Why Defending a Company Costs Millions While Attacks Can Succeed for Just Hundreds of Dollars

In the 26th episode of Belyaev Podcast, two experienced CISOs examined a question every security leader eventually faces: how to explain to business stakeholders exactly what they are paying for when investing in information security.

Vyacheslav Kasimov, CISO of Tochka Bank, and Boris Evdokimov, Director of Information Security at the ASNA pharmacy network, highlighted a fundamental imbalance. Attackers can often launch campaigns using relatively inexpensive cloud computing, automation tools, and anonymization services, while organizations must spend millions on layered defenses, continuous monitoring, and incident response capabilities.

The discussion emphasized that security value cannot be measured by the number of security products purchased or the lack of public breach announcements. Instead, it should be evaluated through the lens of critical business processes, potential impact, probability of realization, and the organization’s ability to continue operations after an incident.

Kasimov noted that the absence of known leaks can be misleading. Undetected compromises, unconnected signals, or data already sold on closed channels may exist without the company’s awareness. Evdokimov added that organizations need systematic monitoring of public and underground sources to detect early signs of exposure.

Both experts stressed that mature security programs require clear answers to several practical questions: which assets are most critical, who has access to them, what indicators of compromise can be detected, and how the company will respond in the first hours after confirmation of an incident.

The conversation also addressed the common perception of security as a business obstacle. When security teams only block initiatives without offering safe implementation paths, they risk being bypassed. The recommended approach is to present risk scenarios, compensating controls, their costs, and the remaining residual risk so business leaders can make informed decisions.

Regarding emerging technologies, the speakers discussed the responsible integration of artificial intelligence into security operations. Automation can accelerate initial triage and response, yet models must be tested, access rights limited, actions logged, and irreversible decisions kept under human control. Any AI system granted infrastructure access becomes part of the attack surface and requires ongoing validation.

In closing, the participants agreed that the most damaging consequence of a security incident is often the long-term loss of customer trust, which can result not only from the breach itself but also from inadequate communication or lack of a clear recovery plan.