--- title: Diminishing Returns in Cybersecurity description: Just spending money on cyber security may not reduce your risk. Here's why and what to do instead. image: https://www.truvantis.com/hubfs/Diminishing%20Returns%20in%20Cybersecurity-1.jpg --- [![truvantis-logo-reverse@2x](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-reverse@2x.png?width=1117&height=250&name=truvantis-logo-reverse@2x.png "truvantis-logo-reverse@2x")](https://www.truvantis.com) [![truvantis-logo-main@2x-1](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-main@2x-1.png?width=1117&height=250&name=truvantis-logo-main@2x-1.png "truvantis-logo-main@2x-1")](https://www.truvantis.com/) ** ## Blog ![](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-main@2x-1.png?length=200) # Diminishing Returns in Cybersecurity May 19, 2020 If you have ever taken a course in economics, then you should know a thing or two about the [law of diminishing returns](https://www.britannica.com/topic/diminishing-returns). It may very well be the subject’s most famous and immediately recognizable principle. Here is the gist of it; there is a point at which the cost of continuing to add inputs into production stops being worth the value of the outputs produced. In the context of software development, this principle is known as [Brooks’ Law](https://www.techopedia.com/definition/18085/brooks-law): a theory that states, “adding manpower to a late software project makes it later.” So, the concept of diminishing returns is applicable in both economics and software development, but does it mean anything in the world of cybersecurity? Of course, it does! At its core, cybersecurity is about efficiency, vigilance, and cunning much more than it is about piling on investment after investment in infrastructure. Case in point: Target. In 2013, Target was the victim of one of the most devastating corporate hacks of the 21st Century. Hackers were able to steal the data from as many as 40 million credit and debit card numbers from shoppers who had visited company locations during that holiday season. Last year, [Target finally settled claims by 47 states and the District of Columbia for a total of $18.5 million](https://www.nbcnews.com/business/business-news/target-settles-2013-hacked-customer-data-breach-18-5-million-n764031), and the full scope of the breach itself cost an estimated $202 million. But it was not as if Target had not made considerable investments in their cybersecurity framework. They had a robust security staff, were PCI DSS validated, and six months before the attack, the company had begun installing a [$1.6 million malware detection tool.](https://www.cnet.com/news/how-target-detected-hack-but-failed-to-act-bloomberg/) They had all the right pieces, but insufficient employee training and a lack of awareness of proper procedure were enough to allow the one of the biggest breaches in recent memory. In the weeks before the breach, Target's $1.6 million malware detection tool picked up two network intrusions, [but their security team did not heed those warnings](https://www.bloomberg.com/news/articles/2014-03-13/target-missed-warnings-in-epic-hack-of-credit-card-data). On December 12th of that year, Federal law enforcement alerted Target that it had found evidence of an intrusion, but Target’s security staff still did not act to secure its network until three days later. By then, their data was already compromised. This cautionary tale goes to show that excessive input into an expensive system will not be worth its output if it is not bolstered by comprehensive employee training, proper cyber hygiene, and [constant vigilance from both inside the company and by trained third parties.](https://www.truvantis.com/security-program/) If you want your security program to dodge diminishing returns, take the time to learn how to invest wisely and efficiently. You should also always make sure that your employees are up to speed on how to handle cybersecurity problems as they arise. One solid way to do that is a security Risk Assessment. This looks at your specific situation - assets, threat landscape, risk tolerance and develops a risk treatment plan to address the most important risks in a way that suits your budget. But do it right, so you don't get all the spend without the ROI. #### Related Articles By Topic [Security Program](https://www.truvantis.com/blog/tag/security-program) [Risk Assessment](https://www.truvantis.com/blog/tag/risk-assessment) ### Subscribe Here! ### Recent Posts ### Related Articles By Topic - [Security Program (76)](https://www.truvantis.com/blog/tag/security-program) - [vCISO (38)](https://www.truvantis.com/blog/tag/vciso) - [CISO (35)](https://www.truvantis.com/blog/tag/ciso) - [PCI DSS (28)](https://www.truvantis.com/blog/tag/pci-dss) - [SOC2 (28)](https://www.truvantis.com/blog/tag/soc2) - [Penetration Testing (27)](https://www.truvantis.com/blog/tag/penetration-testing) - [Privacy (26)](https://www.truvantis.com/blog/tag/privacy) - [Risk Assessment (19)](https://www.truvantis.com/blog/tag/risk-assessment) - [CIS Controls (12)](https://www.truvantis.com/blog/tag/cis-controls) - [Red Teaming (8)](https://www.truvantis.com/blog/tag/red-teaming) - [HIPAA (7)](https://www.truvantis.com/blog/tag/hipaa) - [Threat Intelligence (7)](https://www.truvantis.com/blog/tag/threat-intelligence) - [ISO27001 (6)](https://www.truvantis.com/blog/tag/iso27001) - [CCPA (5)](https://www.truvantis.com/blog/tag/ccpa) - [CPRA (2)](https://www.truvantis.com/blog/tag/cpra) - [GDPR (2)](https://www.truvantis.com/blog/tag/gdpr) - [Ransomware (2)](https://www.truvantis.com/blog/tag/ransomware) - [Red Team (2)](https://www.truvantis.com/blog/tag/red-team) - [HITRUST (1)](https://www.truvantis.com/blog/tag/hitrust) [See all](https://www.truvantis.com/blog/diminishing-returns-and-how-to-avoid-them#) Contact Us Let's chat about how to use a Risk Assessment to target your resources at the largest risks. [![Schedule a call](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4366475/1957d0c0-9fb7-490a-a8f3-d95b9085a3c6.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4366475/1957d0c0-9fb7-490a-a8f3-d95b9085a3c6) [![Contact Us](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4366475/ccf084a3-d095-4418-80d6-891f8fdade46.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4366475/ccf084a3-d095-4418-80d6-891f8fdade46) ### Recent Articles ![Truvantis - Cybersecurity Maturity - One Size Does Not Fit All ](https://www.truvantis.com/hubfs/Blogs/Cybersecurity%20Maturity%20-%20One%20Size%20Does%20Not%20Fit%20All.png) PCI DSS, CIS Controls, Security Program, Privacy, ISO27001 [ Cybersecurity Maturity - One Size Does Not Fit All – Rick Folkerts ](https://www.truvantis.com/blog/cybersecurity-maturity-one-size-does-not-fit-all-rick-folkert) It's common knowledge that enterprise organizations need effective security, privacy and compliance programs to survive and grow. There are a handful of generic best practices but beyond that, cybersecurity programs must be tailored to... [Read more **](https://www.truvantis.com/blog/cybersecurity-maturity-one-size-does-not-fit-all-rick-folkert) ![The Silver Bullet Defense to Ransomware – by Andy Cottrell](https://www.truvantis.com/hubfs/Blogs/The%20Silver%20Bullet%20Defense%20to%20Ransomware%20%E2%80%93%20by%20Andy%20Cottrell.png) Ransomware [ The Silver Bullet Defense to Ransomware – by Andy Cottrell ](https://www.truvantis.com/blog/the-silver-bullet-defense-to-ransomware-by-andy-cottrell) In an era of cost-cutting, downsizing and generally insufficient budgets for everything, we are often asked, what is the one, main thing to do to protect against a ransomware attack? According to Statista, in 2022, there were 493.33 mi... [Read more **](https://www.truvantis.com/blog/the-silver-bullet-defense-to-ransomware-by-andy-cottrell) ![Cryptographic Agility – by Jeff Hall (the ’PCI Guru’)](https://www.truvantis.com/hubfs/Blogs/Cryptographic%20Agility%20%E2%80%93%20by%20Jeff%20Hall%20(the%20%E2%80%99PCI%20Guru%E2%80%99).png) Security Program [ Cryptographic Agility – by Jeff Hall (the ’PCI Guru’) ](https://www.truvantis.com/blog/cryptographic-agility) With the advent of quantum computing, a new threat has been added to the information security mix. The threat is today’s secure cryptography may not be secure once quantum computers reach their potential. The threat to cryptography has... [Read more **](https://www.truvantis.com/blog/cryptographic-agility) [![truvantis-logo-white@2x-1](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-white@2x-1.png?width=1117&height=250&name=truvantis-logo-white@2x-1.png "truvantis-logo-white@2x-1")](https://www.truvantis.com/) [info@truvantis.com](mailto:info@truvantis.com) +1 (415) 422-9844 © 2024 Truvantis, Inc All Rights Reserved. [Privacy Policy](https://www.truvantis.com/privacy-policy)    [Terms of Service ](https://www.truvantis.com/terms-of-service) ![](https://px.ads.linkedin.com/collect/?pid=2614233&fmt=gif) ![](https://ws.zoominfo.com/pixel/dnjpprEKcMtv41HRInFR)