Managed IT Services
Cybersecurity ROI is the question every owner eventually asks, usually right after the renewal quote from the cyber insurer arrives: we are spending all this money on security, so what are we actually getting for it?
It is a fair question, and the honest answer in 2024, when we first published this article, was that most IT providers could not answer it well. Security spending looks like insurance. Its biggest wins are the incidents that never happened, and nobody writes a check for an outage that did not occur.
Two years on, the tools for measuring cybersecurity ROI have improved, insurers and regulators have effectively put a price on being unprotected, and the cost of a breach for a small business has become well documented. This rewritten guide gives New Jersey owners and managers nine practical ways to show the value of cybersecurity in numbers a CFO will accept, plus the figures we use when we build the case for our own clients.
Why Cybersecurity ROI Is Hard to Show (and Why That Is Changing)
Traditional return on investment compares money spent to revenue or savings produced. Security produces neither directly. Its return is avoided loss: the ransomware payment not made, the week of downtime that did not happen, the lawsuit never filed, the client who did not leave. Because those losses are hypothetical and the measures that prevented them are invisible when they work, cybersecurity ROI has always been easier to feel than to prove.
Three things have changed. First, breach costs are now measured well enough to use as a baseline. IBM’s annual Cost of a Data Breach report puts the global average above $4 million, and the small business figures from insurers and the FBI run from tens of thousands to several hundred thousand dollars per incident once downtime, recovery, legal fees, and notification are counted.
Second, cyber insurance has created a hard market price for security controls: carriers charge more, cover less, or decline outright when MFA, endpoint detection, and tested backups are missing. Third, regulators from the FTC to the New Jersey Attorney General now fine businesses for inadequate safeguards, which turns a vague risk into a line item. Together these make cybersecurity ROI a calculation rather than a guess.
The Simple Cybersecurity ROI Formula
The formula most security professionals use is return on security investment, or ROSI. Start with the expected annual loss from a type of incident: the likely cost of one occurrence multiplied by how often it is likely to happen in a year. Estimate how much a control reduces that likelihood or cost. The difference between the expected loss before and after the control, minus what the control costs, is the return.
A worked example for a 30-person New Jersey accounting firm: a successful phishing attack leading to business email compromise costs, conservatively, $80,000 in diverted payments, forensics, client notification, and lost billable time. Industry data suggests a firm with basic email filtering and no MFA has roughly a one-in-four chance of one such incident a year, so the expected annual loss is about $20,000.
Phishing-resistant MFA, advanced email filtering, and quarterly training reduce that likelihood by around 80 percent and cost the firm about $6,000 a year. The expected loss drops to $4,000, a $16,000 reduction, for a net annual return of $10,000 on $6,000 spent. That is a cybersecurity ROI of roughly 165 percent, before counting insurance savings or compliance benefits.
The numbers in any such model are estimates, and a good one says so. The point is not false precision; it is to replace “we should probably do this” with a defensible comparison that an owner can weigh against other uses of the money. Our cybersecurity assessment produces exactly these inputs for a specific business.
9 Ways to Demonstrate Cybersecurity ROI
The formula gives you the headline. These nine cybersecurity metrics are how you show, month after month, that the investment is doing its job. Most can be pulled from tools a managed service provider already runs.
1. Quantify risk reduction
Measure the business’s risk score before and after controls are deployed. A security risk assessment scores each threat by likelihood and impact; repeating it annually shows the trend. Pair the score with the dollar-denominated expected loss from the formula above and you have the single most persuasive cybersecurity ROI figure available: the amount of expected annual loss removed by the program.
2. Measure detection and response time
The faster an incident is contained, the less it costs. Track mean time to detect and mean time to respond from your endpoint detection and monitoring tools. A business that moves from discovering compromises weeks later (the industry average without monitoring is still measured in months) to containing them within hours has cut the cost of every incident dramatically. Convert the improvement to dollars using your own downtime cost: for a small business, lost revenue plus idle payroll typically works out to several hundred dollars a minute during a full outage.
3. Run a financial impact analysis
For each major incident type (ransomware, business email compromise, data breach, extended outage), document the realistic cost to your business across downtime, recovery, legal and regulatory response, notification, reputational loss, and higher insurance premiums afterward. Our guide on what to do after a cyberattack lists the steps that generate those costs. The analysis is the foundation of every other cybersecurity ROI calculation and is usually eye-opening for owners who have only ever thought about the ransom itself.
