Cybersecurity budgets are often poorly aligned with the actual level of risk to the organisation. Such misalignment can be driven by local challenges measuring and quantifying cyber risk, but it is compounded by the challenge of mapping perceived risk levels to security staff levels, controls, and approaches to risk mitigation. This article suggests a practical framework for leaders on how risk can become the driver of budgeting decisions.

Ransomware is now in healthcare’s “blast radius”, exposing underinvestment and rising risk. Cyber incidents now directly affect patient care - not just IT. The challenge is decision-making. Leaders struggle to quantify risk and prioritise spend. So how can they stay ahead?

When cyber risk is inseparable from physical harm, a line of code is no longer just data; it is the command that opens a dam, shuts down a power grid, or overrides the safety sensors in a chemical plant. How can leaders anticipate the security and budgetary needs of operational technology?