Ten Minutes With the Operations Director

Operations directors want one thing from security: fewer bad nights.

So start the conversation with the night CME's markets stopped. More than ten hours. Trading halted across stocks, bonds, currencies and commodities, all from one cooling plant. Then ask the director one question. What would ten hours cost us?

Count the real cost

INDEPENDENT EVIDENCE

Uptime Institute's 2025 survey found that 57 percent of operators said their most recent major outage cost more than $100,000. One in five said the last outage that hurt their business cost more than $1 million.⁷

Your own number will be different. Work it out together. Start with the availability promises in your contracts and the service credits they trigger. Add the hours your customers would feel it. Add revenue or transactions at risk. Add staff time and emergency vendor call outs. Add the risk to hardware from a heat event. Then add the hardest one to price: trust, and what it does to renewals.

Last, add the cost of the broad shutdown. That's the outage you cause when you can't contain one device, so you take down a whole zone to be safe.

Three kinds of value

When you report results to the director or the board, keep three kinds of numbers apart. Mixing them is how security reports lose credibility.

Found. What the assessment measured. Devices nobody had listed. Exposed management screens. Unexpected connections. Devices with no clear owner. Every one of these is counted.

Saved. Time your team no longer spends hunting for device owners, chasing alerts, coordinating vendors and writing up incidents. Measured with your own labor rates.

Reduced risk. Downtime and incident scope you likely avoided. This one is an estimate, and it should always say so, with the assumptions shown.

Keep the report clear about what was measured and what was estimated. That gives the operations director something they can check.