Think strategically, be creative and practice good housekeeping for cybsersec budgets, says expert panel

With the right procedures and processes, a robust cyber stance is within reach

Negotiating tight cybersecurity budgets in an increasingly risky world needs a ruthless organisational discipline and creativity, says panel at cybersecurity festival

A panel session dedicated to the topic of cybersecurity budgets provided some excellent insight for the audience at the recent Computing Cybersecurity Festival. All panelists, despite representing very different organisations, agreed that increased geopolitical instability hadn’t really made budget negotiations any easier. In some cases, it made it more difficult.

Trevor Gordon is Chief Digital and Technology Officer at Save the Children. When he took over the role at the beginning of 2024 he inherited a legacy of underinvestment. He chose to take a strategic approach.

“We talked about AI, data and analytics, better ways of engaging and interacting with supporters, and putting cyber as strategic part of that conversation and moving it from being an afterthought to being something we look at with everything we want to do,” he said.

As a non-profit The Meliore Foundation also must prioritise cybersecurity spend strategically. IT Director, Rebecca Reynolds Jones said:

“On a very high level we use NIST to focus on maturity status and risk management and critical services to establish where the best impact of available funds will be spent. We also look at existing investments to make sure they’re providing enough positive return. If not, we see if we can repurpose those funds to use elsewhere.”

Balancing innovation and risk

Nick Ioannou, Information Security Manager at digital lettings platform Goodlord, explained his departmental approach to risk analysis.

“Sometimes a piece of tech might be amazing but sometimes the marketing is way ahead of the reality, but it still might be useful in a specific part of the business. I like to try and pilot as much as possible with a small department and take it from there.”

Reynolds Jones also likes small scale pilots.

“Running pilot exercises works well, particularly if you don’t have a full budget but know that if and when you do secure that money you can hit the ground running.”

The panel had more practical advice for festival delegates.

“We document the protective value of what we’re doing, ensure we’ve recovered costs from anything we don’t think is as effective anymore and then put a risk-based approach to the senior leadership team,” said Reynolds Jones, “It’s about making sure we’ve put a solid business case together because if there is any doubt, the positive argument has fallen down before we’ve even started. It’s about having a compelling pitch in my view.

“The others thing is to play to your culture. People at Meliore work with passion and they take security seriously, more so than I’ve experienced elsewhere.”

Trevor Gorden set out some more details to his approach of presenting cybersecurity as part of a wider strategy of transformation.

“I’m more explicit in focusing on outcomes, highlighting potential threats and scenarios to make a strategic investment case,” he said. “I’m not building out a doomsday scenario, we’re looking at different drivers. For example, we are making reductions in headcount and being bold in terms of automation workflows. But to do that you need investment in cyber, information governance and training. Cyber investment is one plank in a wider transformation strategy.”

Nick Ioannou starts with housekeeping before even thinking about asking for money.

“There’s a lot of overlap with solutions, “he said. “Before we ask for money we see if we can use what we already have more effectively or whether we can replace something. Sometimes there is no overlap, and it justifies a particular route but it’s amazing what licences you sometimes find you have that you aren’t using.”

Ioannou also emphasized the importance of a creative approach to budget.

“I couldn’t get my patch management solution authorized. Somone posted details of a free patch management tool on LinkedIn that was free for 200 devices, and I’ve got 70. There is enterprise tech that is free for 25 people. Sometimes having no budget doesn’t mean you can’t do something, it just means you can’t have the best of breed solution.”

Trevor Gordon emphasised that casting a critical eye over operation, process and control can enhance cybersecurity posture relatively cheaply. As an example, he cited Save the Children shutting down unauthorized AI use.

It’s an approach that, as the other non-profit on the panel, The Meliore Foundation shares.

“As a remote organisation we have a big reliance on BYOD,” Rebecca Reynolds Jones said. “We bring people into the risk assessments and give them ownership of what they’re assessing. We’re about to start the same exercise with AI tools. Bringing people on the journey with you makes them think, and when people are passionate about what they do, it really makes them think twice before doing something they shouldn’t.“