Make the case with your own numbers: how many findings arrive, how many you fix, how old the oldest critical items are, and what stands in the way. Present options with trade-offs, and frame patching as preventive maintenance. Avoid scare stories and borrowed statistics, which leaders discount.
Start with the framing leaders accept
NIST describes patching as preventive maintenance, a cost of doing business and a necessary part of achieving an organisation's mission. It also notes that business owners and security teams often disagree about the value of patching. That gap is the real conversation. Your job is to show maintenance load in terms owners already use: delivery time, risk to customers and planned work.
The four numbers to bring
| Number | What it shows |
|---|---|
| Inflow per period | How much new work arrives |
| Throughput per period | How much your team clears |
| Aging of the oldest and of high priority items | How long risk sits open |
| Share of work that is routine vs hard | Where automation or people help |
All four come from your own tracker. If you do not have them yet, say so and propose a few weeks of measurement before any hiring request. That is more credible than a guess. For the chart that ties inflow and throughput together, see the inflow and outflow chart.
Show the gap in plain language
State it simply: "We fix about this many a week. About this many arrive. The difference is the backlog growing." Use your real figures, and no others. If the gap is zero, you may not need more capacity, only better sorting.
Offer options, not a single ask
Leaders decide better with choices. A useful set:
- Hold steady. What happens to aging if nothing changes, in your own trend.
- Reduce demand. Reachability filtering, fewer dependencies, retiring unused services.
- Automate routine fixes. Savings in review hours, with the controls you will keep.
- Add people or protected time. What they would own, and how you would measure the result.
- Accept more risk explicitly. A named owner signs off on longer timelines for stated classes.
Option five matters. It makes the cost of doing nothing a decision someone owns, rather than a drift.
Connect to commitments
Link the request to things the business already cares about: customer contract timelines, audit requests, and planned releases. If you have written remediation timelines, show how many items currently miss them. See what to tell leadership when you will miss a remediation SLA for wording.
What to avoid
- Industry statistics you cannot source. Use your own data.
- Fear stories about other companies' incidents. They invite doubt.
- Asking for headcount before ruling out waste. If most findings are noise, fix the filter first.
- Vague asks. Say what the capacity will do and how you will report it.
Close with a measure and a date
Propose one or two metrics, a review date, and what you will do if they do not improve. A time boxed trial is easier to approve than an open commitment.
Where Safeguard fits
Safeguard's findings, ownership and aging records give you the inflow and fix data for this conversation, and reachability analysis helps show how much of the queue is code that actually runs.
Quick check
Should I quote breach statistics in the request?
Only if you have verified the source and it applies to you. Your own aging and throughput data is usually more persuasive.
What if I have no metrics yet?
Ask for a short measurement period first, and bring the results back with options.
Sources
Last reviewed: 19 October 2026.
