In your article, you said: "security professionals should define the probable costs of inaction, in comparison to the costs and benefits of action"

I think communicating the value to their organization – if they actually do even some of the recommendations you are making –to the Board, is one of the hardest things to do. I've found that when you can translate "if you do X, Y and Z it will greatly improve your security posture" to "if you do X, Y and Z, it will cost you $2.25M but save you $3M in OpEx, over the next 2-3 years, with increasing savings in the long term", this results in a very different conversation.

The difficulty is finding supporting data to back up your claims. This data, of course, must be in your back pocket before making your claims because someone will always ask: "How did you arrive at these numbers?" If you have this data ready and from several reliable sources; your recommendations suddenly become more authoritative and will be taken very seriously. Now your recommendations have real business meaning.

To use a real example: I made a series of recommendations to an organization that were projected to cost $1.5M with an ongoing cost of $250k p.a. Independent research showed that a typical cost of an average cyber-breach in their industry was about $5.3M. The recommendations were projected to save them $3M per breach. Of course, no one can predict how many breaches they would suffer, but statistically an organization of their size and visibility suffered a significant breach at least once every 24-30 months. How many smaller breaches occurred cannot be accurately estimated, but they would make OpEx savings there too.

Assuming these costs to be correct and annualizing the costs results in zero saving in the first year, but on average savings of $1.5M per year in OpEx from then on (assuming no increases in costs associated with damage and recovery). If the organization suffered more than one breach every two years or so, the savings would be larger compared to those associated with inaction.

These numbers do not consider the cost, to the organization from a public breach, in terms of lost customer confidence, perhaps lost share value and damaged reputation. Such losses could certainly inflict much larger financial damage to the organization.