Peanut butter budgeting for cyber security -- and why it doesn't work.

The economics of cyber security are completely lopsided. There are a seemingly infinite number of cyber security risks out there, with more and more popping up every day. Hackers appear to have unlimited resources, and cybercriminals are literally reinvesting their lucrative profits into new and innovative ways to exploit, extort, and steal from your organization. But... in order to foil, frustrate, and impede the nefarious schemes of these very well-equipped and well-funded adversaries, we as cyber security professionals are grudgingly allocated a hopelessly limited budget. The meagerness of which we are then asked to stretch ever so thinly across every conceivable threat vector out there in order to assure the business (management, executives, and the board) that, "We’re doing everything possible". If this scenario seems familiar -- and not just because it reminds you of the plot of Mission Impossible -- you’re not alone.