August 14, 2025
358 words, 2 minutes read time.
In boardrooms across America, members are slowly starting to notice the proliferation of cyber-attacks. It is one thing to recognize the danger, quite another to do something about it.
Board members may ask, how does a company’s risk profile compare to others? What is a reasonable amount of money to budget for cybersecurity? What about company growth & change? Are there tools to use to approximate risk level?
Today, Ben Scudera from Fortreum jumps feet first and answers the tough questions Ben admits that financial estimates are always difficult, he suggests a typical spend of ½ % – 2% of a company’s annual budget for a typical company. If you are in a regulated environment, perhaps one like a hospital or bank, you may need to revise that estimate.
Risk prioritization will have to vary based on the circumstances of each organization. Some start at a weak baseline, others can be quite safe.
Even if you are secure, what happens in the future is your company acquires another? What about drastic growth in sales and plant expansion? How to keep up with new attack vectors?
Ben’s goal is to provide an understanding of the threat without any scare tactics. One approach is to use a guideline from Fortreum’s Cyberfoundation that includes eighteen metrics. This view allows leaders to prioritize remediation efforts.
He highlights the importance of continuous risk management and education to combat evolving threats like ransomware and phishing attacks.
If you enjoyed this interview, than you may want to listen to
Why CMMC Compliance Is Now Non-Negotiable for Tech Leaders
Connects well with Fortreum’s focus on cybersecurity maturity and federal compliance frameworks.
Can Microsoft Help Federal Agencies Transition to Zero Trust?
Reinforces discussions around Zero Trust and the modernization of agency cybersecurity
