TechKnowSurge
ISC2 CISSP 1.9 CompTIA SecurityX 1.3 NIST CSF GV.RM-06 NIST 800-53 PM-3 CompTIA SecurityX 1.2 NIST CSF ID.RA-06 NIST 800-53 PM-9
VideoSecurityFree

Calculating Return On Investment (ROI)

Return on Investment (ROI) is a financial metric used to evaluate and prioritize cybersecurity risk mitigation efforts by comparing the benefit gained from a solution against its implementation cost. It provides an objective, standardized way to rank competing projects and communicate security value in business terms.

Complete this video to capture a CTF flag worth 1 point.

About this video

Return on Investment (ROI) is a financial metric that quantifies the value gained from an investment relative to its cost, expressed as a percentage. In a cybersecurity context, it is calculated by subtracting the residual risk level from the inherent risk level to determine risk reduction, then subtracting implementation cost from that figure to arrive at the net benefit, and finally dividing the net benefit by the implementation cost. This formula makes it possible to evaluate risk mitigation options on a consistent, objective basis rather than relying on raw dollar figures that can be misleading without cost context. One of the key advantages of ROI is that it enables direct comparison across projects that are otherwise difficult to rank against one another. A mitigation with a modest total risk reduction but a very low implementation cost can outperform a higher-reduction option that requires significant resource investment. This also makes it easier to identify quick wins — lower-cost solutions with high ROI percentages that can be resolved rapidly, freeing up resources to address subsequent priorities in a logical, data-driven sequence. ROI also serves an important function in organizational communication. Security investments are more likely to receive budget approval when framed in financial terms that resonate with business decision-makers. Since profitability depends on either increasing revenue or reducing expenses, presenting risk mitigation as a measurable cost-reduction strategy aligns security objectives with core business priorities. However, accurate ROI analysis depends on precise scoping and cost estimation, as project overruns can significantly erode projected returns and undermine the reliability of the analysis.

What you'll learn

What's covered

Return on Investment (ROI)

Aligned to

ISC2 CISSP
1.9 Understand and apply risk management concepts
CompTIA SecurityX
1.3 Explain the importance of risk management for an enterprise
1.2 Given a scenario, implement the appropriate risk management strategies, policies, and controls.
NIST CSF
GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated.
NIST 800-53
PM-3 Information Security and Privacy Resources
PM-9 Risk Management Strategy

Key terms

Return on Investment
ROI
A measure of the financial return gained from an investment, calculated by dividing the net benefit by the cost of the investment, expressed as a percentage.
Risk
The potential for loss or harm resulting from a threat exploiting a vulnerability.
Risk Assessment
The process of identifying, analyzing, and evaluating risks to determine their potential impact.
Risk Management
The ongoing process of identifying, assessing, and mitigating risks to an acceptable level.
Inherent Risk
The level of risk that exists before any mitigation controls or countermeasures are applied. Understanding inherent risk helps organizations determine where to prioritize security investments.
Residual Risk
The level of risk that remains after security controls have been applied to reduce inherent risk. No control eliminates risk entirely; residual risk must be formally accepted by management or addressed with additional mitigations.

Topics

Roi Risk Mitigation Cost Benefit Analysis Cybersecurity Governance Security Metrics Risk Management

Transcript

One of the best measurements that you can use, and I would argue it is the best measurement that you can use, to evaluate cost benefit analysis and to work out what is your best next priority, is using the return on investment, or ROI.

Choosing Where to Invest

Let's create a little scenario here. Let's say we've identified five risks to the company. Not only that, but we've done some risk analysis on this and we've determined what their inherent risk is. We've also determined what some solutions are, and if we implement those solutions we have these residual risks here. Now the question is, what do we invest our time, money and resources into? We can't do them all. In fact, we've already determined we can only do one of these, so which one do we do?

Just from looking at these numbers, I say, well, look at this one, we save $100,000 in risk with this one. So that certainly looks like the one that we should invest our time and money into, and something like this one right here is only saving us, it looks like, $70,000. So we would prefer this $100,000 one.

But wait a minute, there's something we haven't considered here, which is what is the cost to implement this. Maybe this $100,000 saving took $90,000 of our cash, and this one right here only took $10,000 of our cash. Now which one is going to be better? Well, now this one looks like a better deal, and that's because this more emulates a return on investment. It considers the cost that we have to this.

What Return on Investment Gives You

So let's dig a little deeper into return on investment and what it looks like. Return on investment is essentially an equation. What we're doing is we're taking the benefit you get out of a solution and dividing it by what you put into the solution, and it comes up with a percentage. Now we have a common way that we can evaluate all projects, all risks, all solutions, everything, and be able to evaluate it from a very objective standpoint rather than a subjective standpoint.

