Do these 3 things to get the security budget you want

"I wish I could, but I just don't have the budget for that this year."

As we approach the midpoint of the year, I hear that phrase from clients wishing they could take on a solution from a vendor. I also hear that concern from vendors wishing their clients were able to act sooner.

I feel for both of them.

The good news is that depending on how you set your budget, there are some proven strategies to remap the budget to suit your changing needs and drive success this year. Timing is perfect to take a tactical pause (read more here) to assess priorities and re-align budget as necessary.

Broader than adapting your current allocation, adopting the three steps below allow you to build a better budget for the next cycle. Getting it right means the budget you need with the flexibility to implement it the right way in the coming year.

This approach is equally powerful for enterprise leadership and vendors. In fact, it is the perfect opportunity to work together for mutual benefit.

1. Focus on outcomes; use functional language

Instead of budgeting the solution, emphasize the outcome. Use functional language instead of technical jargon. Tell the story of the challenge and explain why — and how — this outcome alleviates the problem. Explain how it benefits the business. Sometimes additional research is required to connect those dots. Visualization might help (read about using visualization to create value here).

The key is to share what the audience needs to know, not everything you know. It takes time and effort to capture and demonstrate the outcome that benefits the business — and leaves you flexibility to get the right solution in place.

Why this matters: by focusing on the outcome and approach to solve the challenge, is it easier to get the necessary funding. Better, it also allows you to retain flexibility on making specific decisions until the time to act is near. This takes advantage of improvements and changes in the landscape between budgeting and implementation.

2. Map outcomes to investment (yeah, it’s called ROI)

While the concept of return on investment (ROI) stirs a lot of emotion for security folks, the underlying need to map the outcome to the investment – by any means – is essential.

Successful security teams support the business. The investment in security needs to demonstrate a result to the business. This doesn't mean learning to compute a complex ROI analysis. Instead, aim to cogently answer this basic question: what was the result of the money spent?

Why this matters: get over the fear of measuring what matters to track and measure the returns on the investments they make. Over time, this ideally leads to better decisions. More, it establishes your reputation as someone that understands the business and makes smart investments that pay off.

3. Track investment across prevention – detection – response

The way we practice security is changing for the better. As we adjust for our "prevention bias,"  more organizations are allocating budget (and attention) to detection and response.

Track spending across all three areas (these broad buckets are fine) to get a sense of percentage of allocation. Measuring the outcomes relative to investment in these three areas provides a wealth of insights into what is working and where to focus. Over time, you'll discover the blend of prevention, detection, and response that works best for your organization.

Why this matters: this helps build a useful picture of what works to improve security and better enable the business. Studying the returns from different investments in different areas provides a more complete picture of the organization and leads to better decisions in the future.

A quick note on the difference between budget and funding

Some budgets are line items... but most organizations, yours included, has funding. The key is making the case that the available funds are better spent on the effort at hand than something planned, an action already-in-progress (cut your losses), or doing nothing.

Using the three steps above, you might find success making the case this year – and finish strong with the technology or solution you didn't know existed during the last budget cycle. Worst case, you'll build a stronger argument before the next budgeting cycle begins, easing the process and improving your results.

It's time to shift the approach

To support the business, focus on outcomes. Use the three elements of successful storytelling to describe how solutions and actions benefit the business to capture attention and budget.

Measure and demonstrate the results to build the reputation that you are a good, safe investment. And map how and what you're spending to get a sense of where you get the best returns.

Do these things and get the budget you want. Minimally, you'll get the budget you need. It may seem awkward at first. It might take a few iterations to get the details right. Invest the time now to reap the rewards later.

Let me know what items you're struggling to budget for or you wish you knew existed before budget season. Maybe we can explore some of the business cases together in the future.