Successful leaders use the value of time to boost security team results

What is an hour of your time worth?

When asked, most people aren’t precisely sure. Do you know?

I recently explained that to increase value, you need to know what your time is really worth (on LinkedIn). It includes the true story of when I first gained an appreciation for the power of understanding the value of an hour of time. I’ll show you how, too.

Consider how the value of time impacts how you lead your security team.

As the industry realizes that we cannot prevent breaches, our success is determined by how quickly we detect, and how appropriately we respond. Not everything in the organization is equal in terms of importance. Our ability to detect and respond appropriately means understanding and aligning our efforts with business priorities.  

Protecting the right things means directing focus — and investing time — where it matters most.

Why does the value of time matter?

Understanding the value of your time, as well as the team (individual and average), gives you the ability to make better decisions about where and how to place focus.

Power comes from doing the right things (and doing them well), not from doing everything.

To grow your value (and of your team) means measuring where and how your time is spent. By tracking and considering the results, we learn what pays off, and what just wastes time. We gain insight into which tasks are better delegated or outsourced to others (a different team, partners, or the like).

With purposeful action and regular review, we align our priorities with our actions. Or we shift one or both.

Calculate the value of your time (and your team) in a minute or less

You can calculate the value of an hour of your time in just 3 steps and 1 minute or less. Ready?

1. Take your current salary (or whatever you made last year, in gross numbers).
2. Remove the last 3 digits (hopefully zeros)
3. Divide by two

Here’s how it works out for someone making $100,000 (to keep the math easy):

1. Take your current salary: 100,000
2. Remove the last 3 digits: 100
3. Divide by two: 50

If you make $100,000 annually, then the value of your time is $50/hour.

Sometimes, the first time we actually calculate the value of our time is a bit sobering. Keep in mind that we’re measuring the value of our hour, not the value of our person.

What happens when you place a value on your time?

While many of us have a sense of where our time goes, pinning down whether the investment was worthwhile is less common. Most of us operate under constant busy conditions, moving from urgent task to urgent task. We don’t make the time to consider how we’re actually using the limited hours available to us.

Once you determine what an hour of your time is worth, that changes. With a newfound awareness, the time spent on each task is quickly calculated into a financial equivalent.

Was that meeting really worth $100?

A natural initial experience, the desire to assign a dollar value to everything soon fades away. What remains is an understanding of value and the ability to rapidly track and calculate efforts — when it matters. With practice, you learn when it makes sense to step back and evaluate the investment of time.

The benefit of understanding the value of time — for you and your team — is purposefully investing it. Whether ad-hoc or through a more rigorous time audit, over time you shed the low-value (and often urgent) tasks that provide little return. That creates the time and space needed to focus on solving problems, advancing projects, and prioritizing efforts in alignment with business needs.

A real-world security example

I recently facilitated a conversation with Ron Wilson, VP of Customer Success for Damballa for an educational series on shifting to the “assume breach” mindset (disclosure: Damballa is a client).

During the conversation, Ron shared some real-world insight into the challenges teams face when it comes to handling the growing number of alerts generated in an effort to improve detection and response. A team he worked with experienced the following:

• They experience 17 billion events per week
• This generates roughly 6000 “important” alerts each week
• That creates around 250 tickets/week to evaluate
• Each ticket requires around 1 hour of effort from open to close
• The result is about 50 “actual events” — an 80% false positive rate

Just handling the tickets alone takes over 250 hours. This means a team of seven full-time resources working on issues with an 80% false positive rate.

To really bring this in perspective, let’s add in the value of time.

Commonly, we know the labor cost of the security team — an aggregate number considered a sunk cost. Breaking down tasks — or projects — and assigning a dollar value of the time invested provides a useful and clear comparison. It confirms the investment or surfaces areas where we can make adjustments to focus on better value.

If the average cost of an hour for the team in the example above is $50/hour (the average across everyone), that equates to spending $12,500 tracking down alerts each week, or $650,000 over the course of the year. Worse, with a false positive rate of 80%, it means wasting $520,000 each year.

Could that time and effort be put to better use?

Getting started: consider a new scale to measure success

Understanding and using the value of time in decision-making is a powerful way to advance your security team. Assigning a dollar value to discrete efforts adds a familiar dimension to the decision-making process. Most people understand money. It also gives you a way to communicate the value of your team to others without needing to rely on technical jargon and confusing concepts (provided you can explain the high level tasks).

Going forward, the way we pick tools, develop automation, and guide our teams requires a different method of evaluation. More than budget line items for the capital and initial project costs, we have to more actively consider — and assign a real dollar value — to the operating costs. I know teams that do this, but it always feels optimistic.

Capturing and periodically assessing where the time really goes, and the actual experience of different solutions allows for better decisions. Ultimately, implement programs that reduce workload, allowing the team to shift focus to high-value priorities.

Consider using a different scale to evaluate success: the less time it requires — while increasing confidence in the result — the more effective the solution.

Take a moment and figure out what your time is worth. No need to share the value – but reflect on it for a moment and let me know how the knowledge impacts you.

Pay attention to where you invest your time today. And let me know how you did with a comment below or hit me up on twitter (@catalyst) to keep the conversation going.