You currently spend 2% as much on the countermeasures to prevent attacks as the reported expected cost of the attacks themselves (that you are presumably preventing, i.e. you spend $2 for every $100 of total risk). Your manager wants this percent spending to be only 1% next year (i.e. spend 1% as much on security countermeasures as the cost of the attacks if they were not prevented). You find reliable data that shows there will be 300% as much cost in attacks (if successful, i.e. risk will increase by 200% of current value) next year due to improved threat agencies around the world. Should your budget grow or shrink? By how much? If you have 20 employees right now, how many should you hire or furlough?