The emergence (and widespread adoption) of cloud technology, AI, and other solutions has fundamentally changed the way organizations around the world do business while simultaneously putting advanced capabilities in the hands of individual employees and everyday consumers. But upgrading to the “latest and greatest” technology isn’t always feasible for businesses, given the cost and disruption involved in constantly changing processes and switching solutions. So how can today’s organizations better understand when it makes sense to upgrade—and when it doesn’t?
The answer often comes down to understanding risk. For instance, introducing a new cybersecurity solution can be risky—it might be costly, or require additional training, or entail calibrations or maintenance. That can be tough for many businesses to swallow—but in many cases, the cost of inaction might be even higher. For today’s businesses, understanding when it is time for a change doesn’t just come down to dollars and cents. It’s about recognizing when the risk of inaction outweighs the risk of change.
Weighing the cost of change vs. the cost of inaction
Businesses are constantly changing, but making the right change at the right time is critical—and that means understanding when the perceived value of a new solution outweighs the cost of change. A good place to begin is understanding how internal stakeholders feel about the current solution or process. Has it been widely adopted across the organization? Do users generally like it? Do they have any common frustrations? Are there any stakeholders who would be disproportionately impacted by a potential change? Is the solution effective, or have employees just gotten used to it? These questions—and many more—are critical to understanding not just how well a process or solution currently functions, but how it affects the wider organization.
That broader impact is the “cost of change.” If employees like using the current process or solution, that cost will likely be high—even if that solution is ineffective. Consider a cybersecurity solution that is simple and easy to use but is outdated and antiquated, so it can’t integrate or scale as the business grows. Even though that solution no longer adequately covers the organization’s vulnerabilities, employees will likely be resistant to change—because security metrics don’t impact them directly. Switching to a solution that creates additional friction won’t be a popular decision, which increases the cost of change. Ultimately, security and business leaders will need to consider how they communicate the change—and its necessity—to generate the appropriate level of buy-in. It’s not just dollars and cents, consider the emotional toll, too.
There are other reasons change might be necessary. If employees aren’t engaging with a solution—or worse, actively looking for ways to avoid it—that’s a sign that change is likely needed. For example, data security is a top priority for today’s businesses, but if the data security measures an organization has in place are frustrating, complex and complicated, employees will start looking for ways to avoid them entirely. If your employees are frustrated enough to start sending sensitive data from their personal emails accounts or taking screenshots of confidential information, they are creating significant risk for the organization. In these cases, the cost of change may be high—but it is also irrelevant. Modern businesses cannot afford to allow employees to flaunt privacy or security guidelines in ways that risk regulatory penalties, costly data breaches, or—worst of all—reputational damage that takes years to repair.
Evaluating the ROI of change
When there is a direct impact on the business’s bottom line, the decision to change can sometimes be easy. Regulatory and compliance guidelines shift on a regular basis, and an organization may discover that its security or risk posture no longer meets the appropriate standard. Data privacy regulations, such as GDPR or CPRA, carry stiff fines and other harsh penalties. On the other hand, security frameworks like SOC 2 or ISO 27001 impose no penalties—but customers are unlikely to stick with an organization that cannot adequately protect the data it collects. Customers don’t want their partners and vendors running afoul of regulatory or compliance guidelines, which means change is a necessity in these cases—regardless of the cost.
Avoiding negative outcomes is important—but change often comes with ROI of its own. Does the new solution make key processes more efficient? Will it ultimately lower costs in the aggregate? Will the new solution be more widely adopted within the organization because it reduces friction? Does it meet your needs today, and can it scale with you in the future? At a time when AI is unlocking vast new efficiencies and advanced capabilities, answering these questions and assessing the associated ROI can help businesses better understand not just when to use AI, but how to get the most out of it. For example, a new access management solution that uses AI to automate the evidence collection process can save hundreds (if not thousands) of hours that would otherwise be spent manually gathering data for compliance audits. Calculating the value of that should be simple—and it gives security teams an important data point to include in their conversations with leadership.
Changes or upgrades that improve the volume and quality of information business leaders have at their fingertips can carry substantial ROI—especially at a time when AI is helping businesses unlock greater insights from disparate data sets. Upgrading from a point solution to a more AI-powered holistic approach can often have this effect, enabling information sharing across different systems, applications, and departments, and providing greater visibility and better data-driven reporting upon which to base important decisions. For example, an isolated risk management system can only do so much—but a holistic platform with AI features can aggregate data from security, sales, marketing, and other departments to provide a window – and recommendations – into risk across the entire business, empowering leaders to make informed, risk-based decisions that drive growth.
Preparing for change wherever it is needed
Complacency is the enemy of innovation. That doesn’t require organizations to constantly update their solutions and processes—but it does mean they need to always be open to the idea that while change can be hard, change brings opportunity. Organizations can’t always afford to switch to the “latest and greatest” technology the moment it releases—and even if they could, the constant churn would be disruptive. Instead, organizational leaders should always be evaluating those areas where upgrades might be needed, gauging the cost of change against the potential ROI. When the tipping point is reached, making the business case for change should be easy.
