A security program that cannot describe loss, likelihood, and return on investment in plain business terms will struggle to compete for budget, even when the technical risk is real.