When cybersecurity meets margin pressure, rethinking resilience in lean times
In the world of mass manufacturing, “stable” is rarely the word you’d use to describe a supply chain. At Cabinetworks, America’s largest privately held cabinet maker, our supply ecosystem reflects a vast and shifting landscape—built on a legacy of century-old brands, 20 production sites, cloud workloads, and a web of legacy systems that stubbornly resist retirement. As with our IT estate, complexity is the norm, not the exception.
In the pre-COVID expansion era, security spending rarely faced scrutiny. If a new control generated telemetry, we paid to ingest it. If the team lagged, we expanded headcount. Boards cared about risk, but rarely questioned whether incremental investment brought proportional return.
With interest rates biting into mortgage affordability and home renovations slowing, every dollar must now justify its place. Yet the expectation for cyber resilience remains—just at yesterday’s price. For security leaders, this creates a familiar but sharpened dilemma: How do you protect the business without violating its business model?
New Decision Framework For Lean Times
In constrained environments, the old model of “buy and build” must give way to a new approach—one focused less on aesthetics and dashboards and more on throughput and strategic value. Here’s what that shift looked like at Cabinetworks:
Calculate True Cost Of Investigation
Cyber teams often underestimate the real cost of chasing alerts. It’s not just investigation time—it’s storage, licensing, tooling, and labour. When only a small percentage of alerts are examined, you’re paying to ingest and store data you never use. That’s not just wasted budget; it’s latent risk, hiding in plain sight.
Acknowledge the Real Bottleneck: Human Attention
More sensors don’t always mean better outcomes—they often mean more noise. The constraint isn’t the tech stack; it’s analyst attention. Borrowing from Eliyahu Goldratt’s Theory of Constraints, your system is only as effective as its narrowest point. In the SOC, that’s human focus, not tooling.
Model Throughput, Not Headcount
We don’t view AI as a staff replacement, but rather as a performance multiplier. In our pilot with Prophet Security’s AI-driven SOC assistant, we saw remarkable results: over 3,200 alerts reviewed in 33 days, with only six requiring escalation. Average investigation time fell from 30 minutes to five. Rather than downsizing, we increased the ceiling on what our analysts could handle—enhancing value without increasing cost.
Demand Transparency & Flexibility
Threats evolve daily. Context differs by business unit, geography, and tolerance for risk. Any AI tool we adopt must explain its reasoning, accept feedback, and adapt. When one alert flagged “impossible travel,” the AI pulled together device telemetry, identity history, and behavioural patterns to prove it was a legitimate sign-in. Clear explanations are critical for trust—and trust is critical for adoption.
Reclaim Time, Upgrade Skills
Efficiency gains are more than cost savings—they’re learning opportunities. When analysts are freed from repetitive triage, they can apply creativity and judgement to higher-order problems. One of our junior hires, fresh from college, absorbed months of investigative experience in just weeks by observing AI-driven investigations. It wasn’t just faster; it was smarter.
Align Every Effort With Business Fundamentals
Boards don’t want technical details; they want risk reduced, costs contained, and profits protected. Our SIEM bill alone dropped from high six figures to low five, thanks to AI pulling data directly from source systems instead of expensive storage queries. That’s a line item the CFO can appreciate—and an argument every CISO should be able to make.
AI hasn’t solved everything. Ingest delays, upstream dependencies, and technical debt still demand hands-on work. But it’s changed the shape of that work. Our analysts spend less time stitching together evidence and more time driving down risk.
In today’s climate—where budgets stall and threats escalate—improving analyst throughput isn’t just operational efficiency. It’s fiscal stewardship. The alternative is a false choice between rising risk and unsustainable costs.
For any company serious about staying in business, that’s no choice at all.
