What a great post...simple, obvious and compelling.

http://www.guerilla-ciso.com/archives/177

When I used to work for a large financial services company in the bay area we used to be bombarded with BS ROI models. I saw a few created by sales guys at a large software vendors worked at as well.

Few people in the world are in the business of being secure and far fewer have yet worked out (or had the opportunity) to use security as a competitive differential so traditional economic models just don't translate.

I like it as well. Check out Seth Godins book about marketing which explains the theory really well. It's nice to see fellow security people looking outside the industry for answers! 

EdJames:

I like it as well. Check out Seth Godins book about marketing which explains the theory really well. It's nice to see fellow security people looking outside the industry for answers! 

I read Seth's blog daily, have his feed on my browser, and still think that the marketing other "people people" are strange enough that they must be studied.  Instinctively, I don't "get it" but rationally I do.

It appears that Curphey likes The Long Tail of Security, he posted a whole series about it on his blog.  Quite a little meme I've created. =)