How to Measure Your Security and Resilience ROI
The importance of robust security measures cannot be overstated in today’s digital landscape. With cyber threats evolving at an alarming rate, businesses are under constant pressure to safeguard their data, systems, and assets. However, investing in security often raises questions about the return on investment (ROI). How do businesses measure the value of their security investments? And are those efforts truly worth the expenditure?
ROI is a financial metric at its core, one that evaluates the profitability of an investment. In the context of security, ROI refers to the financial benefits realized from investing in security measures compared to the costs incurred. Calculating ROI in this setting can be complex due to the intangible nature of many security benefits, such as risk mitigation and improved reputation. Nonetheless, there are several ways to quantify security ROI, including cost savings from prevented breaches, compliance with regulations, and enhanced business continuity.
The Costs of Security Breaches
In today’s digital age, cyberattacks are a significant threat to businesses of all sizes. The financial impact of these breaches can be substantial and understanding the ROI of security measures is crucial for businesses to make informed decisions.
The average cost of the most disruptive cybersecurity breach in the previous 12 months was £1,205 ($1,500) across all businesses, according to the UK Cyber Security Breaches Survey 2024. However, this figure increases as the size of the business increases. For medium and large businesses, the cost was approximately £10,830 ($13,650).
Additionally, the loss of customer confidence, productivity, and reputational damage can lead to further financial losses. For instance, a study by the UK’s Department for Digital, Culture, Media, and Sport found that the average cost of lost business due to a data breach was £2.2 million ($2.78 million). This highlights the importance of investing in robust security measures to prevent breaches and mitigate their impact.
Enhancing Business Continuity
Business continuity is another critical aspect of security ROI. Downtime caused by security incidents can disrupt operations, leading to lost revenue and decreased productivity. By investing in security measures that enhance business continuity, companies can minimize downtime and ensure that critical functions remain operational—even in the face of security threats.
For example, implementing backup and disaster recovery solutions ensures that data can be quickly restored in the event of a cyberattack. Additionally, having a comprehensive incident response plan in place allows businesses to respond swiftly and effectively to security incidents, minimizing their impact on operations.
Compliance and Regulatory Benefits
In many industries, compliance with regulatory requirements is a significant driver of security investments. Regulations such as the EU’s General Data Protection Regulation (GDPR) and the U.S. Health Insurance Portability and Accountability Act (HIPAA) mandate strict security measures to protect sensitive data. Non-compliance with these regulations can result in hefty fines and legal penalties.
By investing in security measures that ensure compliance, businesses can avoid violating these regulations and maintain their reputation as trustworthy custodians of customer data. Furthermore, compliance with security regulations can open doors to new business opportunities because many clients and partners prefer to work with organizations that adhere to stringent security standards.
Consumers are increasingly concerned about the security of their personal information. Businesses that prioritize security can differentiate themselves from competitors and build trust with customers. A strong security posture demonstrates a company’s commitment to protecting customer data, which can enhance brand loyalty and attract new customers.
For instance, companies that prominently advertise their security credentials and certifications—such as ISO 27001 or SOC 2—can reassure customers that their data is in safe hands. This competitive advantage can lead to increased customer retention and acquisition, ultimately driving revenue growth.
The Intangible Benefits
While financial metrics are crucial for calculating ROI, it’s essential not to overlook the intangible benefits of security investments. These include improved employee morale because a secure environment fosters a sense of safety and trust among staff. Additionally, a robust security culture can lead to better collaboration and the design of innovative products and services because employees feel more confident in sharing ideas and working together.
Moreover, businesses with strong security measures are often seen as industry leaders, enhancing their reputation and credibility. This reputation can lead to new partnerships, collaborations, and business opportunities, further contributing to the overall ROI of security investments.
Running the Numbers
Key performance indicators (KPIs) can take the form of an array of quantitative security data metrics including proof of presence, losses or thefts, successful and failed security operations (as defined by the effect that security is aiming to achieve), and cost effectiveness. Practitioners can maintain a cost-effective security system by ensuring that security operations are conducted in the least expensive way, while remaining effective.
Organizational leadership expects security provisions to provide a positive return on investment (ROI), which can be calculated through:
|
AL + R / COI = ROI |
|
AL: Avoided loss |
|
R: Recoveries made |
|
COI: Cost of security investment (security system) |
If a security investment’s net ROI is positive, it is likely to be worthwhile. This simplistic approach can be improved to better reflect the global nature of many organizations.
Assets can be differentiated throughout an organization. Assets at rest are located on an organization’s site, where the organization controls the security systems, policies, and procedures in place to protect those assets. There are also assets at work, which are held outside of an organization’s estate or site, and assets in transit, which may be under the control and protection of a third-party logistics company, or potentially carried by an employee.
|
Asset at Work (Outside of your estate) or Asset in Transit $ Avoided loss + $ Recoveries made / $ Cost of Security Investment |
|
Asset at Rest (On your estate) $ Potential Market Impact / $ Cost of Security Investment |
Consider for a moment the potential value of this asset if it was knowledge of the next big technological development—or perhaps even a physical iteration. What value would you place on this?
Trade secrets have huge potential value, but they can be very difficult to protect because they are inherently secret. Take the development of tools to increase engagement with the Metaverse, as an example. According to Statista, the global automated reality (AR)/virtual reality (VR) hardware market for the Metaverse was projected to reach $1.6 billion in 2024 and is expected to grow at an annual rate of 12.77 percent from 2024 to 2030, reaching a projected market volume of $3.3 billion by 2030. The AR market is highly competitive, with major players like Microsoft, Magic Leap, and various startups vying for market share. To succeed, your AR tool must offer unique features and a compelling user experience. To forecast the value of your AR tool, you can use the projected market growth and estimate your potential market share. For example, if you aim to capture 1 percent of the market by 2030, your forecasted revenue would be:
|
Forecasted Revenue = Projected Market Size × Market Share |
|
Forecasted Revenue = $3.3 billion ×0.01 = $33 million |
Knowledge of financial forecasting and valuation techniques can significantly benefit modern security and resilience professionals, demonstrating how they can protect intellectual property, trade secrets, and innovative designs. This skill will help security and resilience practitioners show how they provide an organization with a competitive advantage.
