Any Cyber budget is appropriate

Any Cyber budget is appropriate if it is derived from Board of Directors deliberation using comprehensive risk curves.   Some argue companies spend too little on cyber defense.  Most likely all companies have compromised hosts.  The mathematics of security is the mathematics of risk.  Unfortunately comprehensive risk curves are becoming a thing of the past.  As Dr. W Edwards Deming stated, "In God we trust, everyone else must use data".