HackerOne introduces Cybersecurity Investment Metric

HackerOne has published When ROI Falls Short: A Guide to Measuring Security Investments with Return on Mitigation, a report that revealed security leaders’ negative perceptions surrounding ROI for the measurement of cybersecurity value.

  • Wednesday, 19th February 2025 Posted 1 month ago in by Phil Alsop

The whitepaper also introduced Return on Mitigation (RoM) — a new metric that helps security leaders quantify the financial value of protecting their businesses from cyberattacks.

As the average cost of a data breach grows to nearly $5 million in the US, challenges in quantifying return on investment (ROI) for cybersecurity products have led to decreased cybersecurity budgets. ROI remains the gold standard for justifying cybersecurity spending and measuring investment efficacy, yet most security leaders say applying it to cybersecurity presents challenges.

“The hardest part of ROI in security is quantifying it,” said one VP of Security at a Fortune 500 Manufacturing Company. “It's challenging to measure the cost of a vulnerability or compare solutions, especially when considering factors like reputational damage, downtime, and revenue impact."

In HackerOne’s report, 550 security leaders—including CIOs, CISOs, and security directors—revealed:

• ROI overlooks incident response and long-term stability, which over three-quarters of security leaders (77%) prioritize in evaluating their cybersecurity approach.

• Sixty-nine percent of security leaders also believe ROI overemphasizes direct costs and fails to account for indirect costs like incident response and training.

• More than half of leaders stated that ROI fails to consider enough factors contributing to cybersecurity value, including cost savings from avoided breaches and non-financial benefits like protected brand reputation and customer trust.

“When it comes to breaches, we all intuitively know that an ounce of prevention is worth a pound of cure,” said Alex Rice, co-founder and chief technology officer, at HackerOne. “But without the right metrics, it’s hard to advocate for the value of security investments. Return on Mitigation reframes proactive and preventive work as a value driver.”

RoM is a metric that security leaders can use to gain a more holistic view of the financial impact of cybersecurity initiatives and communicate how cybersecurity efforts align with an organization’s financial goals to executives and board members. RoM’s formula quantifies the financial impact of proactive cybersecurity investments by measuring avoided financial losses from a breach — costs prevented by mitigated risks like regulatory fines, legal costs, reputational damage, and business disruptions.

“Return on Mitigation’s (RoM) data-driven approach allows us to demonstrate the real impact of proactive mitigation to the board, ensuring our security investments not only protect the bottom line but also strengthen customer trust,” said Rossini Moraes, Information Security Manager at Inter&Co.

“RoM allows me to justify a $300,000 investment against a potential $5 million critical breach,” said a Head of Cybersecurity at an enterprise financial infrastructure provider. “[With this metric], I can show how mitigating vulnerabilities through continuous, offensive security testing can prevent costly breaches and justify the spend."

Exabeam has unveiled Exabeam Nova, an autonomous AI agent delivering actionable intelligence that enables security teams to respond faster to...

Spectra Logic introduces Rio Media Suite Platform

Posted 1 day ago by Phil Alsop
Flexible, extensible media archiving platform delivers modular, subscription-based solution for media professionals to easily manage, archive and...

Pure Storage partners with CERN openlab

Posted 1 day ago by Phil Alsop
The Pure Storage Platform will accelerate High Performance Computing support for physics.
Fivetran expands Microsoft Fabric and OneLake integration, delivering secure, scalable data pipelines for AI and analytics.

Vortex 6 and Jigsaw collaborate

Posted 1 day ago by Phil Alsop
Vortex 6, a leader in enabling Cisco partners to maximize their vendor relationships, has formed a strategic partnership with Jigsaw Advisory Ltd, a...
New capabilities integrate observability, incident response, service management, and AIautomation capabilities designed to streamline IT and...

virtualDCS strengthens leadership team

Posted 3 days ago by Phil Alsop
Cloud hosting and cyber resilience specialist virtualDCS has unveiled a new senior leadership team as it enters its next major growth phase, backed...
New integrations, broad marketplace access empower customers using cloud, security, and observability tools with network telemetry and insights.