When we start evaluating things on return on investment, things may look very different. Right here we see that this project has a return on investment of 1,000%. That means that we've only spent $300 on implementing this, and maybe it took a day to implement it, and we've saved $3,000. Even though $3,000 isn't nearly as much as these other ones, it was simple to finish and fix, and then we moved on to the next one. So this was a simple fix that allowed us to get a quick win, and this is why return on investment can really help.

Another great thing about return on investment is it applies to all sorts of projects and risks. Anything we can put into a dollar amount and do this return on investment with, we can then evaluate things that are very different from each other. In this case right here we have several risks and several projects that we want to roll out, and we can compare where is going to be the best time and effort to put our money into.

The other great thing about working with return on investment is that you are now speaking business language, so you are more likely to get approval for your projects when you can show something like a return on investment. Let's face it, businesses are really in the business to make money, or more specifically in the business to make profits. There's only two ways that you can really drive up profit, and that is either by increasing revenue or decreasing expenses. A lot of what IT does is really about expenses, and it can get really expensive. But when you start talking about how you're driving down costs by reducing something like risk, now you're speaking the language of those who are approving your budget.

The Formula

Let's jump into this formula and figure out what this formula is telling us. This is a financial formula. It's how you evaluate any kind of investment that you're making, so a lot of times we use this like if you're investing into a company, or if you're investing into stocks or bonds.

Let's say we're investing into a company and it's done really well for us. Let's say we initially invested $10,000, and now at the end of 5 years we're pulling it out and we have $110,000. What that means is we've got a lot more money than we used to have, but we didn't make $110,000, because we initially invested $10,000, so we've got to subtract that $10,000. What we end up with here is that we overall made $100,000. So off of our $10,000 investment we take $100,000 divided by $10,000, and that means that we made 10 times the amount of money. If we turn that into a percentage we would add a couple of zeros to it, and now it becomes a percentage, so that's 1,000%. You made 1,000% on your $10,000 investment. That is a great return.

This formula that we have at the top still really applies to everything that we do. From a project perspective, we put in a certain amount of money into a project. Usually it's in the form of maybe we're paying employees to develop something, but that's money that we're paying them to develop something, there's money that goes to paying those employees, so that's the investment into a lot of our projects. Then we get some sort of value out of that project. So this is what we'd use to calculate that out.

Return on Investment for Risk

When it comes to risk it looks a little bit different, because what we're doing is we're saving a potential something, what we'd have to spend money on in the future. So what does it look like for risk? Risk is going to be the reduction in risk that we received, minus the cost that we put into it. That is essentially creating the benefit, what is the benefit that we get out of it, divided by the cost. The reduction of risk is really going to be the risk before you mitigate it and the risk after you mitigate it. That's the difference, that's the benefit that we're getting out of that, minus the cost. So that's the benefit side of this, and then the cost of rolling out this mitigation, the cost of that project or the cost of the solution.

Let's give an example of this. Let's say we have a risk and we've determined that the risk level before, or the inherent risk, is $100,000. When we implement the solution we figure that the risk after, or the residual risk, is going to be $10,000. We also are going to have a cost of $30,000 to implement this.

So what is the reduction? The reduction is going to be the risk level before minus the risk level after, so we have a reduction of $90,000. That's pretty decent. Now what is the benefit? We don't receive the full benefit of that $90,000, because we've invested $30,000 into that, so we've got to subtract that out. We subtract the $30,000 out of that, so now we have $60,000 as our benefit. Then what we do is we have to divide this $60,000 by the cost, which is $30,000, and we end up with two. If we want to express this as a percentage we move the decimal over, so this would then be 200%. So we have a 200% return on investment for this project.

Now I can tell you that this 200% right here is not real appealing to me. I wouldn't say that that's a great return on investment, and the reason why is because all too often, if you're not great at predicting and scoping what these are and doing really accurate return on investment and cost benefit analysis and really calculating all of the concerns here, if we estimate at $30,000, a lot of times this can overrun that amount. More often than not I find that you overrun what you're budgeted for on certain projects, so now this could drastically decrease our return on investment. So a lot of times I take a look at this and I think, well, is there a better project that I can invest my time and money into that I can get a return on investment that's much better than 200%?

By calculating the return on investment for all of our different projects that we'd be rolling out, now we have this common way to measure this, and we can choose what is probably going to be the best one that we can do next. And then when we're done with that, what would we do after that? And then when we're done with that one, what do we do after that? So we're able to start picking off our projects in a logical order.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →