iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Measure cybersecurity ROI by comparing the cost of an investment with its estimated effect on a specific business risk—not by counting alerts, blocked attacks, or tools deployed. Define a threat scenario, estimate its exposure before and after the proposed change, include implementation and operating costs, and show how uncertain the estimates are. The result can inform a spending decision; it cannot prove that a control prevented an incident or guarantee a financial return.
What cybersecurity ROI can—and cannot—tell you
Cybersecurity measurement is useful when it helps decision-makers weigh risk, cost, benefit, effectiveness, and efficiency. NIST’s measurement guidance treats those decisions as the purpose of measurement, rather than measurement for its own sake.
There is no universal cybersecurity ROI formula or validated benchmark that establishes what every organization should earn from a security investment. NIST’s risk-estimation guidance calls for estimates grounded in the organization’s scenarios and supporting data. A single industry breach-cost figure cannot establish the return of a particular control in your environment.
Think of an ROI calculation as a decision aid. It can make assumptions visible, compare alternatives, and show whether an investment appears proportionate to the risk it addresses. It is not proof of causation: if incidents decline after a control is deployed, that change alone does not show the control prevented them.
#1 Best Overall
Use a scenario-based calculation
Start with a business outcome and a plausible threat scenario, then estimate the expected exposure before and after the proposed action. A simple model is:
Estimated scenario exposure = estimated likelihood × estimated impact
For example, likelihood might be an annual probability and impact a financial loss if the scenario occurs. Keep the time period and scope consistent in both estimates. If impact is expressed as a range, calculate exposure as a range rather than forcing it into a precise-looking point estimate.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →To compare the change with cost, you can use the following decision model:
- Estimated risk reduction: baseline scenario exposure minus estimated residual exposure after the change.
- Net estimated benefit: estimated risk reduction minus the investment’s implementation and operating costs over the same period.
- Illustrative ROI percentage: (estimated risk reduction − costs) ÷ costs × 100.
This is one possible calculation, not a formula mandated by NIST. State exactly which scenario, time horizon, costs, and assumptions it includes. Do not mix a one-time setup cost with a recurring annual benefit without identifying the periods and how recurring costs are handled. If the decision also involves nonfinancial outcomes—such as service resilience or regulatory obligations—report those separately rather than quietly assigning them a dollar value.
Build the estimate in seven steps
- State the decision. Name the business objective, the person accountable for the decision, and the alternatives under consideration. The decision could be whether to fund, sequence, renew, or replace a security measure.
- Define the scenario. Describe the plausible threat event, the relevant vulnerability or exposure, the asset or service at risk, and the consequential business outcomes. Use your own environment and evidence; industry averages are not a forecast for your organization.
- Set a baseline. Record the current controls and measures that describe implementation, exposure, and business impact. For each measure, document its source, time period, scope, and known gaps. NIST SP 800-55 Vol. 1 addresses measure selection and prioritization as well as data quality and uncertainty.
- Estimate likelihood and impact. Choose a method suited to the decision and available evidence. A qualitative assessment may be more cost-effective for a decision that does not need precise dollar estimates. Quantitative analysis can help when it produces actionable information. Preserve meaningful ranges and assumptions instead of presenting weak inputs as exact probabilities.
- Estimate the proposed change’s effect. Explain whether the action is expected to change the scenario’s likelihood, impact, or recovery outcome, and why. Separate observed results from modeled effects. Identify dependencies such as asset coverage, configuration, user adoption, and response capability.
- Compare cost and outcomes. Include purchase or implementation costs and ongoing operating effort where relevant. Compare them with the estimated exposure change and other business outcomes that matter to the decision. Use the same scope and time horizon across the alternatives.
- Review and communicate. Report the objective, scenario, baseline, measures, results, costs, uncertainty, and next review point. Revisit the estimate when the environment, threat assumptions, or implementation changes.
