Why ROI is Failing Your Cybersecurity Strategy: The Rise of Return on Mitigation
Applying ROI to cybersecurity is like using a teaspoon to measure the ocean. Instead, think of “return on mitigation” as your new yardstick. It’s about recognizing dollars saved, not just dollars earned. Embrace it, or risk budgeting your way into the breach hall of fame!

Hot Take:
Who needs crystal balls when you can have a cyber breach to predict future losses? As organizations continue to play financial whack-a-mole with their cybersecurity budgets, it’s clear they need a new approach. Enter the ‘Return on Mitigation’ (RoM), the trendy new kid on the block that’s here to turn your security predictions from “doom and gloom” to “we’ve got this covered.”
Key Points:
- Cyber breaches increased by 180% last year, costing the US an average of $5 million per breach.
- Traditional ROI metrics are inadequate for justifying cybersecurity investments.
- Reputational damage from breaches, like the Equifax debacle, isn’t captured in ROI calculations.
- Return on Mitigation (RoM) offers a new way to measure cybersecurity value by focusing on mitigated losses.
- RoM not only simplifies cybersecurity value but also aids in stakeholder communication and budget justification.
Already a member? Log in here