What budget is needed for remediation? - What is the cost of inaction? (regulatory fines, breach costs, operational disruption) - Frame as risk reduction per dollar invested