What Every CFO Should Know About Cybersecurity Spending (Without Becoming a Security Expert)

A cybersecurity budget request arrives on a CFO’s desk looking like every other line item: a number, with a confident explanation behind it. But it isn’t like every other line item, and pretending otherwise is where a lot of finance leaders get stuck. You can’t tie it to revenue. You can’t point to a unit of output it produces. And the person asking for it is describing threats you have no independent way to size. So you either wave it through on faith or push back on instinct, and neither is actually evaluating the spend.

The good news: you don’t need to understand the technology to make a sound call on the money. You need to understand what kind of spend it is, and ask the right questions about it. Here’s the framework.

Why security spend resists normal math

Most budget lines buy you something you can measure: capacity, output, a service with a clear deliverable. Cybersecurity buys you something harder to see: a lower probability of a bad event, and a smaller bill when one happens anyway. It’s closer to insurance than to equipment. You’re not purchasing a result; you’re purchasing reduced risk.

That’s why the usual ROI question, “what do we get for this?”, produces an unsatisfying answer. The return on security spend is mostly the absence of something: the breach that didn’t happen, the outage that was contained, the regulatory penalty you never incurred. When security works, nothing visible occurs, which makes it chronically easy to underfund right up until the moment it’s catastrophically clear you should have spent more.

Once you reframe it as risk management rather than a purchase, it becomes evaluable on terms a CFO already knows well.

What you actually need to understand

Not the tools. Not the threat taxonomy. Six things, all of them financial in nature:

1. What are we protecting, and what would losing it cost? Security spend only makes sense in proportion to what’s at risk. That means putting a rough number on the things a breach or outage would damage: lost revenue while systems are down, the cost of recovery, regulatory exposure, and the harder-to-quantify hit to customer trust. This is the same downtime-cost logic that applies to connectivity reliability; you can’t decide what protection is worth until you’ve priced what a failure would cost.

2. Are we spending in proportion to that risk? With the cost of a bad event in hand, the budget question becomes answerable. Too little spend leaves obvious exposure; gold-plating spends real money defending against risks that don’t apply to you. The goal is proportion, not maximum: enough to meaningfully reduce the risks you actually face, no more.

3. Is the money reducing risk, or buying shelfware? Security has a particular failure mode. Tools get purchased, partially deployed, and never fully used, while everyone assumes they’re protected. A reasonable CFO question is simply whether what you’ve already bought is actually in use and doing its job, before approving the next thing.

4. How many security tools and vendors are we running? Just as telecom spend sprawls across too many providers, security stacks accumulate overlapping tools that are expensive to license, hard to manage, and easy to leave half-configured. Sprawl here costs the same way it does everywhere: duplicated spend, diluted attention, and gaps hiding between tools that don’t talk to each other.

5. What’s the shape of the spend, recurring or one-time? Much of modern security is subscription-based, which means today’s approval is a commitment that recurs. Knowing how much of the request is ongoing versus one-time tells you what you’re really signing up for over the next several years, not just this cycle.

6. What’s the plan when something happens anyway? No amount of spend buys certainty; a mature security posture assumes something will eventually get through and plans to detect, contain, and recover quickly. A budget that’s all prevention and no response is incomplete, and it’s fair to ask where the response plan is funded.

Where AI changes the security math

There’s a newer force pushing on the security budget, and it often arrives without anyone labeling it as a security cost: AI. It shows up on both sides of the ledger.

On the exposure side, every AI tool your organization adopts is a new place your data travels to and a new surface to secure. Sensitive information now flows out to AI services as a matter of routine, often through tools that were approved as productivity software, with no one treating the decision as the security question it actually is. That gap, between how AI tools get adopted and how they get secured, is becoming one of the most common sources of unplanned risk. (It’s also a real cost line in its own right, which the AI infrastructure cost post breaks down.)

On the threat side, attackers are using AI too, which makes certain attacks cheaper, faster, and more convincing than they used to be. Phishing that once looked clumsy now reads as polished and personalized. The practical effect for a budget is that some older assumptions about “good enough” protection are quietly expiring, and the spend required to stay in proportion to the threat is moving.

The CFO takeaway is not to become an AI expert. It’s to make sure AI-related risk is explicitly on the list of things the security budget is sizing, rather than sitting in a blind spot because the AI tools came in through a different door.

Questions a CFO can ask the security team

You can pressure-test a security budget without a single technical term. Try these:

• What specifically are we protecting, and what’s our estimate of what losing it would cost?
• Which risks does this spend reduce, and how do those rank against the ones we’re not addressing?
• Of the security tools we already own, which are fully deployed, and which aren’t?
• How many security vendors are we paying, and is there overlap we could consolidate?
• What AI tools are now handling our data, and have we secured that the way we’d secure any other place our data goes?
• How much of this request is recurring versus one-time?
• If an incident happened tomorrow, what’s our plan to contain and recover, and is it funded?
• What are we deliberately choosing not to protect, and are we comfortable with that call?

That last question is the most revealing. Mature security is a series of deliberate trade-offs, not a quest for total coverage. A team that can tell you clearly what they’re not defending, and why, understands the economics. A team that insists everything is critical hasn’t done the prioritization yet.

About Michelle Burgad

Michelle Burgad helps IT and finance leaders make confident calls on technology spend that resists easy measurement, security among the hardest. In her words: “As a carrier-neutral advisor, my role is to help organizations understand their risks, benchmark available options, and build a solution that fits their operational and financial priorities.” On security, that independence matters twice over: the aim is to right-size protection to your actual risk, AI exposure included, and translate it into terms finance can weigh, with no stake in selling any particular product.

If a security budget is in front of you and you’d like help pressure-testing it in plain financial terms, a strategy review is a good place to work through the risk, the proportion, and the sprawl before you approve the number.

Related reading: how to price the cost of downtime, the same logic that underpins sizing security spend.