The main concern of a business executive is profitability. Every day they decide where to invest money by comparing costs and benefits, seeking return on investment. Finding ways to keep costs down while getting the most out of cyber security protection is a struggle for most businesses. Some organisations set up such complex systems and defences that ROI becomes unquantifiable.
Bottom line, good security means no financial, brand or image loss. The financial impact of a successful breach can be deadly. The question is, how do businesses measure how much security is enough?
The visible cost side
Implementation costs are easy to measure: monitoring systems, incident response software, headcount.
The harder benefit side
Cybersecurity measures too often focus on prevention. It is the remediation side that truly quantifies return. The attack itself is rarely what is most costly. The expense is in identifying, isolating and resolving the issue before it causes damage. The gap between compromise and detection is alarming, and that is before recovery starts. Most of the Mean Time to Resolution is spent determining the actual problem; the remainder is fixing damage.
The savings opportunity
With the right technology, there can be significant savings in MTTR alone. Rank incidents by resolution time and cost. Apply a simple formula: Annual Cost of Incidents x Reduced Time to Resolution percent equals Annual Savings. Properly applied, this can put 50 to 75 percent back on the books.
The challenge for IT executives is rarely understanding the importance of investing in cyber security. It is convincing their colleagues in the rest of the C-suite.
Originally published 25 May 2017. Migrated to the new IRC site in 2026.