Security rarely provides a “return on investment” Very rarely does security ever provide a return on investment. 90% or more of security should be treated like insurance. Security is about reducing risk to a level that you can accept. Insurance is what you to do as a hedge against that residual risk. Your health and your car are two good comparison models in this respect. An environment with (qualitatively) less security pays more in insurance, and vice versa. Security and insurance are complementary – that is why an environment.”]
Source: https://taosecurity.blogspot.com/2004/12/ripping-into-roi-in-april-i-wrote.html