A flat cybersecurity budget doesn’t have to mean weaker coverage
vCISO Cheri Hotman advises sorting security spend into four buckets to hold coverage steady under flat or cut budgets.
Cheri Hotman, Managing Partner of Hotman Group, shares advice for security leaders facing flat budgets or 12% cuts in a Help Net Security video. She recommends categorizing each expense as effective protection, unoperationalized value, duplicate tooling, or compliance theater instead of trimming every line equally. She notes waste such as companies running three or four GRC tools, and says framing spending in risk and revenue terms improves finance conversations.
- Sort security expenses into four buckets rather than cutting every line equally
- Companies commonly waste money running three or four overlapping GRC tools
- Cheap choices often cost more later, per Hotman
- Speak in risk and dollars, backed by due diligence, to win finance support
Full article154 words · extracted from helpnetsecurity.com · click to collapse
Cheri Hotman, Managing Partner of Hotman Group, works as a vCISO and vGRC leader. In this Help Net Security video, she talks about holding coverage steady when the CFO asks for a flat budget or a 12% cut.
Her advice is to stop trimming every line by the same percentage. Instead, sort each security expense into four buckets: what works and protects something the business cares about, what could add value but was never operationalized, what duplicates a tool another team already bought, and what exists only for compliance theater.
Hotman says waste is common, with companies running three or four GRC tools that each do part of the job. She also warns that cheap choices often cost more later. Security leaders who speak in risk and dollars, back their estimates with due diligence, and tie spending to revenue get a different conversation with finance.
Download report: How security controls perform in practice
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/17/flat-cybersecurity-budget-video/