The £18,000 Saving That Cost £200,000 in Revenue
Ever cut a cost that seemed obviously wasteful, only to discover you'd destroyed something far more valuable? Welcome to the Doorman Fallacy —it's probably happening in your business right now.
In this episode, Noel Bradford introduces a concept from marketing expert Rory Sutherland's book "Alchemy" that explains precisely why "sensible" security cost-cutting so often leads to catastrophic consequences. Through five devastating real-world case studies, we explore how businesses optimise themselves into oblivion by defining roles too narrowly and measuring only what's easy to count.
Spoiler alert: The doorman does far more than open doors. And your security measures do far more than their obvious functions.
What You'll Learn
The Core Concept
What the Doorman Fallacy is and why it matters for cybersecurity
The difference between nominal functions (what something obviously does) and actual functions (what it really does)
Why efficiency optimisation without a complete understanding is just expensive destruction
The five-question framework for avoiding Doorman Fallacy mistakes
Five Catastrophic Case Studies
1. The Security Training Fallacy (Chapter 2)
How cutting £12,000 in training led to a £70,000 Business Email Compromise attack
Why training isn't about delivering information—it's about building culture
The invisible value: shared language, verification frameworks, psychological safety
What to measure instead of cost-per-employee-hour
2. The Cyber Insurance Fallacy (Chapter 3)
The software company that saved £18,000 and lost £200,000 in client contracts
Why insurance isn't just financial protection—it's a market signal
Hidden benefits: third-party validation, incident response capability, customer confidence
How cancelling coverage destroyed vendor relationships and sales opportunities
3. The Dave Automation Fallacy (Chapter 4)
Insurance broker spent £100,000+ replacing a £50,000 IT person
The £15,000 server upgrade that Dave would have known was unnecessary
Institutional knowledge you can't document: vendor relationships, crisis judgment, organisational politics
Why ticketing systems can't replace anthropological understanding
4. The MFA Friction Fallacy (Chapter 5)
Fifteen seconds of "friction" versus three weeks of crisis response
The retail client who removed MFA and suffered £65,000 in direct incident costs
Why attackers specifically target businesses without MFA
The reputational damage you can't quantify until it's too late
5. The Vendor Relationship Fallacy (Chapter 6)
Solicitors saved £4,800 annually, lost a £150,000 client
Why "identical services" aren't actually identical
The difference between contractual obligations and genuine partnerships
What happens when you need flexibility and you've burned your bridges
Key Statistics & Case Studies
42% of business applications are unauthorised Shadow IT (relevant context)
£47,000 BEC loss vs £12,000 annual training savings
£200,000 lost revenue vs £18,000 insurance savings
£100,000+ replacement costs vs £50,000 salary
£65,000 incident costs vs marginal productivity gains
£150,000 lost client vs £4,800 vendor savings
Common pattern: Small measurable savings, catastrophic unmeasurable consequences.
The Five-Question Framework
Before cutting any security costs, ask yourself:
What's the nominal function versus the actual function?
What does it obviously do vs what does it really do?
What invisible benefits will disappear?
Be specific: not "provides value" but "provides priority incident response during emergencies"
How would we replace those invisible benefits?
If you can't answer this, you're making a Doorman Fallacy mistake
What's the actual cost-benefit analysis, including invisible factors?
Not just "save £8,000" but "save £8,000, lose security culture, increase incident risk"
What's the cost of being wrong?
In cybersecurity, the cost of being wrong almost always exceeds the cost of
Show more...