The factors that can impact security organization spending and sizing are extensive, but here are a few: • The value of assets, especially the assets most important to the organization • The type and frequency of risks and threats • The current state of the organization’s security posture • Regulatory requirements

Only by understanding its specific threat landscape can an organization reduce risk. Controls are implemented according to the most significant threats. Threat analysis begins with the question, Which threat actors are trying to harm the organization and what are they capable of? In response, organizations can visualize the vulnerabilities commonly