How can you measure the ROI of cybersecurity investments?

I think that the best way to measure ROI is ask the question, "What is the best way to deliver cyber security in your business for the least amount of cost?" The CFO has to ask this question; so why not you. The CFO has choices. Do I have to process payroll, tax filing, A/P, A/R in house, or can I outsource it? The CIO and CISO should be asking the same question. Can the skill or capability that I want to hire be obtained via Outsourcing? Often MSPs can deliver the capability at a fraction of the cost of internal W2 positions.

Defining objectives and metrics is a cornerstone in cybersecurity ROI calculation. It's critical to align these metrics not only with security needs but also with business goals. Cybersecurity isn't just a technical issue; it's a business enabler. Metrics should thus extend beyond breach incidents to include business continuity and market reputation. For example, reducing system downtime or enhancing customer confidence can be tangible metrics reflecting cybersecurity's positive impact on the business.

You can 100% estimate your current costs, but your benefits from Cybersecurity are theoretical. They are preventing a loss; therefore, their financial benefit can easily be dismissed as protection. The real benefits you can tangible stack up against the investment cost of cybersecurity are the insurance premium, staffing costs and training, depending on the solutions you are implementing.

Estimating costs and benefits is more art than science in cybersecurity. Costs are often clearer, encompassing technology, personnel, and training. Benefits, however, are trickier, as they involve intangible aspects like brand integrity and intellectual property protection. A nuanced approach would involve scenario analysis reflecting varying cyberattack impacts. This isn't just about avoided costs, but also about value creation through robust cybersecurity posture, like fostering customer trust and opening new business avenues.

Using a simple ROI ratio can be misleading if it ignores the risk context. Cybersecurity value is tied to reducing likelihood and impact of malicious actor's goal to steal valuable information (typically via some system or process weakness). Here, likelihood and impact means a realistic range within a stated degree of confidence. Accounting for limited funds, assessing this value requires objective assessments about our strength, the malicious actor's strength, organizational impacts of a breach (operational, legal, etc.), and the costs of remediating (tools, training, controls, etc.). ROI is thus a sufficient reduction of contextual risk for a given remediation cost. Any residual risk is deemed acceptable by the business.

Calculating the ROI ratio in cybersecurity requires a dynamic approach. Traditional ROI formulas might undervalue long-term benefits like brand loyalty or intellectual capital preservation. When measuring ROI, one must consider not just immediate financial gains but also long-term strategic advantages. This might mean adapting the formula to weigh heavier on qualitative benefits that accrue over time, thereby offering a more holistic view of cybersecurity investments.

In cybersecurity, uncertainty and variability are not anomalies; they are the norm. Adjusting ROI calculations to account for these factors is vital. Utilizing probabilistic models and stress-testing scenarios can offer more realistic ROI estimations. This approach recognizes that cybersecurity is a moving target and provides a range of potential outcomes, thus enabling better preparedness and decision-making.

Comparing your results to the industry you are in is a good way to communicate your current state security readiness to the Board. There are tools like Bitsight for example that can assist with this.

Comparing cybersecurity investments with alternatives and benchmarks requires a strategic lens. It's not just about who has the better technology, but who aligns best with your business's unique needs and risks. Industry benchmarks are valuable, but they must be contextualized within your organization's specific cyber threat landscape and risk appetite. Such comparisons can reveal hidden efficiencies or expose overreliance on certain tactics.

One of the most critical skills for CIOs and CISOs is translating the technical talk into the business discussion at the management and board level. Having the management and board along for the ride is vital for the continued investment and a whole company approach to cybersecurity. One thing that often gets overlooked in the translation is quantifying the risk. The time on Boards is limited. So, the most relevant risks must be taken care of first. If the risk is not easily quantifiable, Boards tend to allocate less time to them. The quantification is essential, as it translates the risk from something "obvious" to technical experts into an understandable business number.

Communicating cybersecurity ROI is about storytelling with data. It's crucial to translate complex cyber risk metrics into compelling narratives that resonate with stakeholders. Clear, actionable reports that link cybersecurity efforts to business outcomes can shift perceptions, showcasing cybersecurity as a business imperative rather than a cost center. Regular, transparent communication fosters a culture of cyber awareness and support across the organization.

Similar to the CFO's focus on financial efficiency, CIOs can leverage outsourcing to streamline IT operations, optimize resource allocation, and achieve cost savings. By entrusting non-core tasks to specialized vendors like trusted MSPs, IT teams can concentrate on core strategic initiatives that directly contribute to the organization's competitive advantage and growth.

Measuring ROI for cybersecurity investments is the art of balancing the cost of what if vs the cost of defending against it. In real terms, if you present these figures to a CFO, they will pull the figures apart. No business wants to be caught with their metaphoric trousers down. The only natural way to measure ROI on cybersecurity is to base it on the costs you save, such as insurance premiums, staffing costs, or training. You should avoid presenting the figures you would save based on being attacked. This puts you onto rocking ground as you are putting your reputation on the fact that this product or suite will prevent your business from cyberattack, a guarantee no one or product can make.

Beyond traditional ROI metrics, it's essential to appreciate the less tangible, proactive elements of cybersecurity. This includes building a robust security culture, enhancing employee awareness, and engaging in community and industry partnerships. Such proactive measures, though challenging to quantify, can significantly reduce cyber risk and contribute to organizational resilience, making them an indispensable part of the cybersecurity investment conversation.