With budgets tightening, Chief Information Security Officers (CISOs) face difficult decisions regarding cybersecurity investments and strategy, writes Kevin Gallagher, President, Invicti
Just a few years ago, CISOs were operating with growing mandates and relatively generous budgets. That era is over. Security leaders are now being asked to do more with less, managing expanding digital estates while facing flat or shrinking budgets. In the UK, for example, companies are spending just 9% of their IT budgets on cybersecurity – barely enough to match growing threats and compliance demands (Verdict).
This tightening has been especially painful in high-risk sectors like healthcare and financial services, where regulatory pressure and cyberattacks are both increasing. At the same time, CISOs must juggle rising threat volumes, compliance reporting and security oversight – all with minimal new funding. One recent study even found that 12% of CISOs saw budget declines heading into 2024 (Security Magazine).
The hidden costs of budget constraints
Security leaders are being held accountable for avoiding breaches while making tough decisions on where to allocate limited resources. One contributing factor is the perception that cybersecurity is a cost centre with unclear ROI. Even when new tools are deployed, they can overwhelm teams with noise – generating hundreds of alerts without helping teams act effectively. This erodes trust in security leadership, especially when incidents still occur despite past investments.
Burnout is another symptom. CISOs and security teams report mounting stress, with many attributing past breaches directly to underfunding. The gap between what they are responsible for and what they’re resourced to manage continues to widen (National CIO Review).
Risk surface grows while budgets shrink
Compounding the issue is the expanding attack surface driven by rapid development, modern frameworks, and API proliferation. Faster deployment cycles often prioritise speed over security, leaving behind exploitable vulnerabilities. Add in growing regulatory requirements and increasingly automated attackers and it’s clear that traditional tooling and reactive postures are no longer enough.
Modern software development demands proactive and continuous protection that extends into runtime. Yet many AppSec programmes still over-index on static checks and ignore what’s actually happening in production.
Platform fatigue and tooling trade-offs
With security spending under scrutiny, CISOs must also decide between best-of-breed point tools and broader security platforms. Point tools can offer deep capabilities – like focused API scanning – but come with complexity and integration costs. Platforms offer broader coverage and consolidated reporting but may sacrifice depth in key areas.
Smart CISOs are aligning tool selection with organisational priorities. For runtime risk reduction, dynamic tools like DAST are proving indispensable. When regulatory reporting or executive visibility is more critical, centralised platforms may offer more value.
The key is to avoid over-investing in low-signal tooling. Instead, organisations should emphasise visibility into real-world risk – how an application behaves under attack, not just how it looks in theory.
Shift smart, not just left
The push to ‘shift left’ has driven adoption of SAST and pre-deployment tools, but those tools often struggle with false positives and lack production insight. Meanwhile, runtime environments – where the real threats play out – remain under-protected.
‘Shifting smart’ means investing based on risk impact. While early-stage analysis is valuable, it shouldn’t come at the expense of runtime security. This more nuanced approach helps teams focus resources where they can actually move the risk needle (IBM Insights).
The value of DAST in constrained environments
DAST provides an outside-in perspective by scanning live applications as attackers would. Unlike static tools that often flag theoretical issues, DAST identifies vulnerabilities that are actively exploitable. This focus is particularly valuable when budgets are tight – it delivers real insight and immediate value by validating risks and enabling effective remediation.
With solutions like Invicti, DAST is not just about detection – it’s about actionable proof. Using proof-based scanning, vulnerabilities are verified automatically to minimise false positives and help teams act faster.
DAST can also reveal gaps that static analysis can’t reach, including logic flaws and runtime misconfigurations. When integrated into CI/CD workflows, it supports scalable security across development lifecycles without adding friction.
Platforms that prioritise risk over noise
Instead of layering on more scanning tools, organisations benefit from consolidating around intelligent, risk-focused platforms. For example, Invicti’s unified AppSec platform offers a combination of automated discovery, API security testing and predictive risk scoring – all designed to streamline prioritisation and reduce waste.
As attackers get smarter, tools need to match their sophistication. This includes identifying exploitable flaws, automating validation and giving developers the context they need to fix issues fast.
Strategic clarity for today’s CISO
CISOs must now blend technical fluency with financial acumen. Security cannot afford to be a black box – leaders must articulate where dollars are going and how they translate to reduced exposure. Reports from Splunk emphasise that executive stakeholders are increasingly looking for risk alignment and transparency in security spending (Splunk CISO Report).
By focusing on the highest-value tools and aligning investments with real-world risks, CISOs can make the case for AppSec as a strategic enabler – not just an insurance policy.
