Skip to content

Investment Portfolio Framework

The Scaling Challenge

Picture this scenario: Your development teams want faster security reviews. Customer success needs immediate responses to security questionnaires. Compliance requires detailed audit preparations. Meanwhile, a critical vulnerability just dropped, and your CEO is asking about your incident response plan.

Sound familiar? You've hit the scaling crisis, the inevitable moment when demand for security services grows exponentially while your team capacity grows linearly.

The Inflection Point

Most security leaders respond to scaling challenges by hiring more people and working longer hours. While this provides temporary relief, it becomes increasingly difficult to sustain long-term and doesn't address the fundamental capability gap.

A Different Approach

Past a certain point, the solution is deliberately constraining some activities while investing in capabilities that reduce future manual effort rather than simply doing more security work. This section shows you how to make this strategic shift while maintaining security outcomes.

The BAU Scaling Crisis

The Capability Gap Reality

The BAU scaling crisis is a capability mismatch rather than a resource problem. When adversaries automate attacks at internet scale while defenders remain manual, no amount of hiring closes the gap.

The Structural Mismatch:

  • Manual defender processes: Quarterly vulnerability scans, manual asset discovery, individual security reviews
  • Scaled adversary automation: Continuous probing, automated reconnaissance, industrial-scale exploitation

This structural mismatch, manual defender processes versus scaled adversary automation, makes the crisis inevitable.

Demand Outpaces Capacity

As software factories grow, traditional security activities face a mathematical scaling challenge:

  • Security reviews increase with feature velocity
  • Threat modeling requests scale with system complexity
  • Customer security inquiries grow with customer base expansion
  • Incident response requirements increase with system surface area
  • Compliance activities expand with regulatory scope

Meanwhile, security team capacity grows linearly at best. Hiring requires time and creates temporary productivity reduction during onboarding. Communication overhead increases with team size.

A word on exponential: that growth rests on AI capability continuing to compound, and the pre-training mechanism behind it may be slowing, with the public-text supply it runs on exhausting this decade. It matters less than it sounds. The demand here tracks how much code ships and how much authority automation holds, both of which keep rising on deployment alone, and the comprehension gap above is already booked. A plateau buys more time rather than a different answer. The BAU vs Scaling chapter works this through.

The Inflection Point

Organizations reach a point where demand for BAU security services exceeds sustainable capacity, creating constraints on both security effectiveness and business velocity.

Strategic Choice Point

Organizations approaching this inflection point can choose between different resource allocation strategies:

Traditional Scaling Approach

  • Hire additional security personnel for manual work
  • Attempt to maintain current service levels across all requests
  • Build custom solutions for individual use cases
  • Maintain primarily reactive security posture

Result: Temporary relief followed by recurring capacity crises

Strategic Scaling Approach

  • Deliberately constrain capacity for some BAU activities
  • Develop automation and self-service capabilities
  • Create standardized approaches for common security needs
  • Shift toward proactive, scalable security architecture

Result: Sustainable security that improves with scale

Investment Portfolio Categories

These three categories rank by the shape of their return. BAU is linear-effort work whose return is bounded by the hours spent and stops when the spending stops; Scaling investments keep paying after the spend ends (BAU vs Scaling works that economics in full). Platform Effects pay across more than one factory at once, but only where you have more than one factory to serve. Usually that means factories you do not run: a product your customers build on, an open-source tool the field adopts. A large enterprise running many factories of its own can reach the same multiplication internally. An organization that serves a single factory tops out at Scaling, which is the right ceiling for it. The ranking by return shape is the durable claim. Which rungs are open to you is a matter of context.

The payback windows below are a 2026 baseline, calibrated to today's tooling and a typical rate of adoption. They will age. The ordering they sit under does not move on the same clock.

