Balance beats brilliance
A million dollars of detection with no response capability just means watching the breach in high definition. The game punishes lopsided budgets, and so do real incidents.
Know what you are defending. Asset inventory, risk assessment, threat intelligence, knowing where the crown jewels live and who can touch them.
Keep the attackers out. Access control, hardening, patching, awareness training, email security, the everyday controls that stop most attacks before they start.
Spot the one that gets through. Monitoring, SIEM, endpoint detection, alerting, and the people who triage what the tools surface.
Act when it happens. The IR plan, the playbooks, the retainer, the practised team that contains an incident before it becomes a headline.
Get back to business. Backups that restore, continuity plans that work, and the communications that rebuild trust afterwards.
An illustrative mid-market allocation. Protect and Detect usually take the biggest share; Respond is where underspend hurts most on the day.
A million dollars of detection with no response capability just means watching the breach in high definition. The game punishes lopsided budgets, and so do real incidents.
Unspent security budget is not prudence, it is unmanaged risk. Money left on the table counts against you when the incident lands.
Every scenario goes better when a practised team with a plan takes over in the first hour. It is the cheapest function to underfund and the most expensive to have missing.
Skimp on Identify and the other four functions defend the wrong things. Asset inventory is boring until the day it is everything.
Backups that restore and communications that hold trust turn a bad week into a footnote. Zero on Recover turns a footnote into a quarter.
Ransomware leans on Protect and Recover; an insider leans on Identify and Detect. Run the game a few times: the scenario is drawn at random.