Organisations often treat security as a tradeable control because its benefits can feel indirect, while safety is understood as a non-negotiable protection against harm. The article argues that this difference is partly linguistic and partly cultural. Recasting cybersecurity practices as safety can make their purpose clearer, especially when teams need to defend spending and avoid risky shortcuts under recession pressure.
Why Security Gets Treated as Discretionary Spend
During a downturn, leaders often classify security as a control that can be deferred because its payoff is easier to postpone than to see. Safety is usually tied to immediate harm, legal duty, and visible operational failure, so it is harder to reframe as optional. Security work also competes with revenue and continuity projects, which makes its value more vulnerable to budget pressure.
That distinction is reinforced by how organisations measure success. If security is only discussed as a cost centre, teams will struggle to defend controls that prevent incidents rather than create visible output. Reframing the problem as protecting a high-risk identity and secret estate helps make the business consequence more concrete, especially where exposed credentials and overprivileged access can turn a small cut into a large blast-radius problem. The same logic shows up in API security, where broken authorisation or weak access controls create immediate loss paths rather than abstract technical debt.
In practice, the issue is not that security matters less than safety, it is that its harms are easier to postpone in finance discussions until the organisation has already absorbed the risk.
Why the Language Gap Matters in Recessions
The article’s core point is linguistic as much as financial. “Safety” implies a shared duty to prevent injury, while “security” can sound negotiable, technical, or purely defensive. That framing matters when a downturn forces hard trade-offs, because words shape whether leaders see a control as essential protection or as an efficiency cost.
When teams describe cybersecurity in abstract terms, they often weaken their own case. When they describe it as preventing unsafe conditions, they connect the control to the same kind of non-negotiable judgement that leaders already apply to physical safety, operational resilience, and regulatory exposure. That is especially true for controls such as credential rotation, access review, and privilege limitation, where delayed action increases exposure over time. The operational reality is well captured in OWASP Non-Human Identities Top 10, which highlights secret sprawl, overprivilege, and rotation failures as recurring sources of avoidable risk.
A useful test is whether the team can explain the control in terms a business owner would use for safety work: what could be harmed, how quickly harm would spread, and what the fallback looks like if the control is removed. If that explanation is hard, the budget discussion will usually be harder.
Keeping Security Spend from Being Cut to the Bone
Practitioners should separate controls that are truly deferrable from those that would create unsafe operating conditions if removed. The most defensible spending is usually the work that preserves containment, revocation, monitoring, and recovery when headcount is reduced or systems are consolidated. In downturns, the hidden failure mode is not only lower investment, it is delayed remediation, longer-lived access, and weaker oversight of shared services and vendors.
What to verify: Identify which security controls protect the organisation from rapid blast-radius expansion if access is abused, credentials leak, or a third party is compromised. Those are the controls most likely to behave like safety measures, not discretionary overhead.
What to prioritise: Keep the controls that prevent irreversible or hard-to-detect loss first, then defer lower-impact optimisation work. If a cut would leave tokens, keys, or privileged access in circulation longer than intended, the cut is usually false economy.
Practitioner takeaway: The strongest budget argument is not that security is “important”, it is that some security controls function as organisational safety rails and should be protected before the downturn forces the business to learn their value through incident response.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 6 — Access Control Management | Controls access and privilege paths that become harder to defend when budgets are cut. |
| Recommendation — Apply CIS Control 6 to keep privileged access tightly bounded and promptly revoked. | ||
| NIST CSF 2.0 | PR.AC — Access Control | Directly addresses limiting access and privilege as a core protective function. |
| PR.PS — Platform Security | Supports maintaining protective controls that keep systems safely operating during cost reduction. | |
| Recommendation — Use PR.AC to preserve least-privilege protections even when spend is under pressure. Use PR.PS to retain baseline protective safeguards that reduce unsafe operating conditions. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Secret sprawl and weak rotation make security cuts materially increase exposure. |
| NHI-03 — Privilege and Access Governance | Overprivileged non-human access turns deferred security work into larger blast-radius risk. | |
| Recommendation — Tighten secrets handling so budget cuts do not extend credential lifetime or exposure. Restrict non-human privileges to keep privilege creep from multiplying incident impact. | ||
| NIST SP 800-63 | AAL — Authenticator Assurance Levels | Stronger authentication raises the cost of compromise when organisations are tempted to weaken controls. |
| Recommendation — Adopt appropriate assurance levels for critical access paths before reducing other safeguards. | ||
Related resources from NHI Mgmt Group
- Should organisations include personal cyber safety in security awareness programmes?
- Why do AI agents become riskier when safety guardrails are disabled during security testing?
- How do organisations decide which baseline security measures to prioritise first?
- How should organisations decide when security review should be triggered during the SDLC?
