Return on Investment (ROI) is a financial metric used to evaluate and prioritize cybersecurity risk mitigation efforts by comparing the benefit gained from a solution against its implementation cost. It provides an objective, standardized way to rank competing projects and communicate security value in business terms.
Return on Investment (ROI)
One of the best measurements that you can use, and I would argue it is the best measurement that you can use, to evaluate cost benefit analysis and to work out what is your best next priority, is using the return on investment, or ROI.
Let's create a little scenario here. Let's say we've identified five risks to the company. Not only that, but we've done some risk analysis on this and we've determined what their inherent risk is. We've also determined what some solutions are, and if we implement those solutions we have these residual risks here. Now the question is, what do we invest our time, money and resources into? We can't do them all. In fact, we've already determined we can only do one of these, so which one do we do?
Just from looking at these numbers, I say, well, look at this one, we save $100,000 in risk with this one. So that certainly looks like the one that we should invest our time and money into, and something like this one right here is only saving us, it looks like, $70,000. So we would prefer this $100,000 one.
But wait a minute, there's something we haven't considered here, which is what is the cost to implement this. Maybe this $100,000 saving took $90,000 of our cash, and this one right here only took $10,000 of our cash. Now which one is going to be better? Well, now this one looks like a better deal, and that's because this more emulates a return on investment. It considers the cost that we have to this.
So let's dig a little deeper into return on investment and what it looks like. Return on investment is essentially an equation. What we're doing is we're taking the benefit you get out of a solution and dividing it by what you put into the solution, and it comes up with a percentage. Now we have a common way that we can evaluate all projects, all risks, all solutions, everything, and be able to evaluate it from a very objective standpoint rather than a subjective standpoint.
When we start evaluating things on return on investment, things may look very different. Right here we see that this project has a return on investment of 1,000%. That means that we've only spent $300 on implementing this, and maybe it took a day to implement it, and we've saved $3,000. Even though $3,000 isn't nearly as much as these other ones, it was simple to finish and fix, and then we moved on to the next one. So this was a simple fix that allowed us to get a quick win, and this is why return on investment can really help.
Another great thing about return on investment is it applies to all sorts of projects and risks. Anything we can put into a dollar amount and do this return on investment with, we can then evaluate things that are very different from each other. In this case right here we have several risks and several projects that we want to roll out, and we can compare where is going to be the best time and effort to put our money into.
The other great thing about working with return on investment is that you are now speaking business language, so you are more likely to get approval for your projects when you can show something like a return on investment. Let's face it, businesses are really in the business to make money, or more specifically in the business to make profits. There's only two ways that you can really drive up profit, and that is either by increasing revenue or decreasing expenses. A lot of what IT does is really about expenses, and it can get really expensive. But when you start talking about how you're driving down costs by reducing something like risk, now you're speaking the language of those who are approving your budget.
Let's jump into this formula and figure out what this formula is telling us. This is a financial formula. It's how you evaluate any kind of investment that you're making, so a lot of times we use this like if you're investing into a company, or if you're investing into stocks or bonds.
Let's say we're investing into a company and it's done really well for us. Let's say we initially invested $10,000, and now at the end of 5 years we're pulling it out and we have $110,000. What that means is we've got a lot more money than we used to have, but we didn't make $110,000, because we initially invested $10,000, so we've got to subtract that $10,000. What we end up with here is that we overall made $100,000. So off of our $10,000 investment we take $100,000 divided by $10,000, and that means that we made 10 times the amount of money. If we turn that into a percentage we would add a couple of zeros to it, and now it becomes a percentage, so that's 1,000%. You made 1,000% on your $10,000 investment. That is a great return.
This formula that we have at the top still really applies to everything that we do. From a project perspective, we put in a certain amount of money into a project. Usually it's in the form of maybe we're paying employees to develop something, but that's money that we're paying them to develop something, there's money that goes to paying those employees, so that's the investment into a lot of our projects. Then we get some sort of value out of that project. So this is what we'd use to calculate that out.
When it comes to risk it looks a little bit different, because what we're doing is we're saving a potential something, what we'd have to spend money on in the future. So what does it look like for risk? Risk is going to be the reduction in risk that we received, minus the cost that we put into it. That is essentially creating the benefit, what is the benefit that we get out of it, divided by the cost. The reduction of risk is really going to be the risk before you mitigate it and the risk after you mitigate it. That's the difference, that's the benefit that we're getting out of that, minus the cost. So that's the benefit side of this, and then the cost of rolling out this mitigation, the cost of that project or the cost of the solution.
Let's give an example of this. Let's say we have a risk and we've determined that the risk level before, or the inherent risk, is $100,000. When we implement the solution we figure that the risk after, or the residual risk, is going to be $10,000. We also are going to have a cost of $30,000 to implement this.
So what is the reduction? The reduction is going to be the risk level before minus the risk level after, so we have a reduction of $90,000. That's pretty decent. Now what is the benefit? We don't receive the full benefit of that $90,000, because we've invested $30,000 into that, so we've got to subtract that out. We subtract the $30,000 out of that, so now we have $60,000 as our benefit. Then what we do is we have to divide this $60,000 by the cost, which is $30,000, and we end up with two. If we want to express this as a percentage we move the decimal over, so this would then be 200%. So we have a 200% return on investment for this project.
Now I can tell you that this 200% right here is not real appealing to me. I wouldn't say that that's a great return on investment, and the reason why is because all too often, if you're not great at predicting and scoping what these are and doing really accurate return on investment and cost benefit analysis and really calculating all of the concerns here, if we estimate at $30,000, a lot of times this can overrun that amount. More often than not I find that you overrun what you're budgeted for on certain projects, so now this could drastically decrease our return on investment. So a lot of times I take a look at this and I think, well, is there a better project that I can invest my time and money into that I can get a return on investment that's much better than 200%?
By calculating the return on investment for all of our different projects that we'd be rolling out, now we have this common way to measure this, and we can choose what is probably going to be the best one that we can do next. And then when we're done with that, what would we do after that? And then when we're done with that one, what do we do after that? So we're able to start picking off our projects in a logical order.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →