Today in 30 seconds
Prevention spend (security, compliance, reliability, recovery) loses budget fights because success looks like nothing happened.
Kevin Goldsmith's fix: stop guessing. Four outside prices already value your risk: deal, insurance, compliance and survival.
This week, write the four prices on one page before next year's budget is locked.
The problem every engineering leader inherits
In Paying for Nothing to Happen (Sep 20, 2026), former CTO Kevin Goldsmith tells how a security vendor he had budgeted for got raided two years in a row. When the CFO asked about ROI, he had no answer, and he lost the argument. Later a new board member told him he was underinvesting. The risk hadn't moved. The price had.
If you lead engineering, you own the lines that are easiest to cut and hardest to defend. Without a method, your budget gets set by whoever pushed hardest most recently, or by your last incident.
Four prices someone is already charging you
Deal price: what customers demand before they buy or renew, such as SOC 2, pen test reports, SLAs and questionnaires. Add up the closed-lost deals that cited security.
Insurance price: your cyber premium, its exclusions and its required controls. Read the policy. It is often the most concrete security spec you have.
Compliance price: what regulators and auditors require for you to operate at all. For fine-based regimes, multiply daily fines by the time it would take to become compliant.
Survival price: your worst plausible day. His worked example is $40,000 an hour of peak revenue times 6 hours to restore, which is $240,000 of exposure for one scenario.
The same model tells you when to spend less. If all four prices come back low, a heavy program is the wrong use of money.
Why there's no magic ratio
Goldsmith ran three companies with seven security people, two, and a fractional CISO, and each was right for its context. Headcount benchmarks don't survive contact with real differences in the cost of failure.
My take as an engineering leader
The CFO's ROI question is fair, so answer it in finance's own terms: revenue enabled, premium reduced, operating ability preserved, loss avoided. The second half of the job is making invisible work visible. Report restore tests, game days, blocked attacks and near-misses the way you report feature delivery. Your backups are a theory until you've restored from them. And protect the people behind this work, because their success is invisible and their failures are public.
Try this week
Write the four prices for security, compliance, reliability and recovery on one page.
Find any prevention line that's been raided more than once.
Schedule a real restore test and a 60-minute tabletop exercise.
Ask finance or legal for the cyber insurance policy, and read its required controls.
Source: Kevin Goldsmith, Paying for Nothing to Happen, Sep 20, 2026. Summarized with commentary; read the full piece for his examples.
One more from today's sponsor, which helps keep Tiny Big Spark free:
Keep going, one small spark at a time.
Erwin
PROMO CONTENT
Can email newsletters make money?
As the world becomes increasingly digital, this question will be on the minds of millions of people seeking new income streams in 2026.
The answer is—Absolutely!
That’s it for this episode!
Thank you for taking the time to read today’s email! Your support allows me to send out this newsletter for free every day.
What do you think for today’s episode? Please provide your feedback in the poll below.
How would you rate today's newsletter?
Share the newsletter with your friends and colleagues if you find it valuable.
Disclaimer: The "Tiny Big Spark" newsletter is for informational and educational purposes only, not a substitute for professional advice, including financial, legal, medical, or technical. We strive for accuracy but make no guarantees about the completeness or reliability of the information provided. Any reliance on this information is at your own risk. The views expressed are those of the authors and do not reflect any organization's official position. This newsletter may link to external sites we don't control; we do not endorse their content. We are not liable for any losses or damages from using this information.