Security investment prioritization tool

Purpose

Turn a list of competing security proposals into a ranked, defensible funding plan by scoring each investment on risk-adjusted ROI, cost-of-breach avoidance, implementation complexity, and cost. Solves the executive problem of allocating a finite budget across too many "critical" asks without a consistent, board-defensible basis for saying yes or no.

When to Use

Invoke this skill when the user asks to:

• Prioritize or rank a set of proposed security investments or initiatives
• Decide which security tools, programs, or projects to fund this cycle
• Allocate a fixed cybersecurity budget across competing requests
• Build a business case or board justification for security spend
• Compare security investments on ROI, risk reduction, or cost-of-breach terms
• Build a phased multi-year security investment roadmap

Inputs Required

Before starting, collect:

• Proposed investments: The list of initiatives, tools, or projects under consideration (name + 1-line description each)
• Cost per investment: Estimated one-time and annual cost for each (if unknown, note it and estimate a range)
• Available budget: Total budget for this cycle, and whether it's annual or multi-year
• Threat/risk context: Top risks or threats the organization is most concerned about (e.g., ransomware, insider, cloud misconfig, third-party)
• Business exposure data: Regulated data types, revenue at risk, industry, and any known compliance obligations (PCI, HIPAA, SOC 2, etc.)
• Current control gaps: Known weaknesses or audit/pentest findings, if available
• Risk appetite: Conservative / moderate / aggressive posture, if known

If cost-of-breach inputs are missing, apply industry-standard per-record and per-incident benchmarks (e.g., IBM Cost of a Data Breach averages) and state the assumption explicitly.

Instructions

Step 1: Normalize and Frame the Investment Set

Restate each proposed investment in a consistent format: name, what it protects, the threat it addresses, and the control category (Prevent / Detect / Respond / Recover / Govern per NIST CSF). Flag any duplicates, dependencies, or investments that only deliver value if another is funded first — these change ranking downstream.

Step 2: Score Risk Reduction Potential (0–10)

For each investment, estimate how much it reduces annualized risk. Model this as:

• Annualized Loss Expectancy (ALE) reduction = (Single Loss Expectancy × Annual Rate of Occurrence) before, minus after the control
• Estimate SLE using cost-of-breach benchmarks: direct response cost, regulatory fines, downtime/revenue loss, and customer churn
• Weight by the organization's stated top threats — a control addressing the #1 concern scores higher than one addressing a tail risk
• Score 0–10 where 10 = eliminates or heavily mitigates a top-tier, high-likelihood loss scenario

Step 3: Score Implementation Complexity (0–10, inverted)

Assess how hard the investment is to deploy and operate. Higher complexity = lower score (it drags priority down). Assess:

• Time to value: <90 days (high), 3–9 months (medium), >9 months (low)
• Operational burden: Does it require new headcount, ongoing tuning, or 24/7 monitoring?
• Integration risk: Dependencies on existing stack, identity, or data flows
• Change/adoption risk: Will it disrupt users or business workflows?

Step 4: Score Cost Efficiency (0–10)

Normalize cost across the set. Compute a Risk-Adjusted ROI for each:

• Risk-Adjusted ROI = (Annualized risk reduction in $ × probability-weighting) ÷ (Annualized total cost of ownership)
• Include one-time cost amortized over expected useful life plus recurring cost (licenses, staff, maintenance)
• Score 0–10 where 10 = highest dollars of avoided loss per dollar spent

Step 5: Compute the Composite Priority Score

Combine the three dimensions with a default weighting (adjust and state if risk appetite dictates otherwise):

• Risk Reduction: 50%
• Cost Efficiency (Risk-Adjusted ROI): 30%
• Implementation Complexity: 20%

Composite = (RiskReduction × 0.5) + (CostEfficiency × 0.3) + (Complexity × 0.2)

Rank all investments by composite score, highest first.

Step 6: Apply Budget Allocation and Sequencing

Walk down the ranked list and allocate budget until exhausted:

• Mark each as Fund now / Fund if budget allows / Defer
• Respect dependencies — never fund an investment above its prerequisite
• Flag any "table stakes" controls (compliance-mandated or covering critical unaddressed gaps) as Must-fund regardless of rank, and note the override
• If total requests exceed budget, produce a phased roadmap: Phase 1 (this cycle), Phase 2 (next), Phase 3 (future)

Step 7: Build the Executive Justification

For the top-funded items, write a 2–3 sentence board-ready rationale each, expressed in risk-and-dollar terms (not technical terms): what loss it prevents, the estimated avoided cost, and why it ranks where it does. For deferred items, give a one-line reason so the decision is defensible when challenged.

Output Format

• Structure: Scored prioritization matrix (table) → ranked funding decisions → phased roadmap → executive justification narrative
• Length: 800–1,300 words plus the table
• Format: Lead with a table (Investment | Cost | Risk Reduction | ROI | Complexity | Composite | Decision), followed by structured prose sections
• Sections: Investment Summary → Scoring Matrix → Ranked Prioritization → Budget Allocation & Sequencing → Phased Roadmap (if over budget) → Executive Justification → Key Assumptions
• Tone: CISO-to-board — analytical, decisive, dollar-framed, free of vendor hype and technical jargon

Quality Checklist

Before delivering output, verify:

• [ ] Every proposed investment appears in the scoring matrix with all three dimension scores populated
• [ ] Composite scores are computed with a stated, consistent weighting and the ranking follows the scores
• [ ] Each risk reduction score is tied to a modeled loss scenario or cost-of-breach benchmark — not asserted
• [ ] Budget allocation sums within the stated available budget; any over-budget items are explicitly deferred or phased
• [ ] Dependencies and must-fund compliance overrides are flagged and never violated in the ranking
• [ ] All assumptions (estimated costs, breach benchmarks, weightings) are stated in a Key Assumptions section

Notes

• The single most common error is treating every investment as "critical" — force differentiation by requiring a modeled loss scenario behind each risk score.
• Cost-of-breach modeling is directional, not actuarial; present ranges and disclose benchmarks so the board understands the confidence level.
• If two investments score within ~0.5 of each other, defer to time-to-value — faster risk reduction wins ties.
• When risk appetite is aggressive, raise the ROI weighting; when the organization is under regulatory scrutiny, raise the risk-reduction weighting and expand the must-fund set.

How to use this skill

This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.

Installing in Claude Code:

• ~/.claude/skills/<folder-name>/SKILL.md — auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)
• <your-project>/.claude/skills/<folder-name>/SKILL.md — auto-loads only when working in that project (recommended for project-specific skills)

Restart Claude Code or open a new session to register.

Using in Claude.ai, ChatGPT, Gemini, or other AI tools:

1. Drag this file into a new chat, or copy and paste its contents
2. Send your task or request as your next message — the AI will apply the skill where it fits

For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills