With rising costs, many organizations are looking for ways to cut corners to keep afloat, including layoffs, fewer raises or promotions, or switching to a less expensive platform. This can lead to some tough calls for a security department, as executives ask if they really need to update their cameras, or software, or perhaps a turnstile that doesn’t work quite right.

When things are going well, security becomes back of mind for organizations. No one ever tries to break into the building, so someone may leave an exterior door unlocked. No one has needed to check security footage, so faulty cameras never get replaced. If there haven’t been any cybersecurity incidents, perhaps the money allocated to cyber defense would be better spent elsewhere.

However, a cut in security funding can have monumental consequences for any organization. This is especially true in the public sector, as government shutdowns and pending grant funding can cause drastic shifts in an organization’s resources. This became especially prevalent as the months-long DHS shutdown caused thousands of Transportation Security Administration (TSA) agents to go without pay. Compounded with rising gas and grocery costs, many agents had no choice but to find other work to feed themselves and their families, leaving airport terminals drastically understaffed.

It’s important for security leaders to have plans in case their budget suddenly shrinks, whether it’s a sudden shift or a dwindling account balance. Alan Saquella, CPP, shares a few recommendations for security leaders looking to properly manage their budgets.

1. Start with Risk, Not Tools

Anchor the budget in your top organizational risks (threats, vulnerabilities, business impact). Prioritize funding based on risk reduction, not technology trends.

2. Speak the Language of Business

Translate security needs into financial impact, operational continuity and brand protection. Frame requests in terms of ROI, cost avoidance and risk mitigation.

3. Align with Organizational Strategy

Ensure your budget supports corporate goals (growth, digital transformation, expansion). Security should be seen as a business enabler, not a cost center.

4. Build a Tiered Investment Model

Must-have (compliance, critical risk mitigation); Should-have (risk reduction, efficiency gains); Nice-to-have (innovation, future capability).

5. Justify with Data and Intelligence

Use internal incident trends, threat intelligence and benchmarking. Incorporate lessons learned from past incidents and near misses.

A strong security budget isn’t about spending more — it’s about spending smarter, aligning protection with business priorities, and clearly demonstrating value in terms leadership understands

6. Invest in People First

Prioritize hiring, training and retention due to an over-reliance on tools. A well-trained team consistently outperforms excess technology.

7. Balance Physical, Cyber, and Insider Risk

Avoid siloed budgeting — integrate across domains. Highlight convergence opportunities for cost efficiency.

8. Plan for Scalability and Flexibility

Build in contingencies for emerging threats and business changes. Avoid rigid, single-year thinking — consider multi-year roadmaps.

9. Leverage Metrics that Matter

Track and present KPIs such as incident reduction, response times, loss prevention, and program maturity improvements.

10. Include a “No Funding” Risk Narrative

Clearly articulate what happens if funding is not approved. This is often more persuasive than the request itself.

11. Look for Cost Offsets and Efficiencies

Consolidate vendors and platforms where possible. Identify automation opportunities to reduce long-term costs.

12. Engage Early and Often with Finance

Build relationships with finance partners before budget season. Pre-wire major requests — no surprises in final submissions.

Closing Thought

A strong security budget isn’t about spending more — it’s about spending smarter, aligning protection with business priorities, and clearly demonstrating value in terms leadership understands.