Running security programs on the smell of an oily rag

In a world where cyber threats continue to escalate but budgets do not, security leaders are being asked to do more with less, often a lot less. 

Breaches persist, not because adversaries are dramatically more advanced, but because they exploit small and preventable gaps created by limited capacity, competing priorities, and unrealistic expectations of coverage. As security teams pursue maturity through control implementation, alert response, and stakeholder education, they can become trapped in a cycle of overcommitment and under delivery. The challenge is not purely technical. It is an organisational one. Without shared clarity on priorities, outcomes, and trade-offs, security effort risks being spread too thin to meaningfully reduce risk. 

This session focuses on how organisations can work empowered together to align cyber investment with the outcomes that matter most. Rather than attempting to solve every problem, we explore how to define what good-enough security looks like, how to prioritise ruthlessly, and how to make conscious decisions about what not to do. By connecting security activity to business objectives, teams can make defensible choices, communicate constraints clearly, and focus effort where it delivers the highest value. We must learn to work the priority, not just the problem.

Drawing on real-world experience across enterprise, public sector, and MSSP environments, this is a candid exploration of how to run effective cyber security programs with minimal resources. Through practical examples, shared lessons, and honest discussion, we will examine low-cost approaches that build influence, improve basic hygiene, and demonstrate progress without relying on large budgets or complex tooling. 

Attendees can expect practical takeaways, real stories, and an emphasis on collaboration as the foundation for sustainable security outcomes.