Which of the following is the MOST critical component for justifying increases in security funding?

Question

Options

• AAlignment with security best practices
• BReduction in residual risk to acceptable levels
• CIntroduction of new industry threat intelligence
• DAdoption rate of latest security controls

• A
  2% (1)
• B
  94% (44)
• D
  4% (2)

Explanation

Reducing residual risk to acceptable levels (B) is the most critical justification for security funding because it directly ties investment to measurable business outcomes - executives and boards approve budgets based on demonstrable risk reduction, not process compliance or tool adoption. Security funding decisions are fundamentally risk management decisions, so showing that spending moves residual risk from unacceptable to acceptable levels provides the clearest cost-benefit case.

Why the distractors fall short:

• A (Best practices alignment): Following best practices is a means, not an end - it doesn't quantify what risk was actually reduced or whether the spend was warranted.
• C (New threat intelligence): Introducing threat intel informs decisions but doesn't by itself justify funding; it's an input to risk assessment, not an outcome.
• D (Adoption rate of latest controls): High adoption of new controls is a vanity metric unless tied to actual risk reduction - spending on tools that don't move the risk needle wastes budget.

Memory tip: Think of the CFO's question: "What did we get for the money?" Only option B answers that directly - residual risk is the bottom line of security investment, just as profit is the bottom line of business investment. When in doubt, ask yourself which answer a risk-conscious executive would find most compelling.

No community discussion yet for this question.