Put three options in front of executives: a minimum that keeps current commitments, a recommended plan that meets stated targets, and an expanded plan that goes further. For each, state the cost, the capacity it takes from features and the risk that remains. Choosing among options is easier than approving a single ask.
Why a single ask fails
A lone request invites a yes or a no, and "no" is the safe default for someone who cannot judge the details. Three options change the question to "how much risk do we keep?" That is a decision executives are used to making, and it puts the tradeoff on the table where it belongs.
Keep each option honest. A fake low option designed to be rejected is quickly spotted and damages trust for the next request.
The structure
| Option A: Minimum | Option B: Recommended | Option C: Expanded | |
|---|---|---|---|
| What it covers | Meets current commitments only | Meets service levels on exposed assets | Adds cleanup of aged backlog |
| Capacity needed | Existing slice | Reserved sprint share, stated | Reserved share plus a dated hardening effort |
| Feature impact | None | Modest, stated | Larger, for a bounded period |
| Residual risk | Backlog keeps growing | Exposed assets covered, older items remain | Backlog cleared in named areas |
| Review date | Next quarter | Next quarter | Next quarter |
Fill every cell with something concrete from your own data. If a cell is vague, the option is not ready.
What evidence to bring
Use numbers that do not need defending. Open items by age and exposure. The forecast of when the backlog clears at the current rate, built as in how to forecast when your backlog will clear. The share of engineering time already spent on fixes, tagged as in should security fixes count toward velocity.
Add a few external signals if they help the case, such as whether items appear on the CISA Known Exploited Vulnerabilities catalog. Do not quote industry averages you have not verified, and do not invent loss figures. If finance wants a loss estimate, see expected loss vulnerability prioritization for a method with stated assumptions.
Write the residual risk in plain words
For each option, finish the sentence: "If we choose this, we are accepting that..." Examples: "an attacker who finds one of the open internal items has a longer window," or "the older backlog continues to grow by roughly the current net rate." Avoid fear and avoid false comfort. Executives respect a clear statement of what they are accepting.
Make the recommendation, then step back
State which option you recommend and why in two sentences. Then let the executive decide. Record the choice and the date. If they choose Option A, record that as a risk acceptance with an owner and a review date, as in what fields belong in a risk acceptance record. A decision made and written down is more valuable than a vague approval.
Follow up
Report against the chosen option each quarter: items by age, forecast date and capacity actually used. If reality diverges, say so early. A related view of reporting is in vulnerability metrics for leadership reports.
Safeguard's compliance and evidence automation can keep dated records of findings, exceptions and remediation, which gives the quarterly report a factual base. Reachability analysis helps show which open items sit in code that runs.
Quick check
Should the minimum option be a real option?
Yes. It must be something you could live with for a quarter, with its residual risk stated. A strawman option damages credibility.
Do I need dollar figures?
Not always. Item counts by age, exposure and forecast dates are often enough. Add dollars only with stated assumptions that finance can inspect.
Sources
Last reviewed: 19 October 2026.
