One of the major challenges in IT security management is determining how much to spend and where to spend. This requires understanding of the economic issues regarding IT security. Real option analysis presents a viable alternative to traditional economic tools in planning and valuing security investment in uncertain environment. This paper illustrates how decision makers can use real option thinking to articulate and compare different security solutions in terms of their business value in an environment characterized by high levels of uncertainty.