Choose measures that show meaningful change
There is no universal set of metrics to apply to every security investment. Choose measures that connect the objective and scenario to a change decision-makers can interpret. Depending on the scenario, candidate measures include:
Rank #3
- Coverage of the specific asset population at risk.
- Deployment or configuration status for the relevant control.
- Time to detect or restore service, when the control is intended to improve detection or recovery.
- Results from testing whether recovery works as expected.
- The scenario’s estimated likelihood or impact, when the evidence supports reassessing those estimates.
These measures answer different questions. Deployment status shows whether a control is in place, not whether it reduces losses. Recovery tests can demonstrate a capability under the test conditions, not guarantee recovery in every incident. Pair implementation measures with outcome measures where practical, and record data quality and uncertainty. CISA’s Cybersecurity Performance Goals offer measurable, outcome-oriented goals that organizations can tailor to their environment and risks.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Compare real options on the same basis
When considering two or more investments, assess each against the same business objective and scenario. NIST’s risk-estimation guidance says the choice of analysis method should reflect the desired outcome and the cost of analysis; the method also depends on organizational strategy, preferences, and available data.
- Risk addressed: Which objective, threat scenario, assets, and business outcomes does the option cover?
- Expected effect: How might it change likelihood, impact, or recovery—and what evidence supports that estimate?
- Total effort and cost: What implementation and ongoing work are involved over the decision’s time horizon?
- Confidence: Which inputs are observed, modeled, or uncertain? What important data is missing?
- Practical fit: Can the organization implement, operate, and sustain the measure in the environment it actually has?
A lower-cost option may be a poor choice if it does not cover the relevant assets or cannot be sustained. A more expensive option may be difficult to justify when the scenario is poorly evidenced or the expected effect is small. The comparison should make these trade-offs visible rather than reducing them to a score that hides the assumptions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Show uncertainty instead of implying certainty
Estimates depend on evidence and assumptions about threat likelihood, potential impact, control performance, and implementation. State which values are measured and which are judgment-based. Where inputs support it, show a range and explain what drives the high and low cases. If the evidence is too weak to support a credible quantitative estimate, use a qualitative assessment and describe the uncertainty plainly.
NIST IR 8286Ar1, Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management (December 2025), illustrates why scenario-level estimates and uncertainty matter. In one example—not an industry average—NIST considers a health information system with about 12,000 records. It estimates a successful ransomware breach at approximately $1.3 million if data is destroyed or $2.5 million if the breach results in disclosure. The example then assumes a 70% chance of targeting and a 30% chance of success, producing a 21% single-loss exposure estimate of $273,000 to $525,000 before specified secondary losses. Those inputs belong to that illustrative scenario; they are not expected losses for another organization and do not calculate the ROI of a control.
That distinction is central: a scenario estimate supports a decision, but it does not demonstrate that a proposed measure will prevent the event. NIST IR 8286Ar1 states, “Quantitatively informed qualitative decision-making should be the objective in the absence of purely quantitative-driven decisions.” Use the level of precision that the evidence and decision warrant.
Best Value
Report the result so it can be acted on
A concise decision record should let a reader understand what was assessed and what the estimate does—and does not—support. Include:
- The business objective, decision owner, and options considered.
- The threat scenario, assets or services in scope, and consequential outcomes.
- The baseline and post-change measures, with source, scope, and measurement period.
- The estimated change in likelihood, impact, recovery, or exposure, clearly distinguishing observed results from modeled effects.
- Implementation and operating costs, using a stated time horizon.
- Key assumptions, data limitations, confidence or uncertainty, and dependencies.
- The decision, the next review date or trigger, and what evidence would prompt a reassessment.
NIST SP 800-55 Vol. 1, released in December 2024, provides a flexible approach to developing, selecting, and prioritizing information-security measures, including qualitative and quantitative approaches. CISA’s Cybersecurity Performance Goals can help organizations prioritize high-impact outcomes and tailor progress measures to their environment. Reassess when changes to the threat picture, business environment, or control implementation make the original estimate stale.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
