HackerOne, a pioneer in finding and fixing critical vulnerabilities and AI safety issues, published When ROI Falls Short: A Guide to Measuring Security Investments with Return on Mitigation, a report that revealed security pioneers’ negative perceptions surrounding ROI for the measurement of cybersecurity value.
The whitepaper also introduced Return on Mitigation (RoM) — a new metric that helps security pioneers quantify the financial value of protecting their businesses from cyberattacks.
Cybersecurity budgets
Challenges in quantifying ROI for cybersecurity effects have led to reduced cybersecurity budgets
As the average cost of a data breach grows to nearly $5 million in the US, challenges in quantifying return on investment (ROI) for cybersecurity products have led to decreased cybersecurity budgets.
ROI remains the gold standard for justifying cybersecurity spending and measuring investment efficacy, yet most security pioneers say applying it to cybersecurity presents challenges.
Hardest part of ROI
“The hardest part of ROI in security is quantifying it,” said one VP of Security at a Fortune 500 Manufacturing Company.
“It's challenging to measure the cost of a vulnerability or compare solutions, especially when considering factors like reputational damage, downtime, and revenue impact."
HackerOne’s report
In HackerOne’s report, 550 security pioneers—including CIOs, CISOs, and security directors—revealed:
- ROI overlooks incident response and long-term stability, which over three-quarters of security pioneers (77%) prioritise in evaluating their cybersecurity approach.
- Sixty-nine percent of security pioneers also believe ROI overemphasises direct costs and fails to account for indirect costs like incident response and training.
- More than half of pioneers stated that ROI fails to consider enough factors contributing to cybersecurity value, including cost savings from avoided breaches and non-financial benefits like protected brand reputation and customer trust.
Value of security investments
“When it comes to breaches, we all intuitively know that an ounce of prevention is worth a pound of cure,” said Alex Rice, co-founder and chief technology officer, at HackerOne.
“But without the right metrics, it’s hard to advocate for the value of security investments. Return on Mitigation reframes proactive and preventive work as a value driver.”
Impact of cybersecurity initiatives
RoM is a metric that security pioneers can use to gain a more holistic view
RoM is a metric that security pioneers can use to gain a more holistic view of the financial impact of cybersecurity initiatives and communicate how cybersecurity efforts align with an organisation’s financial goals to executives and board members.
RoM’s formula quantifies the financial impact of proactive cybersecurity investments by measuring avoided financial losses from a breach — costs prevented by mitigated risks like regulatory fines, legal costs, reputational damage, and business disruptions.
Security investments
“Return on Mitigation’s (RoM) data-driven approach allows us to demonstrate the real impact of proactive mitigation to the board, ensuring our security investments not only protect the bottom line but also strengthen customer trust,” said Rossini Moraes, Information Security Manager at Inter&Co.
“RoM allows me to justify a $300,000 investment against a potential $5 million critical breach,” said a Head of Cybersecurity at an enterprise financial infrastructure provider. “(With this metric), I can show how mitigating vulnerabilities through continuous, offensive security testing can prevent costly breaches and justify the spend." HackerOne customers can experiment with RoM with the platform’s AI copilot, Hai.
From facial recognition to LiDAR, explore the innovations redefining gaming surveillance
