Cybersecurity Spending: Reuven Aronashvili on Tool Value and Risk
CYE CEO Reuven Aronashvili argues that mapping security assets and measuring risk can help organizations cut waste and direct spending to real gaps.
Security teams can spend heavily and still leave critical gaps. Reuven Aronashvili, CEO of CYE, argues that panic-driven purchases can make that problem worse: a new product may duplicate existing capabilities, be configured incorrectly, or create another route into an organization’s systems. His prescription is to map the security stack and judge each tool by how much it changes the organization’s risk.
Aronashvili has worked with Fortune 1000 organizations for more than a decade. He is a cybersecurity entrepreneur and an expert in industrial control systems and supervisory control and data acquisition security. He also completed a master’s degree in computer science at Tel-Aviv University.
Fear-driven purchases can add exposure
Aronashvili says some vendors use fear, uncertainty and doubt to make a purchase feel urgent. Alarm about rising threats, paired with claims that a product will stop the next major attack, can encourage organizations to buy before they understand what they already own or what problem they need to solve. Teams with little dedicated security expertise may be particularly susceptible.
The result can be wasted budget and staff time, but the downside can extend to security itself. Every tool needs to fit the organization’s systems and operating practices. A product that overlaps with existing capabilities adds cost without necessarily improving protection. One that is poorly integrated or configured can create weaknesses that attackers may exploit.
Aronashvili points to another pressure on security leaders: the CISO role is facing greater scrutiny when an organization experiences a security incident. In his view, that makes it especially important to justify purchases through their expected contribution to security rather than the anxiety surrounding a threat.
A larger tool stack raises the stakes
Cybersecurity products can cost hundreds or thousands of dollars each month. Aronashvili says large organizations average 130 products in their security stacks, with annual spending often reaching seven figures. Adding a tool under pressure can therefore compound an already substantial bill.
Redundancy is one cost. Teams may pay for features they already have, while also spending time managing and maintaining another product. Configuration is another concern: a new system may not work properly with existing assets. Aronashvili cites estimates that network misconfigurations can cost organizations as much as 9% of annual revenue.
There is also a security trade-off. Each product added to a technology environment can expand its attack surface. That does not mean organizations should avoid buying security tools; it means a purchase should be weighed against the additional exposure it brings. Teams need to know what a tool connects to, what it protects, and whether its likely benefit justifies the added complexity.
Aronashvili treats security incidents as an expected possibility and recommends assessing whether a purchase changes their likelihood or potential impact. That assessment requires more than a vendor’s account of what a product can do. It starts with the organization’s own systems, dependencies and weaknesses.
Map the stack before judging its value
For security leaders, the first hurdle is often knowing where to begin. Aronashvili warns against waiting for an attack to reveal that a tool was misconfigured or contributed little. Teams need visibility into the products they already use before they can judge what to keep, replace or add.
Cyber asset management and risk management products can help build that picture. Organizations can also use free, open-source tools for visualization and mapping, or paid network scanners and asset management systems. These options may require additional spending, but they can show how assets and tools relate to one another. That information can also help CISOs explain budget requests to company leaders.
Mapping matters because a list of products alone doesn’t show how an attacker could move through an organization. Teams need to understand connections between tools and assets, then identify routes that could give an attacker access to critical business systems. With that view, they can focus remediation on gaps that expose important assets.
Use likelihood and impact to compare investments
Aronashvili’s proposed calculation is straightforward: Risk = likelihood × impact. Likelihood describes the chance of an attack or other security incident. Asset exposure and the difficulty of carrying out an attack are among the factors teams can consider. Estimating likelihood depends on accurately mapping possible attack routes and understanding which assets an attacker would target.
He illustrates the calculation with an organization that sets its acceptable risk at $10 million and estimates a 20% chance of an incident. Under the example’s assumptions, the potential impact is $2 million. The figures are illustrative, but the method gives teams a way to connect a security decision to a stated risk estimate.
A tool’s value can then be assessed by considering how risk changes without it. For a cloud security product, a company might model or test what happens if the tool is removed from the stack. If the estimated likelihood rises from 20% to 30%, the example’s expected impact increases from $2 million to $3 million. Aronashvili describes the difference—$1 million—as the tool’s value in that calculation.
That estimate can inform a decision about whether the product is worth retaining. If the organization would accept the additional risk, it might remove the tool; if not, keeping it may be justified. In practice, the quality of the result depends on the assumptions behind the estimates and the accuracy of the organization’s asset map. The calculation provides a decision aid, not a substitute for understanding the systems involved.
Make optimization part of budgeting
Aronashvili’s advice for organizations facing financial pressure is to audit their existing stack and check that products work as intended. The review can identify tools that deliver too little value, freeing up funds. It can also uncover gaps that support a request for additional spending in a future budget cycle.
The audit should examine how tools connect to one another and to critical assets. That can help teams spot products with access to sensitive systems, prioritize fixes and direct resources where a weakness could cause the greatest harm. It also gives security leaders a clearer account of why particular products are needed.
Aronashvili expects security spending to keep rising as threats become more sophisticated. He cites Gartner’s projection that end-user spending on security and risk management would total $215 billion in 2024, up 14.3% from 2023. He also suggests that economic uncertainty may push organizations to assess existing tools earlier in the budgeting process.
New technologies, including artificial intelligence and quantum computing, add another consideration for future planning. Security teams will need to judge what tools and staff capabilities are required to address the threats those technologies may pose. Aronashvili’s central point is that this planning works best when purchases follow a clear view of assets, risk and existing protections. A mapped stack gives leaders a firmer basis for deciding where the next dollar can make a difference.
