# Executive Objection Response Toolkit

- **PURPOSE:** Prepares security leaders to anticipate and effectively address common objections to security investment proposals.
- **WHEN TO USE:**When preparing to present security investment requests, developing presentation materials, or preparing for challenging questions from executives.

## OBJECTION 1: "NOTHING BAD HAS HAPPENED YET"

**Reframing the Objection**"How can we assess the likelihood and impact of security risks without historical incidents at our organization?"

### Data-Driven Responses:

- Industry Comparison: "While we haven't experienced a major incident, 4 companies in our industry experienced breaches last year, with an average cost of $\_\_\_\_\_\_ per incident."
- Near-Miss Analysis: "Our current controls blocked \_\_\_\_\_\_ serious attempts last quarter. Without these controls, our exposure would be approximately $\_\_\_\_\_\_."
- Evolving Threat Landscape: "Attacks against our industry have increased by \_\_\_\_% in the past year, with techniques specifically designed to bypass the types of controls we currently have in place."
- Business-Focused Alternative: "This investment isn't just about preventing bad things—it enables [specific business initiative] by [specific mechanism], which supports our goal of [strategic objective]."

## OBJECTION 2: "WE'RE ALREADY COMPLIANT"

**Reframing the Objection:** "How does this investment provide value beyond our existing compliance requirements?"

### Data-Driven Responses:

- Compliance Gap Analysis: "Our compliance controls address \_\_\_\_% of our actual risk exposure. This investment addresses the remaining \_\_\_\_% of business-critical risks."
- Benchmark Comparison: "\_\_\_\_% of breached organizations were compliant with regulations at the time of their breach. Compliance represents a minimum baseline, not optimal protection."
- Business Risk Focus: "Compliance frameworks are standardized across all organizations. Our unique business risks include [specific risks], which require additional protections beyond compliance requirements."
- Business-Focused Alternative: "This investment transforms compliance from a cost center into a competitive advantage by [specific mechanism], which will help us [business advantage]."

## OBJECTION 3: "THE COST IS TOO HIGH"

**Reframing the Objection:** "How does the ROI of this security investment compare with our alternatives?"

### Data-Driven Responses:

- Risk Exposure Calculation: "Our current annual loss expectancy for this risk is $. This $ investment reduces that exposure by \_\_\_\_%, providing a \_\_\_\_% ROI."
- Total Cost of Ownership: "While the initial cost is $, the 3-year TCO is actually $ when we account for [efficiency gains/cost reductions]."
- Cost of Delay: "Each month we delay this investment increases our risk exposure by approximately $\_\_\_\_\_\_. The cost of a reactive approach after an incident would be \_\_\_\_× higher."
- Business-Focused Alternative: "We've developed a phased implementation approach that requires only $\_\_\_\_\_\_ initial investment while still addressing our most critical risks."

## OBJECTION 4: "WE HAVE OTHER PRIORITIES RIGHT NOW"

**Reframing the Objection:** "How does this security investment support our current business priorities?"

### Data-Driven Responses:

- Initiative Enablement: "This security capability directly enables [business initiative] by [specific mechanism], accelerating time-to-market by approximately \_\_\_\_\_%."
- Risk to Priorities: "Our current priorities include [business initiative], which has a dependency on [security capability]. Without this investment, that initiative faces a \_\_\_\_% risk of [specific negative outcome]."
- Opportunity Cost: "Deferring this investment will require compensating controls that will cost approximately $\_\_\_\_\_\_ and consume \_\_\_\_\_\_ staff hours that could be applied to priority initiatives."
- Business-Focused Alternative: "We've designed an implementation approach that integrates with the [current priority] project, sharing resources and reducing the overall cost by \_\_\_\_\_\_%."

## IMPLEMENTATION TIPS:

- Customize responses with specific data relevant to your organization
- Practice responses with your team using role-play exercises
- Gather specific examples of how your existing security controls have already provided business value

***

(c)[Kayne McGladrey](https://kaynemcgladrey.com/) - [Get the full book "Cyber Risk is a Myth"](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054)