Cybersecurity · Cybersecurity · Medium · 25-35 min

How Much Should We Spend on Cybersecurity?

Last updated 2026-07-29

What is this case about?

A retailer's board is split: the CISO wants to double the $25M security budget after a peer's breach made headlines; the CFO wants evidence, not fear. You're asked to frame how much the company should actually invest, where, and how to justify it — without either under-protecting or gold-plating.

Where strong candidates start

  • Frame security spend as risk reduction — likelihood × impact across the main threat scenarios
  • Map the current posture and the biggest gaps relative to the company's risk profile

More cases