“We've never been breached”

CFO · Cyber security

A CFO who says "we've never been breached" is weighing a certain cost against an uncertain risk. Arguing about likelihood rarely works. Talk in their numbers instead: what a day of downtime or a lost key customer would cost, set against what it costs to reduce that risk.

What the buyer says

We've never been breached, and security is already our biggest line in the IT budget.

How to handle it

Listen

Hear both halves: the confidence ("never been breached") and the pressure ("our biggest line in the IT budget"). The second half is usually the real objection.

Acknowledge

Respect the track record and the spend. A clean history is worth something, and a finance leader is right to question a budget line that keeps growing.

Explore

Ask how they'd value the downside. What would a day without core systems cost? What would it mean to lose a key customer, or to face the regulator after an incident? You can also ask, gently, how they'd know about a breach: "never breached" sometimes means "never detected".

Respond

Respond in financial terms: the cost of the risk you reduce against the cost of your product and, where you can, what it lets them stop spending. Bring the security leader into the conversation, so the CFO isn't left judging technical claims alone.

Say this
“That's a strong record, and I understand why the budget line gets scrutiny.”

Say this
“What would a day without your core systems cost the business?”

Say this
“Would it help to look at this as the cost of a risk, rather than the cost of a tool?”

Variations

Finance Director: “We spend more on security every year, and I can't see what we get for it.”
COO: “Nothing's gone wrong yet. Why would we change what we're doing?”

Questions people ask

How do you sell security to a CFO who says they've never been breached?

Don't argue about the odds. Respect the track record, then translate the risk into their numbers: the cost of downtime, of losing a key customer, or of a regulatory response. Compare that with the cost of your product and anything it lets them stop spending.

Should you use fear when selling security to finance leaders?

Sparingly, if at all. Finance leaders respond better to a sized, specific risk than to worst-case stories. Ask them to estimate the impact themselves, then work from their figure.