Year-end is a decisive time for organizations in terms of strategic planning and budget. This is the last call to define the priorities that will guide the new year. Before Q4 ends, that direction should already be set. In these discussions, we see a new participant gaining increasing prominence: cybersecurity has played an increasingly prominent role in corporate strategy in recent years.
It is already clear that it has become one of the central paths to the future of business. Executives outside Information Security or IT have already understood that projected results depend intrinsically on cybersecurity planning. The market increasingly recognizes that cybersecurity is a driver not only of survival and continuity of the business, but of innovation and of the growth. And this applies to companies of every industry, size, and business model.
In this sense, executives fundamentally need to apply a systemic, specialized approach in cybersecurity, to consistently connect security across all digital assets with the broader technology landscape and the business's goals and specific needs.
One mechanism that helps address this challenge is the Information Security Master Plan. The Information Security Master Plan serves as a comprehensive initial assessment, setting an effective roadmap for current and future needs.
To be effective, the Information Security Master Plan must:
- Deliver a maturity assessment faithful to the company's actual situation - maturity levels are often overestimated;
- Provide risk analyses that match the reach and countless possibilities of the digital environment, demonstrating the impact of risk on the business - a limited approach often identifies isolated risks without contextualizing them, underestimating their destructive potential and confusing priorities.
How this approach supports cybersecurity budget effectiveness
By understanding maturity and risk comprehensively and consistently, the organization develops a robust information security master plan aligned with business needs. This enables it to optimize digital investments.
“Preparing an IT budget is not - or at least should not be - calculating the budget for buying certain technologies and assuming that this guarantees secure operations for the year. The technology landscape changes profoundly and constantly from year to year. New cyberattack mechanisms and different vulnerabilities emerge, and new technologies are developed. That is why reviewing strategies, direction, and goals is essential,” says Marcus Marques, director of operations at VULTUS.
Thus, the time to plan and budget for the coming year requires executives to give cybersecurity their full attention so foundational actions are designed accurately and aligned with budgeting and the actual needs of risk mitigation.
What changes in the information security master plan under an annual strategy
Global experts have increasingly warned about a paradoxical situation: technological progress serves both corporate protection and increasingly sophisticated cybercrime.
In this sense, it is essential that organizations periodically review cybersecurity priorities. This includes the continuous identification of new risks, which must be included in the information security master plan. Under this approach, initiatives for risk mitigation are reviewed, preventing master plan obsolescence and ensuring effective investment in the right actions.
What happens to the budget when the master plan is revisited?
Risks can change significantly from one period to another. However, this does not mean that the budget allocation for cybersecurity is expected to increase.
This fluctuating behavior is characteristic of the digital environment. To minimize its financial impact, organizations must be properly equipped to optimize cybersecurity investments, to handle this volatility without wasting resources. As the VULTUS specialist points out:
"In general, if a company already has a well-structured Information Security Master Plan, what changes are the priorities and resource allocation, based on an understanding of which processes and actions we should prioritize and which technologies to acquire. It may change completely from what was planned for the current year. The new strategy needs to guide that change based on current risks."
Practical examples
"Risk may have increased considerably, decreased, or simply changed in terms of attack vector. In one of the case studies from VULTUS, the client was a major retailer that previously faced extremely high risk, with attacks recurring every week. We implemented the right strategy over a year of work, and the risk decreased substantially. We were even able to suspend penetration testing because the company's perimeter had been strengthened. What we accelerated in that first year, especially in technology, can slow down. Then we can address what had to take a back seat during that initial period of extreme vulnerability," Marques explains.
In another case study from VULTUS, the path was reversed. The fashion retailer already had a robust Information Security Master Plan and a well-protected system, with vulnerability management properly running for two years. However, new risks emerged in e-commerce, related to credential leaks.
This is one of the most common crimes, especially in Brazil, and it can take several forms in retail, including:
- A criminal group using leaked credentials, in this case, to make purchases on the retailer's website;
- A malicious insider leaking the customer database;
- An attack on another company's database connected to the retailer's system - which is why it is also essential to improve third-party management in the supply chain.
In this case, identity and access management was a crucial step in the information security master plan, alongside other measures. “We implemented the actions needed to mitigate this cyber risk, and attacks decreased significantly”, says the VULTUS specialist.
"Ideally, strategic development of the master plan should take place in the second half of the year, when companies generally begin working on the next year's budget cycle. For it to deliver good results, it is necessary to understand that cybersecurity is not just technology. It also includes processes, people, KPIs, and governance. We build the budget with all of this in mind. There is no point in having a low maturity level and directing funds toward buying tools. That does not solve the problem. That is why we examine all these dimensions of security, which also enables us to help our clients save millions of reais in resources, which would otherwise be spent, for example, on perimeter firewalls and other tools that would not address the actual risks. What sets a cybersecurity strategy apart is this systemic, integrated perspective, which allows investment in the right proportions and in the right places," warns the specialist at VULTUS.
