There is a reason security budget conversations feel different from almost every other investment discussion that happens in a boardroom. Security risk is structurally difficult to express in the terms that investment decisions are built around, and that difficulty has consequences that ripple through every layer of how organizations fund and operate their security programs. But the measurement problem is only half the story. Even organizations that successfully build a quant