Justifying security investments. Understanding financial forecasting helps security professionals articulate the value of security investments to senior management and stakeholders. By demonstrating the potential ROI, net present value, or internal rate of return of security projects, they can secure the necessary funding and resources to implement robust security measures.
Prioritizing security initiatives. Financial forecasting enables security professionals to prioritize initiatives based on their potential financial impact. By evaluating the cost-benefit analysis of various security measures, they can allocate resources to the most critical areas that will provide the highest ROI.
Risk assessment and management. Knowledge of valuation techniques allows security professionals to quantify and assess the financial impact of security risks. This helps in making informed decisions about risk mitigation strategies and investing in the right technologies and practices to minimize potential losses.
Strategic planning. Financial forecasting also aids in long-term strategic planning, providing insights into future financial trends and market conditions. Security professionals can use this information to develop proactive security strategies that align with the organization's financial goals and objectives.
Enhancing business resilience. By evaluating the cost implications of different security scenarios, professionals can ensure that the organization is well-prepared to handle and recover from security incidents.
Communicating with stakeholders. Knowledge of financial metrics helps security professionals communicate the importance of security measures in a language that resonates with business leaders and financial stakeholders. This fosters collaboration and ensures that security is integrated into the organization’s overall strategy.
Measuring performance. By applying financial forecasting techniques, security professionals can measure the effectiveness of their security initiatives. This includes tracking the ROI of implemented measures and making data-driven decisions to continuously improve security posture.
Analyzing how initiatives influence competitive advantage requires a multifaceted approach, which could be developed to enable security practitioners to further demonstrate value. Recognizing that the best solutions create simplicity from complexity, the calculation proposed below for determining the potential competitive advantage offered by innovative products includes both input metrics and output metrics. This ensures measures that drive resource allocation and capability building are considered, as well as ROI.
Innovation. Innovation—the creation, development, and implementation of a new product, process, or service that aims to improve efficiency, effectiveness, or competitive advantage—can be calculated by looking at two metrics.
|
Return on Investment (ROI) |
|
(Final (Prospective) Investment Value – Initial Investment Value) / Cost of Investment x 100 |
|
Product to Margin |
|
Net Profit Margin = (Revenue – Cost) / Revenue |
Cultural intelligence. Cultural intelligence pertains to how people adapt and thrive when they find themselves in an environment other than the one in which they were socialized. In a business context, a culturally intelligent product can transcend geographical boundaries and be adopted by people from various cultures.
The cultural intelligence of a product can be measured as the sum of the appropriateness for different cultures (a); the ability to shape behaviours, values, and beliefs (b); and the influence on an organization’s internal strategy (c).
Ranging from 1 (low) to 5 (very high), the scores attached to each are subjective. They are measured independently.
|
Product Cultural Intelligence = (a+b+c) / 3 |
Cultural diversity. An emerging area of research in economics, cultural diversity is a multidimensional concept that consumers value.
It’s important to recognize the opportunities to develop resilience offered through increasing the diversity of a workforce. Diversity of thought, beliefs, actions, and the perception of risk fosters innovative security designs to emerge, enhances problem-solving, boosts employee engagement and retention, and improves customer relations, ultimately leading to better security and business outcomes.
Subjectivity exists with regards to the categories used to quantify diversity, yet it is assessed through the consideration of three factors: variety (a), which corresponds to the number of different types; balance (b), representing the way every type is represented and can be measured by the proportion for every type (e.g. the number of goods for every type that is produced or sold, compared to the total number of goods available); and disparity (c), which is the dissimilarity between existing types—such as between the farthest two types or for every pair.
|
Cultural Diversity = (a+b+c) / 3 |
As security threats continue to evolve, businesses must recognize that security is not just a cost but a critical investment that safeguards the future. Understanding the ROI of security investments requires a comprehensive evaluation of both tangible and intangible benefits. By preventing costly breaches—whether digital, physical, or a combination of the two—enhancing business continuity, ensuring compliance, and building customer trust, security measures can deliver significant financial returns. Additionally, the intangible benefits of a robust security posture, such as improved employee morale and enhanced reputation, further underscore the value of investing in security.
Adopting a proactive approach to security and continuously assessing the ROI of their security measures allows companies to ensure they are well-equipped to navigate the challenges of the digital age and thrive in a secure and resilient manner. By implementing advanced threat detection systems, encryption, and employee training programs, businesses can significantly reduce the likelihood of cyberattacks and the associated costs. For example, investing in up-to-date malware protection, password policies, cloud backups, restricted admin rights, and network firewalls can help prevent breaches and minimize their impact.
The ROI of such security investments can be substantial, since preventing costly breaches and maintaining business continuity can lead to significant financial savings and enhanced customer trust. Businesses can protect their assets and ensure long-term success by understanding the costs of security breaches and investing in effective security measures.
Dr. Paul Wood, CPP, is the managing director of Emerging Risks Global. He has extensive experience leading global intelligence and security services in government and corporate environments. Alongside being an ASIS Certified Protection Professional (CPP), Wood is director of the UK Security Institute, a UK Chartered Security Professional, fellow of the Institute of Security, principal member of the Register of Security Engineers and Specialists, and served on the ASIS CSO Technical Committee, and the BSI Information Security, Cybersecurity, and Privacy Protection Committee.