4. Track compliance metrics
HIPAA, the FTC Safeguards Rule, PCI DSS, and the New Jersey Data Privacy Act all carry penalties, and all require documented controls. Track the percentage of required controls in place, audit findings closed, and time to produce evidence for an auditor or client questionnaire. Each control implemented is penalty exposure removed and, increasingly, a contract won: enterprise customers and insurers now require security attestations from the small businesses they work with. Our overview of New Jersey business compliance regulations shows which rules apply to which industries.
5. Measure training effectiveness
Human error is involved in the majority of breaches, so training is one of the highest-return controls. Measure it with simulated phishing: the click rate on the first campaign is the baseline, and the decline over subsequent quarters is the return. A drop from a 25 percent click rate to under 5 percent, which is typical after a year of monthly simulations, is an 80 percent reduction in the likelihood of the most common incident type and a cybersecurity ROI figure that owners understand instantly.
6. Track user awareness and reporting
Clicks going down is half the story; reports going up is the other half. Track how many suspicious emails staff report, how quickly, and how often they ask before acting on an unusual payment request. A workforce that reports a phishing attempt within minutes gives the IT team time to pull the same message from every other inbox before anyone clicks. Reporting rate is a leading indicator of security culture and belongs on every cybersecurity ROI dashboard.
7. Show technology ROI with blocked-threat data
Every security tool produces counts: malicious emails quarantined, malware executions blocked, sign-ins denied by conditional access, web requests stopped by DNS filtering. Report them monthly. Even a 20-person company sees thousands of blocked threats a year, and a short monthly summary (“412 phishing emails quarantined, 3 malware downloads blocked, 27 foreign sign-in attempts denied”) makes the invisible work visible. Pair the counts with the cost of a single successful attempt and the cybersecurity ROI of the tooling is self-evident.
8. Report data protection metrics
For businesses that hold sensitive data, measure the controls directly: percentage of devices encrypted, percentage of accounts protected by MFA, backup success rate and last verified restore, data loss prevention policy hits, and the number of external sharing links reviewed and removed. Each is a yes-or-no question an insurer or regulator will ask, and each moving from “no” to “yes” is cybersecurity ROI expressed as reduced exposure. The backup metrics deserve particular attention; our ransomware recovery plan explains why a tested restore is the control that most often decides whether a company survives an attack.
9. Measure vendor risk management
Supply chain attacks, where a vendor’s compromise becomes yours, have grown sharply. Track the percentage of critical vendors with a completed security review, the number of vendor findings remediated, and how long it takes to answer when a client sends you their questionnaire. Our guide to vendor security assessments covers the process. A documented vendor program is both risk reduction and, for professional services firms, a sales asset.
The Cybersecurity ROI Numbers Owners Overlook
The formula captures avoided loss. Three other returns are real money and rarely counted.
Cyber insurance premiums and insurability
Carriers price policies on controls. A business with MFA everywhere, endpoint detection and response, immutable backups, and security awareness training typically pays materially less than one without, and more importantly can get coverage at all. Several of our clients have seen renewal quotes fall after a security program was documented, and we have seen businesses declined entirely for lacking MFA. Our cyber insurance coverage guide lists the controls carriers ask about. Put the premium difference in the cybersecurity ROI calculation; it is often enough to fund the controls on its own.
Revenue you can only win with security in place
Larger customers, healthcare systems, financial institutions, and government contracts increasingly require vendors to attest to specific controls or hold a certification. A law firm that cannot complete a bank’s security questionnaire loses the bank as a client. A manufacturer bidding on defense subcontracts needs CMMC. The revenue those requirements unlock is cybersecurity ROI in its most direct form.
Productivity and reduced IT firefighting
Modern security controls remove daily friction. Single sign-on with passkeys ends password resets. Endpoint management keeps machines patched and running. Email filtering means staff spend less time deleting junk and second-guessing messages. The hours recovered across a company are measurable and belong in the calculation.
