Focusing Your Security Budget on High Impact Risks

There’s a costly lesson learned by many management teams that try to prove their security maturity by continuously adding policies, requirements, and technical controls. Yes, the accumulation creates a quantifiable metric for leadership to review. Yes, a higher control count appears to represent a stronger, more robust defence posture on paper. However, the total number of implemented controls actually serves as a remarkably poor measure of actual organisational resilience. Just because there is activity doesn’t mean there’s also risk reduction.

The evolution of international cybersecurity standards clearly reflects the industry shift away from measuring security by volume. When the International Organization for Standardization updated its global information security standard from ISO 27001:2013 to ISO 27001:2022, the framework deliberately reduced the total number of Annex A controls from 114 to 93. The revision consolidated overlapping requirements and reorganised them into four distinct themes because security effectiveness stems from targeted application rather than sheer quantity. A massive checklist of generic controls provides a false sense of security when the specific, highly probable vulnerabilities threatening the organisation remain unaddressed. Generating spreadsheets displaying tick marks against standardised frameworks satisfies point-in-time compliance audits but completely fails to function as a continuous operating model.

Start With the Risk Rather Than the Catalogue

Security programs must begin by identifying the exact disruptions the organisation is actively trying to prevent, reduce, or prepare for. Working backward from a generic control catalogue reliably leads to misallocated resources and operational blind spots.

An organisation might have implemented dozens of sophisticated internal network controls to protect its perimeter. If the initial risk assessment failed to identify the systemic dependency on that external supplier, those internal controls offer zero protection against the actual vector of disruption. Effective defence requires deeply understanding the operational landscape and tailoring defences to the specific threats that could cause significant business or public service interruption. Connecting risks directly to business outcomes ensures that protective measures reflect reality rather than theoretical compliance. Evaluating this reality often starts by establishing your current baseline and understanding where you actually stand regarding mandatory requirements before allocating any budget toward new technical solutions.

The True Meaning of Proportionate Security

Recent regulatory frameworks explicitly demand this risk-based approach. The European Union NIS2 Directive, alongside the corresponding Swedish legislation Cybersäkerhetslagen, mandates that essential and important entities implement appropriate and proportionate technical, operational, and organisational measures. Compliance functions as a continuous operating model rather than a finalised project with a set end date. Proportionate security means applying relevant controls to relevant risks, accompanied by clear ownership and strict accountability.

The European Union Agency for Cybersecurity (ENISA) reinforced this philosophy in its June 2025 technical implementation guidance. The document translates high-level regulatory requirements into operational risk management practices. The guidance emphasises that organisations must map their security measures directly to identified risks. Supply chain vetting, incident response protocols, and basic cyber hygiene must scale appropriately to the actual threat level the entity faces. A regional utility provider does not necessarily require the same complex threat intelligence infrastructure as a multinational bank. That same utility provider absolutely requires uncompromising network segmentation and stringent access controls on its operational technology environments.

Implementing every conceivable control is neither expected nor legally required. Demonstrating that the chosen controls effectively mitigate identified, high-priority risks remains the mandatory standard. Deep assessment of critical dependencies based on operational impact provides far more value than sending generic vendor questionnaires lacking specific technical context.

The Opportunity Cost of Misaligned Defenses

Every security control carries a tangible, ongoing cost. A control consumes financial budget, implementation time, management attention, and routine operational capacity. When an organisation implements a control that does not materially reduce a relevant risk, those resources are actively taken away from something that matters far more. Security leaders operate with finite budgets and constrained technical teams dealing with daily alerts.

Spending six months deploying a complex data masking solution to satisfy a perceived compliance checklist while ignoring unpatched legacy systems creates a severe vulnerability gap. Strategic security investment requires acknowledging this opportunity cost.

Resources spent on the wrong measures cannot be deployed against the most critical threats facing the business. The strict 24-hour early warning incident report obligation under NIS2 demands rapid operational capacity. This crucial response capacity is easily suffocated if teams are burdened managing misaligned, low-value security systems that generate constant false positives.

Structured Control as a Mechanism for Prioritization

Moving from raw control accumulation to genuine risk reduction requires a structured methodology that connects theoretical risks to practical, accountable actions. A mature risk management capability turns audit findings into prioritised risks. It transforms those risks into specific treatment plans and translates progress into verifiable proof. This structured approach ensures that every implemented control traces directly back to the specific vulnerability that produced it.

Assigning clear owners and strict deadlines to these treatment plans prevents security initiatives from stalling in the planning phase. Trend tracking between assessments allows organisations to monitor their maturity over time. This provides board-ready evidence of improvement rather than a static spreadsheet that auditors can easily challenge.

By maintaining a centralised risk register where every action has a designated owner and a clear follow-up mechanism, management can ensure that operational capacity remains focused entirely on the highest-priority vulnerabilities. Security teams can finally connect their daily engineering work to the organisation’s overarching compliance and survival goals.

The Better Management Question

The ultimate goal of any information security program is to protect the organisational ability to function reliably under hostile conditions. Cybersäkerhetslagen places direct personal liability on executives and board members for overseeing these risk management measures, elevating cybersecurity to a core governance duty. Measuring the sheer volume of implemented policies or technical deployments encourages a compliance-driven mindset that routinely fails to address modern threat landscapes.

The board meeting where nobody can answer the basic question about actual preparedness usually starts with a dashboard showing many implemented controls. The most valuable question leadership must ask is which specific risks the organisation has materially reduced this quarter. Shifting the conversation to risk reduction outcomes ensures that the organisation remains resilient, compliant, and thoroughly prepared for the operational challenges ahead.

Building this resilience starts with uncovering the actual gaps in your current security posture. Identifying your specific vulnerabilities allows you to stop accumulating controls and start managing risk. CyberResilient offers ongoing assessments that connect each finding to your controls and risk register, so you have a clear view of your operational readiness.

 

Fredrik Limsäter is CEO of CyberResilient. He has spent his career building software that makes complex work more efficient and modern, first as founder of the global production platform ftrack and now by turning cybersecurity compliance and risk management into work organisations can run continuously.