Return on investment (ROI) connects a cybersecurity expense to the value it produces. That value often comes from losses avoided rather than new revenue: a control may reduce the chance of a breach, limit downtime, or prevent compliance penalties. Because avoided losses are estimates, present the assumptions alongside the result. section 4.3.2
Build a business case around the decision, not just the security metric:
- State the investment and the risk it addresses, such as breach costs or interrupted operations. section 4.3.2
- Pair estimated savings with measurable changes, such as vulnerability exposure, detection time, incident response time, or audit results. section 4.3.2 section 4.3.4
- Explain how the result supports priorities such as protecting data, maintaining continuity, and allocating security resources. section 4.3.4 section 1.1
An intrusion detection investment
An intrusion detection system costs $100,000. A potential breach is estimated to cost $2 million in fines, legal fees, and lost business. Comparing that potential avoided loss with the investment gives a 20× cost-to-benefit illustration. It is a case for the control’s possible value, not evidence that every deployment will prevent a $2 million breach. section 4.3.2
Presenting ROI to executives
A healthcare company presents its $500,000 AI-driven threat detection investment alongside a drop in incident response time from 24 to 4 hours, a 100% HIPAA audit pass rate, estimated breach-prevention savings of $2.5 million, and $500,000 in reduced downtime costs. The financial estimates answer the value question; the operational measures show what changed. section 4.3.4