Three investment categories ranked by the shape of their return A line chart of cumulative return against sustained spend over time, plotting the three investment categories by the shape of their return. BAU is a straight line of modest slope. It climbs only while the spend continues and goes flat the moment spending stops, returning nothing after that. Scaling investment is a curve that starts slower than BAU but keeps compounding and rising after the initial spend ends, overtaking BAU and finishing far higher. Platform effects is the steepest curve, multiplicative because it pays across more than one factory at once, but its first segment is dashed to mark that it is only open where you serve more than one factory. The durable claim is the ordering by return shape: linear, then compound, then multiplicative. The payback windows are a 2026 baseline that ages; Scaling returns in roughly six to eighteen months and Platform in roughly twelve to twenty-four, but those numbers move while the ordering does not. Three categories, ranked by the shape of their return cumulative return sustained spend over time spend stops, return stops BAU: linear Scaling: compound Platform: multiplicative dashed = only where you serve more than one factory The ordering by return shape is the durable claim: linear, then compound, then multiplicative. Payback windows (Scaling 6 to 18 months, Platform 12 to 24) are a 2026 baseline that ages; the ranking does not.
The three categories ranked by return shape. BAU returns nothing once the spend stops; Scaling keeps compounding after it; Platform multiplies across more than one factory, where you have more than one to serve. The ordering is durable; the payback windows are a 2026 baseline that ages.

How fast any of this returns is set by absorption capacity: how fast the organization adopts a paved road, retires the manual work it replaces, and keeps a working understanding of what changed. Absorption has a measurable cost. DORA's 2024 State of DevOps research found that standing up a platform first cost roughly an eight percent dip in delivery throughput before the platform matured: the gain arrived after a temporary dip, paced by how fast teams absorbed the change rather than by the rollout date.

One thing the return-shape ranking does not say on its own: the category it tells you to prioritize, compounding scaling investment, is also the most discretionary line on the budget, which makes it the first one a downturn cuts. The 2023 round of security budget cuts landed hardest on exactly this kind of future-facing spend. That year, HackerOne found 63 percent of organizations cut their security budgets, and 39 percent cut headcount. Two instructions follow, and both are about sequencing rather than reassurance. If you are funding in an up-cycle, pre-fund the compounding capability now, because it is the line that vanishes when the cycle turns. Whatever the cycle, bias the portfolio toward capability-based controls that keep enforcing with fewer hands, because that is the spend whose value does not leave with the headcount. What a cut cannot repossess is the durable enforcement that keeps running with fewer hands, which is the Lean guide's subject. This paragraph is about what to fund first. A plateau may give you more time on the demand side; a downturn gives you less on the funding side, so build for the clock that runs out first.

BAU Activities (Constrain)

Characteristics:

  • Manual work that scales with growth
  • Security reviews, threat modeling, incident response
  • Customer security questionnaires
  • Individual risk assessments

Evaluation Criteria:

  • Operational necessity
  • Customer impact
  • Constraint sustainability

Resource Allocation: Deliberately limited capacity post-crisis

Expected ROI: Immediate but unsustainable scaling

Constraining BAU Strategically

Constraint doesn't mean abandonment. It means providing self-service alternatives, automation, and clear prioritization criteria.

Scaling Investments (Prioritize)

Characteristics:

  • Capabilities that reduce manual effort exponentially
  • Automation platforms, self-service capabilities, policy-as-code
  • Developer security platforms
  • Continuous security validation

Evaluation Criteria:

  • Manual effort reduction potential
  • Developer experience improvement
  • Time to value
  • Cultural alignment
  • Organizational change requirements
  • Adversary economics

Resource Allocation: Primary investment focus past crisis point

Expected ROI: 6-18 months with compound returns (2026 baseline, modeled; paced by absorption capacity rather than a fixed calendar)

Scaling Investment Examples

  • Paved Roads: Secure templates that eliminate security review needs
  • Self-Service Platforms: Automated environments with security baked in
  • Policy-as-Code: Automated compliance validation
  • Automated Dependency Management: Continuous monitoring without manual effort

Platform Effects (Multiply)

Characteristics:

  • Benefits both internal and customer software factories
  • Security capabilities that create multiplicative value
  • Open-source security tools
  • Security-as-a-service offerings

Evaluation Criteria:

  • Internal business case + multiplicative customer value
  • Competitive differentiation
  • Market amplification potential

Resource Allocation: Enhancement to scaling investments

Expected ROI: 12-24 months with market amplification (2026 baseline, modeled; same caveat as above)

Investment Evaluation Framework

When evaluating security investments, consider these criteria:

Criteria Description Why It Matters
Manual Effort Reduction Will this eliminate repetitive work permanently? Primary driver of sustainable scaling
Developer Experience Impact Does this reduce security friction or create new complexity? Critical for organizational adoption
Time to Value How quickly will benefits become measurable? Affects organizational confidence
Cultural Alignment Does this support learning culture and psychological safety? Determines long-term sustainability
Organizational Change Requirements What adoption challenges should we anticipate? Affects implementation success probability
Adversary Economics Does this close the surface it claims, or only raise the cost on paths already covered? Coverage is the test. Cost-raising counts on top of a boundary that contains the breach, not instead of it.

Designing Security Capabilities That Compound

The "Catch and Store" Principle

The most sustainable security investments do more than solve immediate problems. They capture organizational effort and store it in reusable capabilities that serve future needs without additional manual work.

Renewable Energy Analogy

Like renewable energy systems that provide ongoing value after initial investment, effective scaling investments become self-sustaining and increasingly valuable over time.

Examples of Compound Capabilities:

Paved Roads:

  • Secure templates and baselines that engineers reuse without security review
  • Each use provides security value without marginal security team effort
  • Templates improve based on lessons learned

Self-Service Platforms:

  • Automated environments and policy-as-code
  • Eliminates recurring security review requests
  • Scales to thousands of deployments without proportional security team growth

Automated Dependency Management:

  • Continuous monitoring without manual scanning
  • Automated vulnerability detection and remediation
  • Improves security posture while reducing security team workload

Security-Quality Integration:

  • Process improvements that serve both goals simultaneously
  • Single investment, dual benefits
  • Reinforcing improvements over time

Avoid Energy-Consuming Tools

Some security tools create new maintenance burdens without proportional value. Favor investments that become more valuable and less demanding over time, capabilities that store energy rather than consume it.

BAU Constraint Strategy by Organizational Stage

Organizational Stage BAU Constraint Approach Communication Strategy Alternative Provision
Pre-Crisis Maintain current service levels "We're investing in better capabilities" Gradual self-service introduction
Crisis Point Strategic capacity limits "We're shifting to sustainable scaling" Clear self-service alternatives
Post-Crisis Systematic constraint with alternatives "Improved capabilities now available" Comprehensive self-service platform

Financial Model Considerations

Security leaders must work within inherited financial constraints while building toward more strategic integration:

Cost Center Context

Reality: Security viewed as overhead to minimize

Strategy: Focus on compliance cost avoidance and operational efficiency

Communication: Emphasize business risk reduction and efficiency gains

Investment Opportunities: Crisis events create windows for scaling investment approval

Shared Services Context

Reality: Security funded through chargeback model

Strategy: Develop strong business cases emphasizing internal customer satisfaction

Communication: Highlight operational improvements that reduce business friction

Investment Opportunities: Service level improvements and efficiency gains

R&D Integration Context

Reality: Security integrated into product development budget

Strategy: Frame security investments as competitive advantages

Communication: Measure success through business outcomes rather than security-specific metrics

Investment Opportunities: Product security capabilities that differentiate in market

Strategic Conversation Template

When proposing the shift from traditional to strategic scaling:

Executive Communication

"We've identified that our current security approach may become a business constraint as we continue to scale. Rather than only adding capacity through hiring, which provides temporary relief, we recommend investing in capabilities that reduce manual effort requirements permanently.

This approach can improve both security outcomes and business velocity over time. The initial investment will create capabilities that compound: each use provides security value without proportional security team effort.

We'll measure success through developer satisfaction, security coverage, and time-to-market improvements, demonstrating that security enables rather than constrains business growth."

Implementation Roadmap

Run it in this order: assess, pilot, constrain, expand. The quarter labels are a 2026 baseline cadence. An organization with high absorption capacity may move through it in two quarters; one stabilizing heavy BAU debt may need a year. Pace the moves to what the organization can absorb rather than to the calendar.

Quarter 1: Assessment and Planning

  • Measure current BAU demand and capacity
  • Identify scaling investment opportunities
  • Assess developer pain points
  • Build business case for strategic shift

Quarter 2: Pilot Scaling Investments

  • Select highest-impact scaling investment
  • Implement pilot with small team
  • Measure manual effort reduction
  • Collect developer feedback

Quarter 3: Constrain BAU + Scale Alternatives

  • Introduce strategic BAU constraints
  • Provide self-service alternatives
  • Communicate clearly about transition
  • Monitor adoption and satisfaction

Quarter 4: Iterate and Expand

  • Review pilot results and iterate
  • Expand successful scaling investments
  • Build compound capabilities
  • Demonstrate ROI to stakeholders

Next Steps

Explore specific aspects of the investment portfolio framework:

BAU vs Scaling Investments Platform Effects Evaluation Criteria

Back to Strategic Positioning