Most organizations still make a very basic mistake when they think about cybersecurity investments, they link security cost to technology cost.
On the face of it, it sounds logical. But honestly, it’s flawed.
Security is not, and should never be, a fraction of what your technology costs. It has to be aligned to the value of what you are actually protecting.
Let me put this in a simple way.
Assume you own a car, and you need a driver to take you safely to your destination. The road you’re travelling is not easy, it’s risky, dangerous, and full of examples of people who didn’t make it. Everyone knows the risk. It’s not hidden.
So what do you decide first?
The car.
Naturally, you will choose a car that is safe by design. Anything that compromises on safety is ruled out immediately.
Now comes the second question, the driver. Would you hire a more experienced driver for an expensive car, or for a car that is less safe? Most of us will instinctively say: “For the expensive car.”
That’s where we go wrong.
If the car itself has weaknesses, you actually need a far more skilled driver not less. Because now the risk is higher, the margin for error is smaller, and the consequences are much more serious. If you end up valuing the car more than your own life, something is fundamentally off.
Now bring this into cybersecurity.
When organizations choose open-source or technologies where security is not built in but added later, they are effectively choosing a less safe car. That choice automatically increases risk.
But then comes the common assumption: “The technology is free or low cost, so security should also be low cost.”
In reality, it works the other way around. The weaker the built-in security, the more you need to invest to protect it.
Security should never be benchmarked against: → the cost of the software → the licensing model → whether it is open source
Instead, it should always be aligned to: → The value of the data → The criticality of the business process → The impact if something goes wrong
Because when security fails, you don’t lose the software. You lose trust. You lose reputation. You lose business. And sometimes, you lose data that you can never recover. That’s the real cost.
There’s a reason we say, “A stitch in time saves nine.”
If security is treated as an afterthought, the cost of fixing things later is always much higher financially, operationally, and reputationally.
Organizations that understand this that shift from thinking about technology cost to thinking about asset value are the ones that actually become resilient.
So maybe we are asking the wrong question. Instead of asking: “How much does this technology cost?” We should be asking: “What is the cost if this fails?”
Curious to hear your thoughts.
Should security investments be driven by asset value rather than technology cost?
