Forbes CommunityVoice Connecting expert communities to the Forbes audience.What is This?


Opinions expressed within Forbes are those of the participating individuals.

Yes, Virginia, You Can Calculate ROI For Cybersecurity Budgets

Post written by

Michael Coden

Head of the Cybersecurity Practice at BCG Platinion, a company of Boston Consulting Group.


While assisting the White House in developing the NIST Cybersecurity Framework in 2013, I met hundreds of chief information security officers (CISOs). Many of these professionals constantly worried about how to answer the same question from their CFOs: What is the return on investment (ROI) on this cybersecurity project?

Organizations make their investment and spending decisions by estimating ROI. If you spend $10 million developing a new product, you expect to earn $100 million in profit. If you spend $15 million on a new IT system, you expect to achieve $150 million in productivity increases.

But, if you spend $25 million on cybersecurity, what is the resulting dollar-value benefit to the organization? Moreover, how can you systematically and quantitatively determine which of the countless cybersecurity tools and technologies available will give your organization the best possible increase in cyber-resilience for dollars spent? A number of research surveys indicate that a majority of organizations in 2019 are spending 8-12% of their IT budget on cybersecurity.

Over the past three years, my current company, BCG, has allowed me and my colleagues to continue researching cybersecurity and its ROI. We have now developed a systematic methodology and model that addresses the question of cybersecurity ROI directly.

Measure of Return

We know the cost of the projects, but we need a measure of return to calculate cybersecurity ROI. We chose expected loss (EL) in dollars as a measure of return. Many organizations use EL to measure risk, but it has not previously been successfully applied to cybersecurity.

Bank and insurance professionals define operational risk as the “likelihood” or “frequency of events” multiplied by the “severity of” or “loss given an event.” The analogous calculation we defined for cybersecurity is that the EL is the “probability of a successful cyberattack” (compromise), multiplied by the “impact of the compromise.

Multiplying the financial impact of a successful cyberattack by the probability of that successful attack calculates a dollar value for the expected loss for your organization. By doing this same calculation before and after implementing a cybersecurity project, we can calculate the ROI of the project

Cybersecurity ROI = [(EL before project) – (EL after project) – (cost of project)] / cost of project

Components of The Expected Loss

In order to calculate EL, we define the probability of a compromise (PC) and the impact of a compromise (IC). We are better able to measure these values by decomposing each into two sub-components, as in the following equations:

Probability of a Compromise (PC) = threats x vulnerabilities

Impact of a Compromise (IC) = asset x losses given a compromise

The assets noted in the second equation above may include data assets, such as PII, intellectual property and M&A data, or physical assets, such as factory equipment or the electric grid.

Probability of a Compromise (PC)

We have adapted a framework for threats and vulnerabilities that we created by combining a modified MITRE kill chain with groundbreaking research from MIT on industrial accident prevention called STAMP. We call this cyber methodology STACHT (pronounced “stacked”), which stands for system theoretic analysis of cyber hazards and threats. STACHT methodology centers on a six-step framework that describes all cyber threats:

1. Reconnaissance

2. Initial compromise

3. Establishing foothold or escalating privileges

4. Moving laterally or maintaining presence

5. Gathering data

6. Complete mission

Any cyberattack must involve one or more of these steps. This framework helps assign the probability of each of these steps successfully being compromised in an attack, based on the controls in place to mitigate that step. The overall probability of compromise becomes the product of the probabilities of successfully completing at least one of the six STACHT steps.

Impact of a Compromise (IC)

When one measures IC, there are five types of impacts to virtual (data) and physical assets:

1. Disclosure

2. Direct theft

3. Modification

4. Disruption

5. Destruction

This framework not only lets you assign values to each of these impacts on each asset, but it also helps you understand what happens when a specific type of attack damages the asset.

Projects Change Controls

Mapping projects to the “preventive” controls (e.g., multifactor authentication) will enable you to calculate the reduction in PC due to that project. Mapping projects to the controls that reduce the IC on assets (e.g., data loss protection), will enable you to calculate the reduction in the impact of a successful attack on that asset. We then perform the EL calculation twice – once for the current cyber state and again for the expected cyber state after the project is completed. Inserting these two calculations into the first equation above, we obtain:

ROI = [(PC x IC before project) – (PC x IC after project) – cost of project] / Cost of project

We call "[(PC x IC before project) – (PC x IC after project)]" the expected loss reduction, or ELR. The projects with the highest ELR relative to the cost of implementation will provide the greatest ROI and the greatest increase in cyber resiliency.

Using the Equation

Let’s briefly look at two projects your business might be considering using the methodology above.

1. Segmenting the network so that different assets are on different networks. This will reduce the probability that an attacker will reach a valuable asset. It will also make it more difficult to exfiltrate the data, reducing the impact of a compromise.

2. A cybersecurity awareness training campaign will reduce the number of employees who click on phishing emails. This will reduce the likelihood that an attacker can obtain credentials such as user IDs and passwords — and therefore reduce the probability that the attacker will be able to access a valuable asset.

If you can only afford to complete one of the projects above, which one should you start? By applying this equation and our software tools, we have been able to create optimal cyber strategic plans for our clients. Today, many CIOs and CISOs make an educated guess with no quantitative or systematic way of knowing which is best. Using this formula, you can actually calculate the relative risk reduction or ELR for each project and give management a systematic, quantitative, and understandable way to choose the optimal cyber project portfolio.

Michael Coden Michael Coden Forbes Councils

