Security Investments Are Business Decisions
The next security proposal should not begin with equipment.
It should begin with what the business must keep accomplishing, and the loss it is trying to prevent.
That was the central message of Making the Business Case for Security Through Risk-Based Investment Decisions, presented at GSX 2026 by Daniel R. Young, MBA, MS; Jeff Slotnick, CPP; and Michael Martin.
Security competes for capital, not simply for approval. Executives are not only deciding whether a vulnerability exists or whether a technology is a best practice. They are deciding where to invest limited resources, what exposure the organization is willing to accept, and which option best supports the business.
That requires a different conversation.
From equipment to exposure
A traditional security proposal may begin with a camera, access-control upgrade, security officer, fence, or software platform. These solutions may be appropriate, but on their own they don't make a business case.
A vulnerability is not a business case yet.
To become one, it must be connected to a credible loss scenario and a business consequence:
Vulnerability → Credible scenario → Business consequence → Risk exposure
For example, an aging access-control system is a condition. The business case begins when we explain the potential path from that condition to an unauthorized entry, an interruption of a critical operation, and a measurable impact on people, customers, operations, finances, legal obligations, or reputation.
This framing changes the conversation from “We need to replace this system” to “Here is the exposure the organization carries if this failure pathway is not addressed.”
Security value is not always traditional ROI
Revenue investments are usually evaluated by the gain they may produce. Security investments work differently. Their value often comes from reducing uncertain loss and strengthening resilience.
That does not mean we should avoid financial analysis. When information is available, we can quantify cost, downtime, recovery expenses, property damage, legal exposure, and operational disruption.
However, not every meaningful consequence fits into a single dollar amount.
Life safety, trust, reputation, leadership disruption, and resilience may be material even when they cannot be estimated precisely. A strong recommendation recognizes both the quantifiable and material consequences of a security failure.
The goal is not to manufacture false precision. Risk estimates are decision inputs, not prophecies.
Using ranges, documenting assumptions, and testing whether the recommendation remains sound under different conditions is more credible than presenting an exact number that suggests certainty we do not have.
The CLEAR framework
The presenters introduced a practical framework for turning security analysis into a capital-allocation decision: CLEAR.
C — Clarify the business objective
Start with the operation, not the security solution.
What must the organization continue accomplishing?
The answer may involve protecting employees, maintaining production, meeting customer commitments, preserving access to a critical area, supporting an acquisition, or keeping a facility operational during a disruption.
This step identifies the objective, its dependencies, the risk owner, and the organization’s risk tolerance. It gives security a direct connection to the business outcome that matters.
L — Lay out the loss scenario
A general concern must become a specific event pathway.
A useful scenario describes:
Trigger → Control failure → Event progression → Business consequence
This structure helps decision-makers understand how a security condition could develop into a business loss. It also prevents a recommendation from being driven only by a vague concern or a dramatic possibility.
The scenario does not need to predict the future perfectly. It needs to be credible enough to support a thoughtful decision.
E — Estimate current exposure
Risk creates the decision context:
Risk = Probability × Severity
Probability considers how likely the scenario is to occur. Severity considers the potential impact across life safety, operations, financial performance, legal exposure, and reputation.
The team should evaluate the baseline risk, account for existing controls, and identify the residual exposure if nothing changes.
This is also where assumptions should be visible. A recommendation is stronger when operations, finance, security, and other stakeholders can review and validate the assumptions behind it.
A — Assess treatment alternatives
Not every risk requires the same response. Organizations may accept, avoid, transfer, or reduce risk. Risk reduction may focus on lowering probability, reducing severity, or both.
The important question is not simply, “Which option costs less?”
It is, “How does each option change the risk?”
Alternatives should be compared by:
- Cost
- Time to value
- Effectiveness
- Impact on probability
- Impact on severity
- Residual exposure
- Alignment with current capital constraints
The cheapest option may leave unacceptable residual exposure. The most expensive option may provide diminishing returns. The best investment delivers the strongest risk-adjusted value for the organization’s priorities.
R — Recommend, measure, and revisit
A strong recommendation leads with the decision—not with pages of analysis.
For example:
Approve targeted access-control improvements and revised response procedures. This reduces the most credible interruption pathway while preserving capital flexibility.
The recommendation should explain why the action is needed now, what exposure it addresses, how success will be measured, what residual risk remains, and when to review the assumptions again.
Executives do not need certainty. They need a defensible decision.
Risk reduction is the value
The presentation used a fictional case of a critical facility with aging controls and increasing unauthorized-access attempts. The business objective was clear: maintain continuous operations.
The team did not begin by deciding that a full system replacement was the answer. Instead, it established a credible loss scenario, estimated the current exposure, and compared three alternatives:
- Full system replacement
- More monitoring and response staff
- Targeted technology improvements with revised response procedures
The recommended option was not necessarily the largest or most expensive investment. It addressed the most likely failure pathway, reduced both the probability and duration of interruption, improved resilience, and fit current capital constraints.
That is the value of a risk-based investment decision. It makes clear that the organization is not buying equipment for its own sake. It is reducing an exposure that could prevent the business from achieving an important objective.
Preparing for the executive conversation
A complete recommendation should answer the questions leaders are likely to ask next:
- What decision do you need from me?
- Why now?
- What happens if we wait?
- Which loss scenario are we addressing?
- What assumptions support the recommendation?
- How will we know the investment worked?
- When will we revisit the decision?
When we address these questions in advance, security becomes easier to understand as a business function. The conversation moves beyond technology features and toward the tradeoffs that executives are already managing.
A better role for security
Security does not eliminate risk. No investment can make that promise.
Security can help the organization understand which risks it is accepting, which it is reducing, and what it may be giving up in the process.
This is how security earns a stronger role in strategic decisions. Not by asking leaders to approve a solution because it is a best practice or because something bad could happen, but by showing how a proposed investment protects a business objective and reduces a credible exposure.
The CLEAR framework offers a practical starting point.
Choose one pending security investment. Define the business objective. Lay out the loss scenario. Estimate the current exposure. Compare realistic alternatives. Then write the recommendation before writing the analysis.
The goal is not perfect prediction.
It is a defensible choice.