September 16, 2026 · Executive Intelligence · Operating Plan

The Operating Plan — decide what to fund, defend it to your CFO

Turn your risk register into a funded, defensible budget: programs ranked by expected loss reduced per dollar, a funding line drawn by the budget you actually have, and every no recorded as a signed decision. Board slide, CEO one-pager, CFO variance letter, and the signed accepted-risk register — generated from the plan of record.

What changed

Every security budget conversation eventually arrives at the same question: why this number? The Operating Plan is live in Executive Intelligence for Business plans and above, and it’s the thing that answers it. Your risk register already prices every scenario in dollars; the Operating Plan spends against it.

Funding line
Programs order themselves by the loss each dollar buys down, your budget decides where the money stops, and everything below the line stays on the table with a reason.
Investment case
Programs proposed from your own maturity gaps and open findings, priced as labeled starting estimates, ranked by what each dollar buys down. The first defensible draft takes about an hour, not six weeks.
Priced cuts
Finance's counter runs against the same exposure data, so a 10% cut arrives with its cost in expected loss attached. The business either shrinks the cut or chooses it with eyes open.
Signed acceptance
Accepting a scenario goes through the risk register's own decision path: rationale required, chain-attested, sealed when the plan is promoted to plan of record.
The packet
Board slide, CEO one-pager, CFO variance letter, and the signed accepted-risk register generate from one plan of record, every figure traceable back to it.
The budget control set to $1.1M of a $1.9M ask, funding 6 of 9 programs with $926K of risk reduced and $214K of residual exposure, allocate-by modes for risk reduced per dollar, priority order, and audit-led.
FIG. 1The budget set to $1.1M of a $1.9M ask funds 6 of 9 programs, with $926K of risk reduced and $214K of residual exposure called out. Allocate-by modes: risk reduced per dollar, priority order, or audit-led.

Why it matters

Security budgets die as lists. Everything sounds necessary, nothing is ranked, and whatever didn’t fit just quietly doesn’t happen. The funding line ends that. Programs order themselves by the loss each dollar buys down, your budget decides where the money stops, and everything below the line stays on the table with a reason. The argument stops being “do we really need all this?” and becomes “is this the right number?”

Cuts get priced before they get made. Finance’s counter runs against the same exposure data, so a 10% cut arrives with its cost in expected loss attached. Either the cut shrinks, or the business chooses it with eyes open. You never absorb it silently.

Unfunded risk stops being quietly yours. The accept-risk path records rationale, attests the decision to the chain, and seals it when the plan becomes plan of record. When “who decided this?” gets asked, the answer is on the record.

Availability

Live today for Business plans and above. Reporting → Forecasting → Operating plan in your tenant.

The full walk-through is on the Operating Plan page. Programs are proposed from the maturity gaps and open findings already in your tenant, so the first plan opens with real line items instead of an empty table.

Known limitations

The funding line prices against scenarios already in your risk register. Scenarios that aren't priced in dollars yet don't appear on the plan until they are.

Program estimates arrive as labeled starting figures from the maturity gap or finding they close. Replace them with your own quotes before you take the plan to a CFO who will test the numbers.

The packet renders from the plan of record. When you promote a new plan, the previous packet's figures are archived to the version it was built from rather than retroactively re-rendered.