Qualys VP outlines economic model for security decision-making

Ivan Milenkovic, Vice President of Risk Technology for EMEA at Qualys, has outlined a framework for security leaders to build economic models that assign monetary value to security decisions. According to a report by Help Net Security, Milenkovic explains how organizations can move beyond qualitative risk assessments to provide concrete financial data that supports budget requests and prioritization strategies.

The core of this approach involves starting with high-level loss scenarios and working backward to identify the specific assets that drive those potential losses. By connecting technical vulnerabilities to financial outcomes, security teams can rank remediation efforts based on the actual value at risk. This method allows organizations to prioritize fixes that protect the most critical financial interests, rather than addressing vulnerabilities in a vacuum.

Aligning with Financial Leadership

Milenkovic emphasizes the importance of speaking the language of the finance department. He details what Chief Financial Officers expect to see when evaluating security investments, noting that traditional security metrics often fail to resonate with financial leaders. By translating technical risks into economic terms, security professionals can better justify their budgets and demonstrate the return on investment for security controls.

The model also addresses the challenge of proving the value of security measures that prevent incidents from happening. Milenkovic explains how to quantify the worth of avoided incidents, allowing organizations to show the financial impact of their security posture even when no breach occurs. This capability is crucial for maintaining funding and support for security initiatives over time.

Broad Applicability

According to the source material, the economic model described by Milenkovic is designed to be versatile. He suggests that a single model can serve multiple purposes within an organization, providing a consistent framework for risk assessment and decision-making. This unified approach helps streamline the process of evaluating security risks and allocating resources effectively.

The focus on economic modeling reflects a broader trend in cybersecurity where security leaders are increasingly expected to demonstrate business value. By providing clear financial context for security decisions, organizations can make more informed choices about where to invest their limited resources.

What should you do?

Security leaders looking to improve their risk management processes should consider adopting an economic modeling approach. This involves identifying key loss scenarios and mapping them to specific assets to determine value at risk. Organizations should also work to align their security metrics with financial expectations to better communicate risk to executive leadership.

What to do and how to stay safe: Qualys

• Identify high-level loss scenarios relevant to your organization's operations.
• Map these scenarios to specific assets to determine the financial value at risk.
• Rank remediation efforts based on the economic impact of potential losses.
• Develop metrics that translate security outcomes into financial terms for CFOs.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is Ivan Milenkovic and what is his role at Qualys?

Ivan Milenkovic is the Vice President of Risk Technology for EMEA at Qualys.

What is the starting point for building an economic model for security?

The starting point is to identify a few loss scenarios and then work down to the assets that drive them.

How can security leaders demonstrate the value of prevented incidents?

By using an economic model to quantify the worth of incidents that never happened, showing the financial impact of effective security measures.