Perspectives on Budgeting for Cybersecurity

The preventive perspective aims to implement measures that stop hackers and other malicious users from being able to exploit a system. One way to do this is by strengthening the internal infrastructure by fixing any known vulnerabilities.

A mitigative perspective recognizes that the best preventive measures are not impregnable. This perspective hopes to use cybersecurity concepts to understand how systems on a network can still function in the case of an attack or a breach.

While preventive and mitigative perspectives provide methods to prevent and react against attacks, it does not address the fundamental question of the suitability of the current spending and the effectiveness of the current strategy employed. There is then another perspective that frames cybersecurity as an operational risk and aims to attach a measurable metric to cybersecurity risks.