Why Your Security Proposal Died in Thirty Seconds
It’s sitting in a shared drive somewhere right now, gathering digital dust. Fourteen pages of well-researched risk analysis, a defensible budget request, and a routing slip with three approvals already collected. The fourth signature never came, and nobody can tell you exactly why. That’s the part nobody puts in the case study, because the honest answer is embarrassing. The proposal was sound, but the language was wrong, and the meeting was never really a meeting. It was a polite execution.
The fix isn’t a better template, citing some other framework, or a scarier statistic. It’s learning to say the same thing in the language the room actually speaks, which is revenue, liability, and timing. Here’s what that looks like, using the numbers from a prior engagement, plus a repeatable method you can start Monday morning.
The $78,500 Proposal That Died Without a Fight
Precision Components (drawn from a prior engagement; identifying details changed, numbers preserved) is a 42-person precision manufacturer doing $8.5 million a year, with a machine shop floor that smells like coolant and a customer list drifting steadily toward aerospace. Getting there meant passing a supplier security assessment, which arrived as a 47-question document from their largest prospective aerospace customer.
Their managed service provider (MSP) built the right proposal, covering endpoint detection and response (EDR) across every workstation, a modern firewall, network segmentation, immutable backups, 24/7 SOC monitoring, and an annual penetration test. The total came to $78,500, roughly what that package goes for anywhere in the country at that footprint. The owner is a machinist at heart, the kind of person who can eyeball a tolerance on a milled part, so he read the proposal the way he’d read an invoice for work he didn’t order.
What He Heard, Not What It Said
| What the proposal said | What the owner heard |
|---|---|
| Endpoint detection and response across 46 endpoints | Software subscription, forever |
| NGFW with segmented VLANs | Acronyms with a monthly fee attached |
| Immutable, air-gapped backups | Storage, which we already pay for somehow |
| 24/7 SOC monitoring | Somebody watching screens in another country |
| Annual penetration test | Paying people to break in on purpose |
| Remediation retainer | Lawyers with wrenches |
Thirty seconds of silence, then came the sentence that ends more security programs than any breach ever will: let’s circle back on that one. It came back three times over two quarters, each round a little weaker, until word came down that procurement was leaning toward a competitor who had already passed the assessment. $1.4 million in annual revenue was walking out the door over a $78,500 investment. Nobody approved anything. Nobody had to.
The Problem Is the Language, Not the Controls
Every control in that stack was correct, and none of it mattered, because the proposal argued in the wrong language to a man who thinks in terms of finished parts shipped. This isn’t rare. Security professionals train for years to speak precisely in vulnerabilities, patch cadence, and attack surface. Then they hit a wall, because the audience thinks in gross margin. The executive isn’t being stubborn or ignorant; they’re doing their job, which is allocating scarce capital against competing priorities described in dollars and weeks.
The failure isn’t on the executive’s side of the table. It’s on ours. Jargon doesn’t read as expertise to a business owner; it reads as a trust problem. Precision in a language they don’t speak is indistinguishable from evasion. Urgency without a business anchor reads as manufactured. Fear works even worse, in a specific way.
Fear is a rental. You’re renting attention for the duration of the presentation, and it expires the moment you leave the room.
Scared executives approve emergency spending once, maybe twice, and they remember. Every subsequent request starts from a lower trust position, because they eventually notice that the disasters keep not happening at the frequency advertised. Nobody has ever funded a durable program off a borrowed emotion.
Three Ways Proposals Die
In practice, most dead proposals share one or more of these three traits.
- Jargon overload: The CFO won’t learn what a SIEM does, and shouldn’t have to. Yet the proposal leads with it anyway.
- Urgency without a deadline: Everything is urgent, which means nothing is. A timeline tied to a business event wins every time.
- Fear as currency: The room feels the anxiety, but it doesn’t get refunded. That cost shows up on your credit with the next request.
Same Proposal, Different Question
Six weeks after procurement started leaning toward the competitor, the proposal went back across the same desk with the same price and one changed opening line. “This investment qualifies Precision Components for $1.4 million in annual aerospace revenue”. The entire structure flipped from what you should buy to what you stand to gain, with every control tied to a question on that 47-question assessment in language the owner could audit line by line.
