Cut Risk Where It Counts: A Smarter Way to Prioritize Cyber Defenses
Thoughts about cyber risk
In today’s threat landscape, executive leaders face a critical challenge: deciding where to invest scarce cybersecurity resources to cut meaningful risk. You can’t protect everything equally. You must systematically prioritize based on likelihood and impact—and do so cost-effectively. Here’s a pragmatic approach to consider.
Focus on What Matters
Cyber risk equals the probability of exploitation multiplied by the impact of a threat hit. Likelihood stems from threat actor capabilities, exposure of vulnerable systems, controls you already have in place, historical incidents, and shifts in attacker tactics. The impact depends on internal factors: the business value of affected assets, the cost of operational disruptions, regulatory exposure, reputational damage, and remediation costs.
You build clarity through two tools: a comprehensive asset inventory and a risk heat map—catalog identities, endpoints, networks, cloud workloads, applications, and data. Then, score each asset on likelihood and impact and plot them on a matrix to visualize the riskiest areas.
Focus and Scale
Once you know where the risk lies, you confront a dilemma: Do you tackle high‑probability, low‑impact threats (e.g., common vulnerabilities and phishing) or low‑probability, high-impact threats (targeted attacks on crown jewel systems)? You can’t ignore either, but your priority should be the threats that occur most often. Eliminating footholds deprives attackers of easy entry points and dramatically reduces downstream risk.
Practically, this means patching aggressively, enforcing phishing-resistant MFA, and deploying broad monitoring—across endpoints, networks, and identity systems. These generic controls stop many attack vectors at a fraction of the cost of asset-by-asset defenses.
Balance Coverage with Cost
Controls fall into two buckets:
Generic controls, such as XDR platforms, NDR, ITDR, MDR, vulnerability management, and endpoint detection, are designed to cover early-stage threats across the enterprise.
Specific controls targeting high-value assets later in the kill chain, like custom protections for financial systems or sensitive databases.
Generic tools spread costs across hundreds or thousands of detection and prevention use cases, making their total cost of ownership (TCO) attractive. By contrast, specialized controls deliver narrow protection at a disproportionately high cost per vector.
Apply External Context to Internal Priorities
An outside-in perspective refines your internal prioritization. You cannot base decisions solely on your infrastructure—you need to know what attackers do, where they’ve succeeded, and what they’re focusing on now. Secureworks data shows that ransomware groups often exploit opportunistic, publicly exposed vulnerabilities. In over half of recent incident responses, organizations lacked basic protections like patched systems and phishing-resistant MFA. Identity misconfigurations remain alarmingly common, and external exposures drive more initial access events than anything else.
Events like these underscore a clear message: focus on the basics first.
A Three‑Step Action Framework for Executives
Start with the most likely threats. Patch high-risk exposures, enforce phishing-resistant MFA, and deploy enterprise-wide visibility and detection.
Invest in broad-reaching defenses. Prioritized XDR, NDR, ITDR, vulnerability management, and managed detection and response. These cover more ground, reduce risk quickly, and require less overhead.
Reassess TCO continuously. Favor tools that give you more detection value per dollar and push specialized tools only where generic ones leave gaps.
This sequence lets you eliminate primary attack avenues first, dramatically lowering the surface for higher-order risk. You clearly understand what you protect, how much you protect it, and whether that aligns with your risk appetite.
The Takeaway for Leaders
Today’s attacks exploit broad vulnerabilities first. By leading with generic controls that block these paths and optimizing for cost, you can collapse risk faster and cheaper than with targeted defenses. In parallel, time and budget permitting, invest in asset-specific protections where they truly matter.
Numerous organizations have used this playbook to significantly reduce their attack surface while keeping security spending in check. Leaders can craft an aggressive and sustainable risk reduction strategy by marrying external threat understanding with internal heat mapping and cost analysis.
Context courtesy of SecureWorks