Recognizing the hidden costs of a security program

The costs associated with a security program almost always solely rely on the hefty price tags of security tools and the security headcount needed to support them. What these budgets fail to include is the hidden expenses of operationalizing security. In most cases, hidden costs are at scales greater than those seen on financial sheets — and decision makers must be fully aware of the true impact security has on an organization’s bottom line if they want to succeed.

Never-ending onboarding 

After purchasing a security tool, the next most significant expenditure includes time and resources spent on onboarding and training. Of course, this is no surprise, but it’s worth mentioning since implementation can take anywhere from months to years. Implementing a new security solution requires extensive employee training, often resulting in dramatic changes to workflows and current processes. This onboarding process consumes valuable hours and resources for those outside of the security team, diverting dev and engineer attention away from core business objectives and, therefore, impacting productivity.

The great development drain 

But that’s not the greatest hidden cost. A security program’s most substantial hidden cost is the loss of development hours. Traditional security tools focus on alerting and notifying users of hundreds if not thousands of potential threats daily or weekly, which need to be further reviewed, triaged and remediated, all manually. This conventional approach to security leads to alert fatigue. Not only does this directly impact the security team but also significantly drains development resources, as devs divert their attention from critical projects to address security alerts and vulnerabilities in both developing applications and those under maintenance.

How much does it cost?

Many companies that run mature application security programs share that roughly 10% of their security and development time is spent on manual review and triage, and even after that, they’re barely scratching the surface. While this may not seem significant at first glance, the implications are substantial. Imagine losing 10% of developer productivity due to security tools recently onboarded. 

Financially this means an organization would need to spend an additional 2 million to 3 million dollars to backfill for the time lost, with a relatively small 100-person development team. Yet, these hidden costs are overlooked when reviewing tools.

The greatest threat to any business

Aside from the more quantified costs impacting financial performance, unseen security costs also include an organization’s ability to compete and innovate. As development resources divert toward addressing security alerts and vulnerabilities, less time and capacity are available for innovation and, thus, the pursuit of strategic initiatives. This ultimately hinders an organization’s agility and competitive edge in a rapidly evolving market — the greatest threat to any business.

The vicious cycle 

A truth often unspoken by security vendors and practitioners is the paradox of advancing in a DevSecOps program. As a program matures and security leaders integrate more automated security scanning tools into the pipeline, the Shift Left is achieved and the unintended consequence emerges. Security and development teams are more frequently penalized because these tools uncover more issues. At this juncture, security leaders will likely be advised to implement security gates to prevent any vulnerabilities from reaching production, now that they’re aware of them. While this step might seem prudent, it inadvertently impacts a business’s primary goal: maintaining a competitive edge. Implementing these security measures, though necessary for safety, can slow down operations, affecting an organization’s ability to compete in the market.

Building a more secure future 

Rather than solely focusing on the upfront price tag of security tools, decision makers must consider the broader implications on resources, productivity and innovation. The key focus here should be understanding how equipped tools impact an organization’s teams. Do these tools create more work or less? Do they consume dev hours, and if so, how many? Understanding these numbers can help security leaders make a case for reimaging an organization’s security tooling.

But it is not all doom and gloom. Similar to how code assistance tools increase developers’ productivity in writing new code, there are new tools that help improve productivity in fixing security vulnerabilities. Creating strategies for a secure future entails prioritizing solutions that address immediate security concerns and minimize the hidden costs associated with implementation and maintenance. Adopting tools that fix versus find is essential for staying competitive in the digital age.