Nothing about the technology changed, and neither did the number, but the owner’s question did. It stopped being why and became how fast, which is the only question that matters in a deal that’s still winnable. The reframing method itself comes straight out of my book Cyber Risk is a Myth (CRC Press), because this is the entire thesis in miniature. There’s no such thing as cyber risk. There’s business risk that occasionally involves computers.
Control-to-Assessment Mapping Example
| Control | Assessment Requirement | Business Value |
|---|---|---|
| EDR deployment | Section 3.2: Endpoint visibility | Enables aerospace supplier qualification |
| Network segmentation | Section 4.1: Production isolation | Protects proprietary tooling designs |
| Immutable backups | Section 6.3: Recoverability of production drawings | Ensures contract delivery commitments |
| Penetration test | Section 8: Due diligence validation | Simplifies future customer assessments |
You Can’t Translate What You Haven’t Priced
Here’s the part most advice skips. You can’t reframe a proposal around revenue if you don’t know what that revenue depends on, and most security teams don’t, because nobody hands them that information. That’s why I put almost every new engagement through three documents before we discuss a single control, and they’re free to download.
The Three Documents Cascade
- The Business Process Catalog lists what the organization actually does to make money, who owns each process, the revenue per hour it generates, and how long it can be down before customers notice.
- The Business Systems Inventory connects each process to the technology it runs on, along with vendor contacts and recovery objectives.
- The Component Ledger tracks the piece parts inside each system, hidden dependencies included, because the blast radius of a failed $900 component is not $900.
I wrote a longer walkthrough of how a new CISO uses all three over at TechRound if you want the full version.
The three documents chain together deliberately. When a component fails, you trace it to its system, then to the business process, and finally to a revenue number you can defend in a room where nobody knows what a SIEM is. Once those numbers exist, the Security-Business Alignment Matrix does the sentence-level work of mapping each control to a business objective, and my walkthrough of building the full financial case covers the math in depth.
The Numbers That Close the Deal
Revenue framing wins the room, but it needs a companion figure for the skeptic who asks what happens if the contract falls through. For Precision Components, a two-week ransomware outage modeled out to roughly $650,000 in lost production, recovery, and customer churn. Apply an 8 percent annual probability of a disruptive incident before the investment and 3 percent after, and annualized loss expectancy drops from $52,000 to $19,500. That’s $32,500 a year in risk reduction, and it’s the number that stands when the revenue figure gets challenged.
Put both numbers on the table next to the $78,500 investment, $1.4 million in annual revenue enabled against $32,500 in annual risk reduced. The revenue number wins the room. The risk reduction number defends it. I won’t stretch either figure into a payback period, because the stack price mixes one-time capital with recurring subscriptions, and dressing that up is the same sleight of hand this article exists to kill.
If you want the deeper method for turning scanner output into exactly this kind of business impact statement, Chapter 3 of the book includes the Vulnerability-to-Business Impact Mapping Framework, and there are more than sixty free resources at kaynemcgladrey.com/myth.
Courts Already Speak Business Language
Revenue closes the deal, but liability is causes trouble after the deal’s closed, and the venue where that language gets adjudicated is a courtroom. Judges don’t rule on (or necessarily understand) CVSS scores; when security failures reach a courtroom, the opinions parse contract language, business controls, and duty of care. That’s why I’ve argued that business email compromise belongs to finance rather than to IT, since the Seventh Circuit’s reasoning turned on who authorized a payment, not on which security product was installed. Somebody always prices the risk eventually, in court if nowhere else, and the $23 million MCNA settlement makes the point at scale, though the ransom itself was the cheap part.
Three Processes, Three Owners, Three Conversations, Four Pages
Start with your top three revenue-generating processes, and find the person accountable for each one, ideally someone whose bonus depends on the number. Ask them two questions, namely which systems that process depends on and what a day of downtime costs. Write it up as one page per process, in business language, with a dollar figure at the bottom, then walk that page into your next budget conversation instead of a vendor tiering spreadsheet.
There’s no such thing as cyber risk. There’s business risk that occasionally involves computers, and the language gap is the tax you keep paying for it. The controls were never the expensive option.
