Selling the C-suite on preemptive IT investments

What the ROI calculations tend to overlook are the increased costs associated with extending IT networks and systems to more edge locations — and ensuring that security is robust. When these additional costs appear, the original ROI prognosticators get unhappy.

CIOs can prevent this from happening by participating at very early stages in corporate decentralization plans so that the costs of additional IT enhancements can be baked into estimates before ROIs are calculated.

The IT enhancements likely to be needed include zero-trust networks and equipment, additional security and observability software, more bandwidth, and even SASE (secure access service edge).

3. Embrace metrics to emphasize the importance of training

Often the first category to fall on the budget battlefield, training for IT staff and end-users is an important investment — and one that is hard to recognize in terms of tangible results besides expenses. Yet without training, both IT and end-users are ill-equipped to move forward with new technologies that the company needs.

You can’t calculate ROI in customary ways when it comes to training — but you can raise awareness in the company about the risks of not having employees trained to do their jobs.

Important metrics to consider for training investments are employee retention, employee growth, and the costs of bringing in talent instead of growing it yourself internally.

In 2024, LinkedIn surveys show that half of all Americans want to change jobs. The cost of replacing an employee is running a high as six to nine months of that employee’s salary — not to mention the possibility of project delays or the adverse impact on employee morale.

CIOs need to point this out to the board, to the CEO, and to other C-level executives. In other words, how much business risk does your company run if it can’t find (or train) employees into the jobs it needs to be done?

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts