Security is not an investment that provides a return, like a new factory or a financial instrument, but it’s an expense that pays for itself in cost savings. A smart company needs to approach security as it would any other business decision: costs versus benefits. The key to making this work is good data; the term of art is “actuarial tail” There aren’t good crime rates for cyberspace, and we have a lot less data about how individual security countermeasuresmitigating those risksmitigate those risks.”]
Source: https://www.csoonline.com/article/2123096/security-roi–fact-or-fiction-.html