Building the Business Case

Insider risk programmes are funded on fear or on compliance, and both produce brittle mandates that get cut in the next budget round. There are better arguments.

What does not hold up

Fear. A famous case raised in a board meeting produces a one-off allocation and no ongoing commitment. When the memory fades, so does the budget.

A compliance mandate that does not exist. Few frameworks require DLP by name. Claiming otherwise invites someone to check, and the credibility loss extends to the parts of your case that were true.

Vendor loss statistics. Average cost of a breach figures are produced by parties with an interest, use contested methodology, and are recognised as marketing by anyone who reads them regularly.

Blocking as prevention. Promising to prevent data loss sets an expectation you will fail, publicly, at the first incident.

What does hold up

Breach assessment capability. Most organisations cannot answer, within days, what data was exposed in an incident. Several regulatory regimes require notification within 72 hours of awareness, and the assessment is the hard part.

An inventory plus logging makes that answerable. This is a concrete capability gap with a regulatory deadline attached, and it is the argument that most reliably gets funded.

The departure case. Specific, frequent, and quantifiable in your own organisation. How many people left last year with access to customer data or code? What would it cost if one of them took it to a competitor? This is a real number your business already understands.

Error reduction. Most incidents are mistakes. A pre-send warning prevents them at low cost and no friction. Framed as operational quality rather than security, it attracts different and easier support.

Access reduction. Cheap, effective, and it reduces exposure permanently rather than observing it. Frequently fundable from existing budget.

The costs to include

Business cases fail at renewal because the initial one omitted the operating cost.

Licence, over three years, with growth.

Deployment, including the internal time, which typically exceeds the professional services line.

Operations. At least one full-time equivalent for review, tuning and exception management in a mid-sized organisation. This is the omitted line that ends programmes.

Investigation capacity, retained or internal.

Compliance obligations you are creating. Impact assessment, works council consultation where required, retention management, subject access handling. Real, and never in the original case.

Tuning period. A quarter before it is useful. Say so, or month three will look like failure.

Framing the ask

State what you will and will not achieve. "We will detect bulk movement of customer data through email and cloud sharing, and we will not detect someone photographing a screen." Executives respond well to stated limits, because it makes the rest credible.

Propose a staged commitment. Phase one: inventory and access reduction, low cost, no product. Phase two: monitoring on two channels. Phase three: enforcement, only if the first two work.

This is easier to approve than a platform purchase and it produces evidence for the next stage.

Bring the alternative. Cloud audit log review, access reduction and a departure process cost a fraction and address a substantial share of the risk. Presenting this alongside the platform option demonstrates that you have considered proportionality, which is exactly what a sceptical finance director is checking for.

If the cheaper option is sufficient, say so. Recommending against your own budget request once buys credibility that lasts years.