There is a strategic question that we are banging our heads against in my IT department, which essentially boils down to this:
There is a type of attack against our systems that can cause a lot of damage if missed or not addressed properly. More precisely, this could cause a major blow to the company's operations and potentially ruin the entire business.
The probability of such an attack is very low. Nonetheless it does happen to other companies in the field regularly (however rarely). It has not happened to our systems yet.
In order to be able to mitigate the attack, we must hire another employee and spend an additional 8% (at least) of our budget every year. Both of which are significant investments.
Usually we gauge such problems by multiplying the probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to infinity to come up with cohesive answer.
Along the same lines, our team in divided into two camps: one thinks that the attack will never happen and the investment of time and money will be wasted; the other camp thinks that the attack will come tomorrow. Everybody agrees, though, that half-assed measures will be both a waste of resources and will not protect against the attack – we either go all-in or don't bother at all.
As the team leader, I see merit in both opinions – we may operate for the next 20 years without encountering such an attack, and we might have it today (out of the blue, as it usually happens). But I still have to decide which way to proceed.
In that regard, I would like to ask you whether you encountered such puzzles and what is the industry's approach to dealing with them.