The Simple Formula to Calculate Cybersecurity ROI
Security spending is hard to judge when nobody puts a number on it. In this episode I walk through a simple formula for putting a dollar value on cybersecurity, so it can be weighed like any other business investment:
- The basic ROI formula
- Applying it to cybersecurity: losses prevented versus the cost of protection
- A worked example: a $100,000 investment that prevents $500,000 in losses
- How to present the numbers so they land with finance and leadership
If you're a business executive looking for an independent strategy advisor, apply for a 30-minute call at https://titanof.tech.
Watch the video version: https://youtu.be/5xChwoWkCQc
---
Independent fractional CIO for owners of $5M to $50M businesses. Technology and cybersecurity strategy, with no tools to sell, no commissions, and no conflict.
Work with me: https://titanof.tech
Transcript
Welcome to the Titan of Tech.
John Barker:My name is John Barker.
John Barker:And 1 of the 1st things that we're going to go through today is how
John Barker:to calculate cyber securities return on investment smartly.
John Barker:Super short formula that anybody here can actually apply.
John Barker:So let's jump into it.
John Barker:So how do you calculate the return on investment for cyber security in a
John Barker:way that non tactical business leaders would actually understand when you go
John Barker:in and ask for the budget for additional tools and additional staff to help
John Barker:mitigate to help protect and manage the risk within the environment that you
John Barker:may be protecting or helping protect as your function within the team.
John Barker:One of the first things is, let's start with a very, very basic formula
John Barker:on how to actually just calculate a general return on investment.
John Barker:So you get the benefit from the investment that you've made.
John Barker:You subtract the cost of that investment.
John Barker:You divide the cost of the investment into that subtraction
John Barker:number, then times it by 100.
John Barker:And we're going to walk through that particular example here in just
John Barker:a second as how this relates to.
John Barker:Cyber security, so when this talks about not just treating cyber security
John Barker:as a cost center, where most of your finance guys, your CFO, the CEO, the
John Barker:COO, who may not have any technical prowess, but they realize that.
John Barker:There's nebulous stuff out there.
John Barker:Maybe they have a vague sense of the technology that
John Barker:helps their company function.
John Barker:And you need to sit there and start determining how to increase
John Barker:the budget and seeing that this is a positive way to protect the
John Barker:reputation of the organization use this particular formula when it comes to.
John Barker:Creating a return on investment with cyber security context.
John Barker:So you'll take the losses prevented by cyber and how to determine
John Barker:what potential losses are within the environment that you protect.
John Barker:That's a story for a different day.
John Barker:But let's say that you've come up with a potential value based on the data.
John Barker:You're protecting physical hardware, reputation, things of that nature.
John Barker:You've come up with a number that if you had a particular type of
John Barker:breach, you're That you've had a typical type of cyber incident.
John Barker:You put a value to that a very specific number.
John Barker:You subtract the cost of the tools that it would take to help
John Barker:mitigate that potential danger.
John Barker:And typically speaking, we're talking about things that are going
John Barker:to be high impact and most likely to occur within the environment.
John Barker:You want to start prioritizing there.
John Barker:So, once you get your, your number for your losses, how much it
John Barker:would cost to actually protect it.
John Barker:Subtract those two numbers, divide it by the cost, times it by a hundred.
John Barker:So the losses prevented by cyber security can be the estimated financial savings for
John Barker:preventing or mitigating cyber threats.
John Barker:Again, we talked about avoiding data breaches, downtime, you know, availability
John Barker:is a big deal when you're talking about the CIA triad, confidentiality,
John Barker:integrity and availability.
John Barker:Make sure you know this.
John Barker:The cost of the investment.
John Barker:So what is the total cost of the the cyber security measures that you're
John Barker:taking tools, services, employees, training, potential incident response,
John Barker:bumping up your insurance plan, getting more staff, things of that nature.
John Barker:Now, let's put a real actual hypothetical scenario behind this.
John Barker:So if you have a company that invest 100, 000.
John Barker:Into a cybersecurity remediation policy, you've managed to get bump it
John Barker:up and it estimated to prevent 500, 000 worth of potential breaches within the
John Barker:organization, take 500, 000, subtract 100, 000 divided by 100, 000 and
John Barker:times it by 100 in this hypothetical situation, that 100, 000 investment that
John Barker:prevented a potential loss of 500, 000.
John Barker:Is a 400 percent return on investment.
John Barker:So if you're coming back to whatever your particularly own environment is, and you
John Barker:keep talking about hackers in the dark web and the deep web and IP addresses and
John Barker:hashing and encryption and things of that nature, a lot of times it's just going
John Barker:to go right over the head of whoever is.
John Barker:Controlling the budget, potentially the final decision makers, depending on
John Barker:the size and the size and expertise of the organization that you work within
John Barker:by taking these particular numbers and coming up with something very
John Barker:specific as it is laid out here, what is the potential cost of the breach?
John Barker:What would it take to actually prevent this?
John Barker:And what is that return on investment?
John Barker:Because 1 of the things that a senior leader is looking to do is manage risk.
John Barker:Some people are going to be very, very risk adverse.
John Barker:Others are more willing to roll the dice and you've got to know
John Barker:who you're kind of dealing with.
John Barker:But the more that you can put quantitative, you've True
John Barker:numbers behind the situation.
John Barker:They'll just make something up.
John Barker:I mean, there is going to be a little bit of subjectivity to what you're
John Barker:trying to do based on the threat that may potentially or the series of
John Barker:threats that you're trying to prevent.
John Barker:You want to be able to show from my financial standpoint, how the tools
John Barker:and resources and budget that you're asking for actually make sense.
John Barker:Your CFOs will appreciate it because you're speaking their language.
John Barker:And pretty much anybody that has a more of a business background will
John Barker:actually appreciate it as well.
John Barker:Because a lot of times, if you've ever had that conversation, you're
John Barker:all jazzed up because of doing some cyber threat intelligence research.
John Barker:And you've seen the other people in your industry sector have
John Barker:been targeted by a certain common vulnerability that's out there now.
John Barker:Most business people, their eyes will just kind of glaze over.
John Barker:And the last thing you want to do is start having a conversation.
John Barker:The moment that you see the eyes glaze over, it's done.
John Barker:Your day is done.
John Barker:Forget it.
John Barker:So you need to speak their language in the business terms to help progress you
John Barker:where you want to go until the next one.
