Securing the Budget: Demonstrating Cybersecurity's Return

This article argues that traditional ROI metrics are inadequate for evaluating cybersecurity investments because they fail to account for avoided losses and indirect costs (reputation, downtime, regulatory impact). It introduces Return on Mitigation (RoM) — measuring mitigated losses relative to investment — as a more accurate, standardized way for security leaders to justify budgets, prioritize initiatives, and communicate value to non-technical stakeholders.