Counting inspection against downtime
Security spending is hard to justify against incidents that did not happen. Downtime is easier: a confirmed incident takes a machine out of service until it is cleared, and at a busy site those hours are measurable. That comparison makes the discussion concrete.
The operational cost of a compromised terminal
A skimming device that is found forces the machine out of service until the review is complete, and that location loses capacity exactly when it is most visible. On top of the cost of the incident itself comes the cost of the interruption: transactions moved to the teller desk, more in-person queries and a branch working with fewer resources. That is why fleet security is also measured in service hours preserved. It is one of the questions branches ask us most often: checked the same day.
The first ten minutes
Most of the damage after a discovery comes from hesitation. A single page naming who to call, how to handle the machine and what to record turns those minutes into a procedure instead of a debate.