Budget funds either shrinking your enumerable internet footprint or hardening supplier paths — which?

## What the question is really asking It looks like a spending question and it is really a question about whether you know which order of targeting each spend addresses. Two candidate spends: - **Shrink the enumerable footprint** — retire internet-facing services that do not need to be reachable, put the rest behind an access path that does not answer to the world, stop publishing names that need not be published, and hold a fast patch tempo on the few things that must remain exposed. - **Harden supplier paths** — access terms in contracts, scoped and time-bound access for suppliers, second factors on supplier identities, and the right to verify. ## Removal versus redirection The decisive asymmetry is substitution. A crew operating in the selection-after-access order has no substitution available *for you*. Its economics are one capability applied to a whole enumerated population, and its return comes from the population, not from any member of it. If your instance is not enumerable, or not vulnerable when the run happens, you are not ranked low — you are absent. The spend removes the order. A crew that already has your name treats the route as the variable. Close the supplier path and it tries a different supplier, a person, an exposed service, an acquisition you just completed. Hardening raises the price and lengthens the attempt, which is worth money, but it redirects rather than removes. If the only criterion were removal per unit spend, footprint wins outright, and a candidate who says so has the core of the answer. ## The part that makes it a leadership decision **Which order you are actually exposed to is not your choice.** Four positions put an organisation into the name-first order regardless of size or spend: being a provider with access into other estates; holding data that is valuable specifically because of whose it is; occupying a position in a larger organisation's supply chain; and holding a public stance that attracts adversaries with non-financial motives. For an organisation in any of those, footprint spend still removes the first order — worth doing — but it moves the fight rather than ending it, and the second spend cannot be deferred forever. **Who can refuse.** These two spends fail in different places. Footprint reduction is technically cheap and politically expensive: the reachable service you want to retire is somebody's revenue path or somebody's convenience, and the decision is not the security team's to take alone. It needs an executive who will overrule a business owner, and it needs a migration for the users who depended on it. Supplier hardening is politically cheap and contractually slow: nobody objects in principle, but you cannot reopen a hundred contracts at will. At renewal the marginal cost is near zero; off-cycle it is a negotiation you will lose. That asymmetry produces the actual plan and it is why the question is not a coin toss. ## The answer worth giving Fund footprint reduction with the budget, because it is the only spend that removes an order rather than redirecting it, and because the crew it defeats cannot adapt. Secure the executive backing before the money, since the binding constraint is the business owner's refusal and not the engineering. Take supplier terms at natural renewal, where they are nearly free, and sequence the estate by the access each supplier holds rather than by contract size. Then do the thing that distinguishes a lead from a good engineer: say out loud, in the board's own language, that the name-first order is not addressed this year. Naming an accepted residual is a decision the organisation has made and can revisit. Leaving it unnamed lets everyone believe both orders were covered, which is how the next intrusion becomes a surprise as well as a loss. ## Two ways to get this wrong Splitting the budget evenly across both is the reflex, and it buys a partial removal — which is not a removal at all, because an enumerated instance left behind puts you back in the catch — plus a partial redirection. And choosing supplier hardening because a recent intrusion arrived that way is availability, not judgment: the correct input is which orders your position exposes you to, not which one visited most recently.