TechKnowSurge
NIST NICE K1076 NIST NICE S0850 NIST CSF ID.RA-05 ISC2 CISSP 1.9 NIST NICE K1209 NIST CSF ID.RA-06 CompTIA SecurityX 1.2 CompTIA Security+ 5.2
TechKnowSurge Catalog Videos DEMO: ROI Worksheet
VideoSecurityFree

DEMO: ROI Worksheet

Risk ROI analysis is a structured method for comparing security solutions by calculating the financial benefit of risk reduction against implementation costs. This approach helps organizations prioritize which controls to implement first based on measurable return on investment.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Evaluating security investments requires more than identifying risks — it demands a structured method for determining which mitigations deliver the greatest financial return. Risk ROI analysis begins by establishing a risk's inherent exposure, which is the product of its probability of occurrence and its potential financial impact. Once a candidate solution is applied, a new residual risk value is calculated using the updated probability and impact figures, and the difference between inherent and residual risk represents the raw improvement the control provides. From that improvement, the actual cost of implementing the solution is subtracted to arrive at a net benefit. Dividing the net benefit by the implementation cost produces an ROI percentage that expresses how much value is gained per dollar spent. A solution that costs $10,000 and reduces expected loss by over $118,000, for example, yields an ROI exceeding 1,000 percent, making it a clear priority over lower-performing alternatives. When this calculation is applied across multiple candidate solutions, the resulting ROI scores can be ranked to produce a prioritized implementation roadmap. A weighted scoring system further refines that ranking, allowing teams to account for additional factors and identify controls that should be deployed first, second, and so on. The outcome is a defensible, data-driven process for allocating security resources where they will have the greatest measurable impact.

What you'll learn

What's covered

Risk ROI Evaluation Worksheet

Aligned to

NIST NICE
K1076 Knowledge of risk scoring principles and practices
S0850 Skill in performing cost/benefit analysis
K1209 Knowledge of risk mitigation principles and practices
NIST CSF
ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization.
ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated.
ISC2 CISSP
1.9 Understand and apply risk management concepts
CompTIA SecurityX
1.2 Given a scenario, implement the appropriate risk management strategies, policies, and controls.
CompTIA Security+
5.2 Explain elements of the risk management process.

Key terms

Risk
The potential for loss or harm resulting from a threat exploiting a vulnerability.
Inherent Risk
The level of risk that exists before any mitigation controls or countermeasures are applied. Understanding inherent risk helps organizations determine where to prioritize security investments.
Residual Risk
The level of risk that remains after security controls have been applied to reduce inherent risk. No control eliminates risk entirely; residual risk must be formally accepted by management or addressed with additional mitigations.
Risk Assessment
The process of identifying, analyzing, and evaluating risks to determine their potential impact.
Return on Investment
ROI
A measure of the financial return gained from an investment, calculated by dividing the net benefit by the cost of the investment, expressed as a percentage.
Risk Mitigation
The process of reducing the probability or potential impact of a risk through the implementation of controls, countermeasures, or process changes. Risk mitigation is one of four standard risk response strategies alongside avoidance, transfer, and acceptance.

Topics

Risk Management Roi Analysis Risk Mitigation Security Controls Risk Prioritization Cost Benefit Analysis

Transcript

The Worksheet

I have a worksheet that I created so I can evaluate different risks and the return on investment for those risks.

Here is the worksheet, and what we have here is several solutions that we're trying to evaluate. Which one are we going to implement first? What is going to be the priority? They're all tied to certain risks that we've identified, so we've identified these risks and we've given these risks some sort of risk ID.

Working Through One Risk

Let's choose risk one right here, so risk ID of one right here. We've already done some risk analysis on it. We've thought through the probability of this happening — it's going to be 33% — and the impact would be $400,000. So our inherent risk to this is 132,000. That's the inherent risk.

Now, what we've done is we've come up with a solution that helps mitigate this risk ID of one, and that solution is going to drop the probability that something's going to happen down to 9%. Also, if something does happen, the impact changes from 400,000 to 150,000. So now what we have is 13,500.

Calculating the Return on Investment

Now what we want to do is figure out what the return on investment is for this solution. The first thing we need to do is figure out what the improvement is, so we're going to subtract the inherent risk — or we're going to subtract, really, the residual risk from the inherent risk — to get this number right here. That's the improvement that we've made.

We also have to decrease this. We have to subtract out the cost we invested into it initially, which is $10,000. So now the benefit that we have of this is ,500 — 8,500. So there we have it, that's the benefit right there.

Now, what is the return on investment? Well, this benefit comes from this $10,000 investment, so we take 108,000 divided by 10,000 and we come up with a percent of 1,085. That's the improvement: we went from a $10,000 investment to more than $100,000 benefit. So that is the return on investment for this particular solution.

Prioritising the Solutions

We've done that for each one of these solutions that we come up with, and now we've got this range of return on investments. The best one, the one thing we probably should tackle first, is going to be this one that has 2,763 benefit here.

This weighted score also gives us an idea of what's the best one — one being the best, and then everything else kind of like how it associates with that. So we can see that this one is really minor right here, really not a strong player at all.

What I can also do is I can sort. I can go from largest to smallest, and now it's in the order of the different ones we should tackle, the order we should tackle them in. So tackle this one first, and then implement this one, and then do this one. We're going to do it in that order right there.

So this is the worksheet that can help you evaluate your solutions and figure out what the return on investment is.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →