Cheri Hotman, Managing Partner of Hotman Group, works as a vCISO and vGRC leader. In this Help Net Security video, she talks about holding coverage steady when the CFO asks for a flat budget or a 12% cut.
Her advice is to stop trimming every line by the same percentage. Instead, sort each security expense into four buckets: what works and protects something the business cares about, what could add value but was never operationalized, what duplicates a tool another team already bought, and what exists only for compliance theater.
Hotman says waste is common, with companies running three or four GRC tools that each do part of the job. She also warns that cheap choices often cost more later. Security leaders who speak in risk and dollars, back their estimates with due diligence, and tie spending to revenue get a different conversation with finance.
Download report: How security controls perform in practice
