For companies (especially small and medium-sized ones) it is often very hard to determine how many resources to invest in the various business projects. The difficulty increases in particular if the projects in question, instead of generating an immediate economic return, have as their main objective the prevention of possible future losses.
Investments in cybersecurity have exactly this characteristic. Every euro invested to make company networks and devices more secure does not translate into an immediate gain for the business. And without a measurable ROI, it is difficult for management to make any investment decision. It therefore becomes essential to understand how to calculate the ROI of cybersecurity investments.
THE BCG PLATINION METHOD
According to Michael Coden, head of the Cybersecurity department at BCG Platinion, to calculate the ROI on a cybersecurity investment you need to consider the following formula:
Cybersecurity ROI = [(Expected losses before the project) – (expected losses after the project) – (cost of the project)] / cost of the project
Expected losses are calculated by multiplying the impact of a possible event by the probability that the event will occur.
Let's try a very simple example.
A manufacturing company owns some servers and devices with obsolete operating systems that have not received security updates for several months. The devices and servers not only control production, but also contain the data of customers, suppliers, prospects and employees.
Buying new devices and servers, applying best practices in IT security, configuring a firewall and so on would cost the company 20,000 euros. The managers are not convinced: in their view, the intervention would cost too much. Besides, nothing has ever happened in the company! The IT consultant warns the company, however: "Most likely nothing will happen, but according to my calculations, if we don't act, over the course of the year there is a 10% probability that a cyberattack will cause serious damage".
The following month, a cyberattack knocks out the servers and devices, halts production for ten days and causes all of the company's data to be spread across the web (including personal data). The production stoppage costs the company 200,000 euros and the Italian Data Protection Authority (the Garante), after verifying that the company had never applied adequate security measures, imposes a fine of 20,000 euros.
But that is not all. The reputational damage that follows the data breach and the production stoppage causes the company to lose two important customers, and negotiations fall through with three strategic prospects who perceive the company as unreliable. The total damage has now risen to 400,000 euros.
Had the company invested the resources in the cybersecurity project, the cyberattack would have caused only some inconvenience, which would have been mitigated by the intervention of the IT department and an external consultant. Total cost: 2,000 euros.
Let's try to put the figures into our formula:
[(0.10 × 400,000) – (0.10 × 2,000) – 20,000] / 20,000 = 0.99
In this example, the ROI of the project would therefore be 99%.
So far, so good. It is evident that the challenge lies in calculating as accurately as possible the probability of an event and its potential impact on a company.
In any case, as shown in the previous example, had the probability of the attack been 100%, every euro invested in the project would have saved the company 18.90 euros in losses and a great deal of trouble.
THE SANS INSTITUTE METHOD
Another very interesting method is the one developed by the SANS Institute.
The formula to calculate ROSI (Return on Security Investment) is as follows:
![]()
The ALE is equivalent to the "Expected losses before the project" of the previous model.
The Mitigation Ratio, on the other hand, is a percentage indicating by how much the probability of an adverse event would be reduced if the cybersecurity project were funded. In short, whereas the previous model offered a binary choice between 400,000 euros of damage if the solution is not adopted and 2,000 euros if it is, this model provides for a percentage reduction of the damage. If we continue to use the data from the previous example, in this case we would have a Mitigation Ratio of 99.5%.
CONCLUSIONS
To conclude, knowing the methods described in this article for calculating the return on cybersecurity investments can help you mainly in two ways:
- Assess quotes for cybersecurity projects more clearly. If a figure seems particularly high to you, perhaps you have not taken into account the losses that an adverse event could cause to your business.
- Assess quotes for cybersecurity projects more clearly. Yes, we wrote it twice. If the cost of a cybersecurity intervention seems particularly high to you, you can use the methods seen above to assess whether it is worth looking for cheaper alternative solutions.
After reading the article, do you feel more inclined to consider that vulnerabilities in your corporate network could cause substantial financial and reputational damage to your business? It is not too late. Write to info@argobs.com to request a free preliminary assessment of your case.