TH0.13 Building the Leadership Case

The audience determines the argument

Technical stakeholders (CISO, security architects) respond to the detection gap data from TH0.1 and the structural limitation arguments from TH0.4. They understand coverage ratios, ATT&CK mappings, and dwell time.

Business stakeholders (CFO, CTO, CEO, board) do not. They respond to risk in financial terms — what does the gap cost us if exploited, what does closing the gap cost, and what is the return on that investment? TH0.7 provides the numbers. This subsection provides the framing.

The mistake most security practitioners make is presenting the technical case to a business audience. A slide showing ATT&CK coverage heatmaps makes the CISO nod. It makes the CFO check their phone.

Format 1: The 60-second elevator pitch

For informal conversations — hallway, executive lunch, Slack message from leadership asking “what should we be doing about threat hunting?”

“Our detection rules cover about [X]% of the attack techniques relevant to our M365 environment. The other [100-X]% is unmonitored — an attacker using those techniques generates no alert. We’re proposing [N] hours per week of structured hunting to address that gap. Each hunt produces a new detection rule, so the coverage improves permanently. Cost is about $[annual cost] per year in analyst time. Payback is the first time hunting finds a compromise before our rules do — which avoids the cost differential between internal discovery and external notification, typically around a million dollars per incident.”

Three elements: the problem (detection gap, quantified), the solution (structured hunting hours), and the return (self-funding through detection rules, with incident avoidance as the financial case).

Format 2: The 15-minute leadership brief

For scheduled meetings — monthly security review, quarterly business review, annual budget planning.

Slide 1 — The gap (2 minutes). “Our analytics rules cover [X]% of the techniques attackers use against M365 environments. [100-X]% of techniques generate no alert. This is not a staffing problem — it is a structural limitation of how detection rules work. Rules catch what we anticipated. The rest requires someone to look.”

Slide 2 — The risk (3 minutes). “The industry median dwell time is 10 days. Our measured median is [Y] days. In those days, an attacker establishes persistence, maps our environment, and executes their objective. At day 1, remediation costs hours. At day 10, it costs weeks. At day 30+, it involves forensics, legal, regulatory notification, and potentially external incident response.”

Slide 3 — The solution (3 minutes). “[N] hours per week of protected analyst time for structured threat hunting. No new tools needed — we use the same Sentinel workspace and KQL queries. Each hunt follows a documented methodology and produces a new detection rule that runs permanently.”

Slide 4 — The numbers (3 minutes). “Annual cost: $[total] in analyst time. Each hunt produces a detection rule worth [technique coverage] in permanent gap closure. 12 hunts per year moves our coverage from [X]% to approximately [X+12]%. The program pays for itself the first time it discovers a compromise before our rules do — one incident of internal vs external discovery avoidance.”

Slide 5 — The ask (2 minutes). “Approve [N] hours per week of protected hunting time starting [date]. First 90 days: readiness assessment, coverage analysis, and three initial campaigns. We report results quarterly.”

Q&A (2 minutes). Common questions and prepared responses from TH0.9 (hunting myths).

Format 3: The one-page business case

For formal approval — budget requests, program proposals, security strategy documents.

The complete template is in the module summary artifact (TH0.16). This subsection provides the framing principles.

Lead with risk, not technology. The first paragraph is about the business risk of undetected intrusions — not about MITRE ATT&CK or detection coverage ratios. Those are supporting evidence, not the headline.

Quantify everything. Coverage ratio: [X]%. Dwell time baseline: [Y] days. Annual program cost: $[Z]. Expected output: [N] detection rules per year. Break-even: [fraction] of one incident.

Name the alternative. The alternative to hunting is not “nothing changes.” The alternative is “the [100-X]% coverage gap remains unmonitored indefinitely, and intrusions in that gap are discovered through external notification (law enforcement, customer complaint, ransom note) rather than internal detection.” That alternative has a cost — the IBM breach cost differential between internal and external discovery. Name it.

Make the ask specific. Not “we should do threat hunting.” Instead: “[N] hours per week of analyst time, protected from the alert queue, starting [date], with quarterly reporting on coverage improvement, hunts completed, and incidents discovered.”

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

// Generate your specific numbers for the leadership case
// Run all three queries and record the outputs
// Query 1: Your detection coverage ratio
let coveredTechniques = SecurityAlert
| where TimeGenerated > ago(90d)
| where ProviderName == "ASI Scheduled Alerts"
| extend Techniques = tostring(
    parse_json(ExtendedProperties).["Techniques"])
| where isnotempty(Techniques) and Techniques != "[]"
| summarize by Techniques
| count;
// Your numerator: ____ techniques covered
// Your denominator (from ATT&CK Navigator): ____ techniques relevant
// Your ratio: ____%

// Query 2: Your dwell time baseline
SecurityIncident
| where TimeGenerated > ago(180d)
| where Status == "Closed"
| extend EarliestEvidence = todatetime(
    parse_json(tostring(AdditionalData)).firstActivityTimeUtc)
| where isnotempty(EarliestEvidence)
| extend DwellDays = datetime_diff('day', CreatedTime, EarliestEvidence)
| where DwellDays >= 0 and DwellDays < 365
| summarize Median = percentile(DwellDays, 50),
    P90 = percentile(DwellDays, 90),
    Count = count()
// Your median: ____ days | P90: ____ days

// Query 3: Your incident volume (for break-even calculation)
SecurityIncident
| where TimeGenerated > ago(365d)
| summarize TotalIncidents = count(),
    HighSeverity = countif(Severity == "High")
// Annual incidents: ____ | High severity: ____

Figure TH0.13 — Three communication formats matched to audience and context. Each uses the same underlying data (coverage ratio, dwell time, program cost) but frames it differently.

References Used in This Subsection

• IBM Security. “Cost of a Data Breach Report 2023.” — internal vs external discovery cost differential
• Course cross-references: TH0.1 (coverage ratio), TH0.2 (dwell time), TH0.7 (ROI model), TH0.9 (myth responses for Q&A)