A report on a set of semi-structured interviews that aimed to determine how firms make decisions regarding their cyber security investment. The report finds that senior management understand the importance of cyber security, that budgeting for cyber security is not difficult but finding qualified personnel is, and that the process is prioritised over outcome.