A Flat Cybersecurity Budget Doesn't Have to Mean Weaker Coverage
Help Net Security, Thursday, September 17th, 2026
A vCISO's method for a flat or cut budget: sort every security expense into four buckets instead of trimming across the board.
Cheri Hotman, managing partner of Hotman Group and a vCISO and vGRC leader, addresses what to do when the CFO asks for a flat budget or a 12% cut.
Her core advice is to stop trimming every line by the same percentage. Instead, sort each security expense into four buckets: what works and protects something the business cares about, what could add value but was never operationalized, what duplicates a tool another team already bought, and what exists only for compliance theater.
Waste is common, she says, with companies often running three or four GRC tools that each do part of the job, and cheap choices frequently cost more later. Security leaders who speak in risk and dollars, back estimates with due diligence and tie spending to revenue get a different conversation with finance.