Most security money is spent in reaction. An incident happens, to you or to someone on the news, and a technology is bought so that it never happens again. The instinct is human, and it is where a great deal of risk begins. The industry's own data shows why reactive buying fails, and what organizations that recover well do differently.
Why Another Purchase Does Not Tame It
The average organization already runs 83 security solutions from 29 vendors, according to a 2025 study by the IBM Institute for Business Value and Palo Alto Networks, and 52 percent of executives say this fragmentation limits their ability to deal with threats. The binding constraint is not technology. The 2025 ISC2 Cybersecurity Workforce Study found that 95 percent of security professionals report at least one skills gap on their team, and 59 percent describe their skills needs as critical or significant, up from 44 percent a year earlier.
A technology bought in a hurry, without the skill to run it, becomes shelfware at best. At worst it becomes a system no one fully owns, with its own access, its own alerts and its own weaknesses. The organization has added to its attack surface while believing it reduced it.
Hacking Is a Business
Attackers behave like businesses because they are businesses. Chainalysis's analysis of 2025 found about $820 million in tracked ransomware payments, with nearly 8,000 publicly claimed attacks, up about 50 percent, while the share of victims who paid fell to a record low. The median payment rose sharply, to about $59,500, and 85 active extortion groups were observed, far more than in earlier years.
The lesson for decision-makers is not that the fight is hopeless. It is that attackers respond to cost and return, like any business. They favor the cheapest way in. Raising the cost of that way in, and reducing the return by being able to recover without paying, changes their economics. Outspending them is impossible. Out-thinking them is not.
Blame, or a Lesson
| After an Incident | The Blame Response | The Learning Response |
|---|---|---|
| First question | Whose fault is this? | What did we not see, and why? |
| Typical action | A fast purchase and a personnel change | A review of how the signal was missed and who decided what |
| Effect on reporting | People hide problems in the future | People surface problems earlier |
| A year later | More tools, the same blind spots | Fewer blind spots, and faster decisions |
Organizations that treat cyber risk as part of the ordinary cost of doing business tend to choose the second column. Those that treat every incident as a scandal tend to choose the first, and repeat it.
Not Alone: Allies over Vendors
No organization defends itself alone. The difference that matters is between suppliers that deliver a product and allies that share information and accountability. Industry information-sharing groups, peer networks of security leaders, and partners whose interests are aligned with the outcome rather than the renewal all strengthen a program. The test is simple: when something goes wrong at two in the morning, who is on the call, and do they already understand your business?
People Are the Solution
Businesses run from the top down. People set the processes, and processes choose the tools. When the order is reversed and tools choose the processes, organizations accumulate technology faster than understanding. Most organizations already own much of the technology they need. The weak point is using it well, which is a matter of skill, practice and leadership.
The people responsible for security should be trained continuously and rehearse regularly, because the day they are called on will come. The more they have practiced, the fewer mistakes they make when it does.
Four Questions Before the Next Purchase
- Are we buying this because of a risk we analyzed, or because of an incident we read about?
- Who will own and run it, with what skills?
- What will it tell us that we cannot already see?
- If we did not buy it, what would we do with the time and money instead?
Conclusion
Cybersecurity is a beast, and it is not tamed by a line item. It is tamed by judgment: understanding the business, understanding the attacker's economics, and making decisions deliberately rather than in reaction. Giving leaders the view they need to make those decisions is the purpose of AQUILA C4I.
Sources
- IBM Institute for Business Value and Palo Alto Networks, Capturing the Cybersecurity Dividend, 2025
- Security Info Watch, on the 2025 ISC2 Cybersecurity Workforce Study
- BleepingComputer, on Chainalysis's 2025 ransomware data
- Cointelegraph, on Chainalysis's 2025 ransomware analysis