives outside it, say what actually happens and how long it waits. - **Worked volume** - alerts triaged, including the ones correctly closed as benign, which demonstrate the pipeline was live rather than dormant. - **Executed techniques and the stage each reached** - the only positive evidence generated by the defence itself rather than by an adversary's mistake. - **How findings arrived** - detected internally versus reported to you by a supplier or a customer. If any arrived from outside, that gap is your strongest concrete ask. ## Present options, not a plea The budget decision belongs to the budget holder. Your job is to make it an informed one, which means offering the alternatives with their honest costs rather than defending the status quo: 1. **Sustain two people.** What it buys: the current staffed window, in-house context on the estate, response executed by people who know it. What it costs: the salary, and no overnight coverage regardless. 2. **Drop to one.** What it buys: the saving. What it costs: single points of failure on leave and illness, a queue that grows, and the loss of whichever activity the second person was doing that nobody else does - usually detection improvement and the exercises, which are exactly the evidence this meeting needed. 3. **Move first-line triage to a provider.** What it buys: hours of coverage that a two-person team cannot staff, at a cost usually below a second salary. What it costs: a provider triages alerts against your estate without your context, and cannot own containment decisions on it - escalation and response authority stay in-house, so you still need an owner, and you have added a supplier to manage and measure. It is a coverage purchase, not a responsibility transfer. Mixing options is often the honest answer: a provider for out-of-hours raising plus one in-house owner is a real configuration, and saying so demonstrates that you are optimising the company's spend rather than protecting headcount. ## Frame the spend correctly Security capability is bought against a low-probability, high-consequence event, which is why activity-based justification fails. The comparison a CFO can act on is: what does the company lose in a bad week, who would run that week, and how many hours of that week would pass unobserved under each option. That reframes the question from 'what did we get for the money' to 'what capacity are we choosing to hold', which is a decision an executive is used to making. End by asking for the decision to be recorded with the coverage it accepts and a date to revisit it, so the same conversation next year starts from what was agreed rather than from scratch. ## Then instrument the year you just argued about badly The reason the meeting was hard is that the evidence was assembled afterwards. Fix it forward: record every case's detection-to-containment timeline as it happens, keep a running list of techniques executed and the stage reached, track the staffed-hours gap, and note every finding that arrived from outside. Next renewal is then a review of a record rather than an argument about a zero.