Cyber's failure of imagination relates to the cost of waiting

Jen Easterly didn't open her CyberCon keynote in Melbourne on 14 October 2026 with a briefing on current threat trends. She opened with a Rubik's Cube. A few minutes later she turned to the 9/11 Commission, whose chairman described the attacks as, above all, "a failure of imagination". That line, she said, still hits her like a lightning bolt.

In cybersecurity, the former Director of the US Cybersecurity and Infrastructure Security Agency told the room, "perhaps the greatest danger is the failure to imagine": the failure to imagine the worst of what is possible.

She had the numbers too. A cyber attack roughly every 40 seconds. An average data breach costing more than $5 million. Cybercrime damages in the trillions, enough, she said, to make cybercrime the world's third-largest economy if it were a country.

They are familiar numbers to anyone who works in security. And that points to the problem I kept running into in conversations around the conference: the people who most need convincing are already convinced.

Between sessions, I spoke with security professionals from Australian universities and government agencies, among representatives from large entities, and almost all of them told me the same thing. Their biggest barrier isn't getting management buy-in. Management acknowledges the risk. It just won't commit to spend money on it. So security teams keep making recommendations they can't deliver, because their organisations won't pay for the tools they need.

When I asked several of them what would change that, the answer wasn't more awareness or a better-designed board paper. It was this: show leadership the opportunity cost of not acting.

After more than 30 years of helping technology organisations make their case, I think they're right. Leaders who accept the risk but won't fund the fix aren't failing to understand it. They are failing to imagine what it will cost them. That makes this, at heart, a communications problem.

Global averages work well in a keynote and poorly in a budget meeting. A finance director looking at a $5 million average can reasonably decide it describes someone else's breach. "Trillions" is too large to belong to anyone. What moves a budget is a number that belongs to the organisation itself.

Waiting has a price

In a video message opening the conference, Minister for Home Affairs and Cyber Security Tony Burke said the advice he once received put the gap between a vulnerability being discovered and being exploited at around two and a half years. Now, he said, it is about 10 hours. Easterly made the same point from the defender's side: when attackers can weaponise a flaw faster than defenders can identify, validate and fix it, "the balance of power starts to shift".

In that world, a recommendation that's still waiting for next year's budget leaves security teams open.

The cost of that delay is well documented in Australia. IBM's Cost of a Data Breach Report 2026 puts the average breach for an Australian organisation at AUD 4.22 million. More telling is what happens over time: Australian breaches that took more than 200 days to identify and contain cost an average of AUD 5.17 million, against AUD 3.26 million for those dealt with faster. That is a difference of almost AUD 2 million, attached to time alone.

The Australian Signals Directorate's Annual Cyber Threat Report 2024–25 tells a similar story. The average self-reported cost of cybercrime to large Australian businesses rose 219% in a year, to $202,700 per report, and the ASD received a cybercrime report every six minutes on average.

None of these figures predicts what any single organisation will lose. But they make one thing clear: inaction isn't free, and its price is rising.

Put a price on "not this year"

So how do security teams turn an acknowledged risk into a funded one? From what I heard in Melbourne, and from what works when we help clients build a business case, four things make the difference.

1. Price the delay, not the threat. For every shelved recommendation, show what it costs to fix now, what it is likely to cost if it is exploited, and how long the exposure stays open while the decision waits.

2. Count the bill that's already being paid. Teams without the right tools compensate with people: hours spent stitching data together by hand, chasing alerts and rechecking findings. That time has a dollar value, and the organisation pays it every week.

3. Keep the cost of waiting in view. A recommendation that is acknowledged once and then filed is easy to forget. A short, regular update showing which recommendations are still open, how long they have been waiting and what that exposure could cost keeps the decision on the table without turning it into a confrontation. At CISA, Easterly worked with CEOs and boards to treat cyber risk as "a fundamental business risk that must be managed as a matter of good governance at the board level". Governance depends on what leaders can see, and plain, regular reporting is how they come to see it.

4. Use the budget holder's language. Present the case as avoided cost, protected services and time saved, in the format finance already uses. Severity scores and vulnerability counts belong in the appendix.

For universities and government agencies, the framing matters even more. Easterly spoke of the critical infrastructure that citizens "rely upon every hour of every day", and these organisations run exactly that kind of service. When it fails, the cost doesn't stay on a balance sheet. It lands on students, patients and the wider community.

The next conversation

Our industry has spent a decade persuading leaders that cyber risk is real. Judging by the conversations I had at CyberCon, that job is largely done. The next one is harder: helping them imagine, in dollars and days, what it costs to wait.

Because the most expensive security recommendation isn't the one that gets rejected. It's the one that gets accepted in principle and never funded.