A CISO’s guide to trimming waste from a flat security budget

In this Help Net Security video, Ken Leeser, CISO at Y Meadows, explains how security leaders can get more protection out of a flat budget.

He argues a frozen budget gives teams a reason to cut waste and simplify their security stack. The first step is an inventory of every tool and what it costs, including renewals and storage fees. Next, teams should map those tools against attacker techniques using frameworks like MITRE ATT&CK, and ask what each product stops, what it only catches with weekly tuning, and which paid features were never turned on.

Leeser lays out rules for combining tools safely: make sure every capability has a home in the tool you keep, and run old and new tools side by side for 30 to 60 days before cancelling. He covers how to pitch these changes to the CFO and board, and how to put savings toward identity threat protection and other gaps.