Your executive reads "nation-state actor" and wants a budget line - what does that label justify funding?

## The situation A summary crosses an executive's desk with the words "nation-state actor" in it. The reaction is predictable and not unreasonable: this sounds like the serious end of the problem, so what do we need to spend? You are the person who has to answer, and the answer is neither "nothing, it is hype" nor a number. It is a translation of the label into the specific predictions it supports, followed by an explicit list of the things it does not support - because the second list is what stops the money going to the wrong place. ## What the label supports The class asserts sponsorship and patience: an objective that outlives any single campaign. Two consequences follow, and both are fundable. **Eviction is an interruption, so buy durability.** If the requirement survives your remediation, then work whose entire value is ending the current episode has a short half-life. What holds afterwards is structural: credentials that expire quickly enough that a stolen one is worth little, authentication that a copied secret cannot satisfy, administrative paths scoped tightly enough that a re-entrant cannot rebuild yesterday's position from a foothold. That is a control-class argument, and it is the same argument whether or not the crew ever comes back - which is precisely why it is a good place to spend money justified by a prediction that might be wrong. **Time horizons stretch, so buy things that are still true in a year.** A patient adversary makes one-off exercises and point-in-time attestations poor value relative to changes in how identity and administration work. This is the argument for structural spend over episodic spend, and the label genuinely supports it. ## What the label does not support, and you must say so **It does not assert novel capability.** Nothing in "advanced persistent threat" or "nation-state" promises an unfixed exploit. State-sponsored intrusions overwhelmingly use stolen credentials, internet-facing appliances left unpatched, and tooling that already exists on the host. So a purchase pitched as the answer to exotic technique is being sold against a claim the label never made. The test to apply out loud: *which specific adversary behaviour does this remove, and does our estate expose that behaviour?* If the pitch cannot answer in those terms, the label is doing the work instead of the product. **It does not establish that you were chosen.** Sponsorship and patience say nothing about how you came to be in scope. You may be there because of what you build, who you supply, or because an appliance of yours answers the internet. Letting "they are targeting us" enter the record unexamined inflates the ask and, worse, damages your credibility later when nothing about the estate supports it. **It does not mean you cannot win.** The fatalism follows from the novelty misread and it is expensive in both directions: it either justifies unlimited spend or it justifies giving up. If the methods are ordinary, ordinary control classes raise the cost materially. ## Holding the line when the ask is bigger than the evidence The hard part of this conversation is not the technical content, it is that the label is persuasive and you are the person reducing it. Three things make that survivable. State the spend against a *named exposure in your estate*, not against the actor class. "We have service accounts with non-expiring passwords and administrative reach across the estate" is a fundable sentence that stands on its own; if the class prediction turns out to be wrong, the money was still well spent. "A nation-state may target us" is not, and if it is wrong you have burnt the budget and the argument. Say explicitly which part of the request the label does not support, before someone else finds it. An executive who is told "this half is justified by the prediction, this half is not, and here is what would justify it" is being given a decision, which is their job. An executive handed only the scary half is being managed, and it usually shows. And give the prediction a way to be wrong. If the class read implies re-entry attempts and a year later there is no sign of them, that should change the next budget round rather than becoming a permanent line item nobody revisits. ## The uncomfortable version of the question Sometimes the honest answer is that the label justifies *no new spend*, because the durable controls it points at are already funded and the remaining gap is elsewhere. Being able to say that is what separates someone who owns a budget from someone who uses whatever label is available to grow one. The label is a prediction. A prediction that cannot come back negative was never doing any work.