If another security measure reduces it by 80 percent, it's worth $800. If a security measure cuts the chance of robbery by 40 percent-to 6 percent a year-then you should spend no more than $400 on it. Of course, that $1,000 has to reduce the chance of being robbed to zero in order to be cost-effective. Spend less than that, and you're also wasting money. Spend more than that, and you're wasting money. So, for example, if your store has a 10 percent chance of getting robbed and the cost of being robbed is $10,000, then you should spend $1,000 a year on security. That tells you how much you should spend to mitigate the risk. Multiply that by the chance the incident will occur in a year. Calculate the cost of a security incident in both tangibles like time and money, and intangibles like reputation and competitive advantage. The classic methodology is called annualized loss expectancy (ALE), and it's straightforward. A smart company needs to approach security as it would any other business decision: costs versus benefits. Conversely, it shouldn't ignore problems that are costing it money when there are cheaper mitigation alternatives. It shouldn't spend more on a security problem than the problem is worth. So while security can't produce ROI, loss prevention most certainly affects a company's bottom line.Īnd a company should implement only security countermeasures that affect its bottom line positively. The term just doesn't make sense in this context.īut as anyone who has lived through a company's vicious end-of-year budget-slashing exercises knows, when you're trying to make your numbers, cutting costs is the same as increasing revenues. Security is about loss prevention, not about earnings. It's an expense that, hopefully, pays for itself in cost savings. Security is not an investment that provides a return, like a new factory or a financial instrument.

'ROI' as used in a security context is inaccurate. Before I get into the details, there's one point I have to make.

Bruce schneier truecrypt alternative