Physical security is one of the few business risks still reported in colors and incident counts rather than dollars. That keeps it out of the comparison where budgets get decided. Putting it in dollars does not require false precision, only a number the business can compare, defend and revise as it learns more.
Physical security risk should be measured in dollars because dollars are the unit the rest of the business already uses to weigh one risk against another, and against the cost of doing something about it. Put the full risk register in front of an enterprise risk management consulting team and the physical security rows are the only ones without a dollar figure. Physical security is rarely underfunded because the risk is small. It is underfunded because it is the one risk nobody can add up.
Operations already prices its biggest risk. Siemens estimates that the Fortune Global 500 lose almost $1.4 trillion a year to unplanned downtime, about 11% of revenue, and that an hour of downtime at a large automotive plant costs $2.3 million (Siemens, The True Cost of Downtime 2024). A plant manager who wants a new line can argue in that unit.
Cyber is held to a public standard. Under rules the SEC adopted in 2023, public companies must explain in their annual 10-K how they assess and manage material cybersecurity risk and how the board oversees it (SEC press release 2023-139). In announcing the rules, the SEC treated a major cyber incident and a factory fire as the same kind of event: either can be material to investors. Cyber now has a disclosure item of its own.
That leaves corporate security as the outlier. Finance runs on models, cyber answers to investors, and security still defends its budget with instinct and incident counts.
A five-point scale tells you which site worries the team most. It cannot tell a CFO how much that worry is worth, or whether one more guard post buys more protection than a camera upgrade at the same price. When the request reaches the budget meeting, it sits next to a downtime estimate in dollars and a cyber program with a board-level disclosure behind it. The rating loses because it cannot be compared, not because it is wrong.
Colors also hide two different problems at once. A site rated medium for three straight years may be carrying more exposure than the company's strategy tolerates, and nobody sees it because the color never moved. A control funded every year because it is familiar may be reducing little, and nobody sees that either. Better decisions cut both over-exposure and over-spend, and a scale that cannot show either is not helping with the decision every security budget comes down to: what the next dollar should protect.
For how this plays out in banking and manufacturing, see Rated, never priced: the physical security risk assessment banks need and Everything reads as medium: the corporate risk assessment manufacturers actually need.
It already is, when someone does the work. The American Hospital Association estimated that violence cost US hospitals $18.27 billion in 2023, counting the cost of incidents and the cost of preparing for them (AHA, June 2025). Workplace violence is about as human a risk as security handles, and it still has a dollar figure an executive can read.
It also holds at the company level. The security leader at one technology customer described the change as being able to go to Finance and "show math data, money data to them." The figure did not have to be perfect to change the conversation. It had to exist.
Pricing a risk does not mean reducing everything to money. A useful dollar figure starts from what is at stake, which is rarely only cash: the safety of people, the sites themselves, continuity of operations, insurance coverage that depends on documented controls. It then weighs the options, the controls or courses of action available, against the context: how big the company is, how many sites it runs, whether it is expanding or consolidating. The dollar figure is the common unit that lets those pieces sit side by side.
It should not, and an honest one does not. The number is a defensible starting hypothesis built from external statistics and the company's own context, calibrated with the company's feedback, with the source logged behind each risk. A control's effect starts as a stated assumption and is checked over time against the company's own before-and-after incident data. What the CFO gets is a traceable number the security leader can defend and that gets more accurate as new data comes in.
Some decisions are won on something other than risk avoided. An option can come out even on risk and still win on cost or continuity, and a dollar view makes that visible instead of forcing every case into the same argument.
The point is to connect the work to the risk it is meant to reduce. A project tracker shows what the security team is doing. A dollar view shows which risk each control reduces, and by how much, which is the link a color scale cannot make.
Holtium is an annual program. A security expert works with your team to build and maintain how security decisions get made, with the platform as part of the program, so each decision can be explained and defended afterward. Pricing the risk in dollars is one part of that. The point of the number is the decision it lets you make, and the case it lets you bring to the budget meeting.
Once physical security risk is in dollars, the next question is where the first dollars should go. Any enterprise risk management consulting discussion about where money goes should include physical security, with a number that can earn its place, year after year.