ARR Became King: How Cybersecurity’s Economic Engine Created the Budget Crisis CISOs Now Inherit

A Three-Part Deep Dive Told Through the Lived Reality of CISOs, the Incentives of VCs, the Pressure on Vendors, and the Economics Driving All of It.

Coffee Cup Cheers, Security Gang. Let’s talk about the decade that shaped your budget before you ever touched it.

If you’ve been anywhere near a cybersecurity budget meeting in the last five years, you’ve probably asked yourself some version of this question:

“Why do vendors keep raising prices when my budget barely moves?”

It’s a fair question.
A painful question.
And an important one — because the answer isn’t “inflation” or “greedy vendors” or “supply and demand.”

The truth is more structural and far more consequential:
cybersecurity pricing today wasn’t designed by CISOs, or CFOs, or even the vendors themselves.

It was designed by the economic environment that shaped the entire tech industry between 2015 and 2022.

To understand why CISOs now feel boxed in by unpredictable renewals, consumption overages, and per-endpoint price explosions — you have to understand the world that shaped vendor behavior long before those vendors shaped your budgets.

This is that story.

The Decade of Cheap Money and Explosive Valuations

To make sense of today’s cybersecurity pricing, we need to travel back to what I call the Zero-Interest Decade — roughly 2012 to early 2022. The cost of capital was near zero, venture funds were flush with cash, and the playbook for software was straightforward:

Recurring Revenue = Predictable Revenue = High Valuations.