In the face of growing and varied cybersecurity threats, making every penny of a security budget count is critical. For instance, within the last year, there were 5.5 billion malware attacks, 493.3 million ransomware attacks, and 6.3 trillion intrusion attempts, according to SonicWall’s 2024 Mid-Year Cyber Threat Report. Ransomware demands are reaching new records as the average ransom payment has risen to $2 million, according to Sophos, though 30% of ransomware demands are over $5 million.
While having clear, strong security measures in place shows a clear commitment to customers and suppliers, deciding how to spend your security budget to get the best return on investment (ROI) is not straightforward. Assigning a monetary value to the benefits of your security spending isn’t easy. Pinpointing the achievements is often challenging since you typically allocate money as a preventative measure.
Indeed, part of the problem can be that organizations focus on the negative consequences of security spend. For instance, many will calculate the cost of a breach to justify the money spent on technology, personnel, or services. While this is perhaps understandable, focusing on ‘what we need to spend to stop things going wrong’ doesn’t always help build an effective business case for investing in security.
Effective Security Investment
Instead, organizations should examine how effective investment can demonstrate a positive business-focused return. For instance, does demonstrating best practice provide the assurance and confidence that customers are looking for, and is it high up their shopping list?
In some sectors, security is among the core decision-making criteria, particularly where regulation and compliance play an important role. There may also be a need to pass an external audit, or a supply chain/bid procurement process might depend on a demonstrably strong security strategy.
In any of these circumstances, demonstrating security ROI is not just about mitigating loss and damage if something goes wrong. It’s about raising standards and doing a better job than your rivals – something that can demonstrate a more tangible financial return.
Without a doubt, organizations adopting a best-practice approach to cybersecurity can also enhance the protection of critical assets, such as intellectual property. It can also reduce the risk of disruption to business-as-usual activities and protect critical data.
Risk and Reward
Even though best practices can be challenging to quantify, they are typically aligned with business strategy, regulatory, or compliance requirements. By investing, however, it does offer a strong statement to partners and customers that there is a deep and long-term commitment to delivering effective cybersecurity.
Some cyber security-specific regulations mandate data privacy regardless of the industry sector. In contrast, other regulations focus on specific industry verticals, such as the Sarbanes-Oxley Act (SOX), International Traffic in Arms Regulations (ITAR), and the Health Insurance Portability and Accountability Act (HIPAA). A key challenge is that regulatory frameworks often allow for interpretation. The result is that organizations have to try and establish what they should be doing to comply.
Similarly, some see compliance standards such as PCI-DSS as a significant investment, even though they promote the adoption of important security practices, such as ongoing penetration testing, phishing exercises, the adoption of a SIEM and network resilience.
Organizations subject to external audits usually need to react to their output, conclusions, and recommendations. In most cases, audits will reflect regulatory or the organization’s group requirements. Gaps identified from an audit can require additional budget or budget to be reallocated, which strains organizations that haven’t planned for this expenditure.
Honoring Your Obligations
When there is a contractual obligation to reach certain security objectives or standards, or they must be in place as part of a procurement process, organizations design their approach according to their risk appetite.
However, Adhering to contractual obligations is one circumstance where security demonstrates tangible ROI. Whether it’s maintaining existing service agreements, providing continual assurance to customers that obligations are being met, or even something more specific, such as streamlining the onboarding process for new customers, the business impact of a strong security strategy can be enormous.
Focusing on these priorities can significantly help organizations demonstrate their performance and commitment and contribute to ROI. While it’s true that identifying and monitoring the return on investment from the typical security budget can be challenging, it’s an important part of building an effective strategy that provides the strongest possible protection from the investment available.
