ROI Isn’t Cutting It: 6 Questions to Help CISOs Better Quantify Security Investments

This report introduces Return on Mitigation (ROM), a framework for expressing the value of cybersecurity investments by quantifying avoided losses (including reputational damage, compliance costs, and operational disruption) in monetary terms to aid budget justification, prioritization, stakeholder communication, and measuring security effectiveness over time.