Cybersecurity ROI by industry
The inputs change by sector. For medical and dental practices, the dominant cost is HIPAA breach notification and the practice days lost while systems are rebuilt, so backup and endpoint controls carry the highest cybersecurity ROI. For accounting and tax firms, business email compromise during filing season is the realistic worst case, which puts MFA, email security, and payment verification procedures at the top. For law firms, client confidentiality and the ethical duty to protect data make the reputational component unusually large. For manufacturers and contractors, production downtime dominates, and the return on segmentation and tested recovery is easiest to show. The nine metrics above apply everywhere; the weighting is what changes.
Which Controls Deliver the Best Cybersecurity ROI
Not every dollar of security spending returns the same amount. For the small and mid-sized businesses we support in New Jersey, the controls with the highest return per dollar are consistent. Multifactor authentication, especially phishing-resistant MFA or passkeys, blocks the overwhelming majority of account takeover attempts for a few dollars per user. Security awareness training with phishing simulation costs about the same and addresses the human element. Endpoint detection and response, which replaced traditional antivirus, is what actually stops ransomware. Tested, immutable backups turn a catastrophic incident into an inconvenient one. Email security beyond the built-in Microsoft 365 filtering stops the attacks before anyone sees them.
Those five controls together typically cost a 25-person business less than one month of a single employee’s salary per year and remove the large majority of the expected loss. Expensive controls with lower return for a small company, such as a 24/7 security operations center or enterprise SIEM platform, make sense only once the fundamentals are in place. Our cybersecurity plan for small business lays out the sequence.
How to Present Cybersecurity ROI to Owners and Boards
The presentation matters as much as the math. Lead with the financial impact analysis: here is what a bad week costs us. Follow with the expected-loss comparison: here is what the program removes and what it costs. Then show the trend metrics (phishing click rate, blocked threats, response time, compliance coverage) on a single page, updated quarterly. Add the insurance and revenue effects as separate lines so they are not lost in the risk math.
A useful format is a one-page quarterly scorecard with four sections: what we blocked, how fast we responded, how ready our people are, and where we stand on compliance and insurance requirements. Each section gets two or three numbers and the trend versus last quarter. Over a year the scorecard becomes the cybersecurity ROI record for the business, and it answers the renewal-time question before anyone asks it.
Keep the language in business terms. Owners do not need to understand conditional access policies; they need to know that foreign sign-in attempts on the controller’s mailbox were blocked 27 times last quarter. A managed service provider should deliver this report without being asked. If yours does not, ask for it; the data already exists in the tools you are paying for. The small business IT budget checklist shows where security spending should sit alongside the rest of the IT budget.
Common Mistakes in Cybersecurity ROI Calculations
The most common is counting only the ransom or the direct recovery cost and ignoring downtime, which is usually the largest component. The second is using enterprise breach averages for a small business; use small business figures or, better, your own financial impact analysis. The third is omitting insurance and revenue effects, which understates the return. The fourth is treating security as a one-time project; the return comes from controls that are maintained, monitored, and reported on continuously, which is why most small businesses get better cybersecurity ROI from a managed program than from a periodic purchase.
Cybersecurity ROI: Frequently Asked Questions
What is a good cybersecurity ROI for a small business?
Most expected-loss models for the core controls show returns of 100 to 300 percent, meaning the avoided loss is two to four times the cost. Insurance savings and unlocked revenue push the figure higher.
How much should a small business spend on cybersecurity?
Common guidance is 10 to 15 percent of the IT budget, which for a small company often works out to a few hundred dollars per employee per year for the fundamental controls, with regulated industries at the higher end.
Which single control has the best return?
Multifactor authentication on every account. It is inexpensive, stops the majority of account compromise attempts, and is the first thing insurers and regulators check.
How do I measure cybersecurity ROI without any incident history?
Use industry likelihood data for your size and sector as the starting estimate, document your own financial impact analysis, and refine the model each year with your own blocked-threat and phishing simulation data.
Can cyber insurance replace security spending?
No. Policies now require the core controls as a condition of coverage, exclude many losses, and do not restore lost clients or reputation. Insurance transfers part of the residual risk; it does not reduce the risk itself.
Put a Number on Your Security Program
eMDTec’s cybersecurity services include the quarterly reporting described in this article, so New Jersey owners can see what their security spending is returning. If you have never seen a cybersecurity ROI figure for your own business, start with a security risk assessment and we will build the model with you. Schedule a free consultation to begin.
Originally republished with permission from The Technology Press; substantially expanded and updated by eMDTec for New Jersey businesses.