Every day, it seems, a story emerges about a backup-tape theft or compromised customer data. But don't overuse these incidents when seeking to justify your funding requests. "CXOs can become desensitized or jaded if they hear too much about reports that they don't think affect them," says Christopher Bomar, founder of Boomarang LLC, an online data-backup service firm in Cincinnati.

"FUD has been used up," agrees Mark Rhodes-Ousley, an information security architect and author of Network Security: The Complete Reference (McGraw-Hill Osborne Media, 2003). "So many people have cried wolf that executives are inured to scary stories."

You might, however, consider using recent security incidents to shed light on your company's needs. For instance, you can send out regular e-mails that put news stories into perspective and show how they apply -- or don't -- to your business, says Bob Dehnhardt, network and information security manager at TriNet, a human resources services firm in San Leandro, Calif. "You can use these incidents as an opening, but back them up with a strong business case," he says.

For instance, when a report comes out about backup tapes being stolen, point out what happened to the company's stock price on the day the story broke, says Gary McGraw, chief technology officer at security consultancy Cigital Inc. and author of Software Security: Building Security In (Addison-Wesley Professional, 2006) .

Do Use Horizon Planning