Tell your CFO that your software is mostly assembled from other people's parts, and that supply chain security is the inventory and checks that tell you what is inside before a problem becomes a disclosure. Frame it as reducing surprise cost, not as buying a tool.
What is the one paragraph version?
"Most of what we ship is third party code. When one of those parts turns out to be flawed, we need to know within hours which products contain it. Today that takes us this long. With a maintained inventory it would take this long. The gap is the cost we are trying to remove."
Fill in the two durations with your own measured numbers. CFOs trust a measured gap more than an industry statistic.
Why does this belong in a finance conversation?
Three reasons, each with a source.
Disclosure duty. Under the SEC's 2023 rules, public companies must report a cybersecurity incident they determine is material on Form 8-K Item 1.05, generally within four business days of that determination. They must also describe in the annual report how they assess and manage cyber risk, including board oversight. If your product can be breached through a dependency, your ability to scope an incident quickly affects that clock.
Cost of a breach. The IBM and Ponemon Cost of a Data Breach Report 2026 page states a global average of about 4.99 million US dollars, described as a record high and a 12 percent rise on the prior year. The page we fetched did not give a supply chain specific figure, so do not attribute one to IBM. Use the average as context only, and note it is a global average across industries.
Customer and procurement pressure. CISA calls the SBOM a key building block for software security and supply chain risk management. Buyers increasingly ask for one. A missing inventory can slow a deal.
What numbers should you bring?
Bring numbers only you can produce:
- Time to answer "do we use component X?" for the last real advisory.
- Share of repositories with a current dependency inventory.
- Number of open critical findings that are known to be exploited, and their age.
- Hours per month engineers spend triaging findings that turn out not to matter.
That last number is the budget argument. If triage consumes a week of senior time every month, tooling that cuts it is an operating cost question, not a security one.
What should you avoid saying?
Avoid fear stories and unverifiable statistics. Avoid promising zero incidents. Avoid jargon such as "transitive" without a one line gloss: a dependency of a dependency. And avoid asking for money before you have shown the measured gap.
What does a good ask look like?
A bounded one. For example: two engineers for one quarter to build the inventory, set severity targets and run a tabletop drill, with the answer time as the success measure. Tools come second and are justified by the drill results.
What to do
- Run a drill: pick a recent advisory and time how long it takes to list affected products.
- Write the one paragraph script with your two durations.
- Pull the SEC disclosure language from your counsel so the legal framing is theirs, not yours.
- List the four metrics above and who owns each.
- Propose a one quarter outcome with a clear measure.
- Report the measure monthly in one line.
Quick check
Do I need to explain what an SBOM is?
One sentence is enough: a list of every component inside a piece of software, like an ingredients label.
Should I quote a breach cost to justify the budget?
Use it as context, labeled as a global average. Your own measured delay is the stronger argument.
Sources
- SEC press release on cybersecurity disclosure rules, 2023
- IBM: Cost of a Data Breach Report
- CISA: Software Bill of Materials
Last reviewed: 18 October 2026.
