Cybersecurity ROI: how do you measure what you don’t lose?

From detection tools to audits, including employee training, monitoring and cyber insurance, companies are increasing their spending on protecting their information systems every year. The firm IDC (1) forecasts that this budget will rise worldwide from $308 billion in 2026 to $430 billion in 2029.

Yet cybersecurity is still often seen as a cost center, an insurance policy against an uncertain risk or a regulatory constraint. Senior management teams therefore question the return on investments whose success shows up as the absence of an incident. On September 17, during a roundtable organized as part of SIDO, four speakers compared their methods for answering this question.

Assessing cybersecurity by the losses it prevents

The classic profitability calculation is poorly suited to this exercise. Corentin Paimparé, account manager at the brokerage Howden Group, prefers the ROSI (Return On Security Investment), which assesses a protection expense based on the losses it helps avoid. “A cyberattack can interrupt operations, expose the company to regulatory penalties, cost it contracts and damage its image. The ROSI puts a figure on these avoided losses. Compliance also produces concrete value: regulations, European directives and international standards such as ISO 27001 are gradually becoming eligibility criteria for certain markets and calls for tenders,” explains Corentin Paimparé.

Laini Cultier, an independent cyber expert and Cybersecurity & Business program director at CEFCYS (Cercle des femmes de la cybersécurité), shares this view. In her opinion, return on investment “is measured in reverse.” The NIS2 directive does indeed provide for penalties for entities that fail to meet its requirements. The lack of protection is then paid for in fines as much as in incidents.

But for Thierry Rouquet, Vice President of Digital League, the question of ROI arises at a different level. “Looking for the ROI of cybersecurity amounts to asking the wrong question. A return on investment is calculated for a digital transformation project. Security is what makes this type of project possible and speeds up its rollout. The real question for a senior management team is to determine the cost of the risk it agrees to bear,” says Thierry Rouquet.

Translating cyber performance into indicators an executive committee can read

This quantification requires supplementing technical indicators with measures that executives understand. Corentin Paimparé thus tracks the potential impact of an incident on gross margin, the frequency of attacks and their cost. His top criterion, residual financial exposure, refers to what the company can still lose despite the protections already in place.

Thierry Rouquet uses a similar indicator: the maximum credible loss. He recommends breaking it down into concrete scenarios, such as the probability of an e-commerce platform going down and its consequences for revenue. The company must still know how to restart quickly after such an interruption.

According to Denis Boyer, awareness project officer for cyber risk at Cybermalveillance.gouv.fr, “the average recovery time after an incident is the indicator to follow. Backups remain the key. Business continuity and recovery plans must also anticipate the time needed to switch from one system to another. These measures are only worth something if they are proven through regular exercises.”

Laini Cultier extends this requirement: a backup only protects the company if its restoration has been tested. She also sets an RPO (Recovery Point Objective, the maximum volume of data the organization agrees to lose) for each critical asset identified beforehand.

Prioritizing spending and speaking executives’ language

These indicators are then used to arbitrate between competing priorities. Thierry Rouquet and Laini Cultier place risk analysis at the starting point of these choices. The former stresses the constraints specific to industrial environments, the latter the joint work with business departments, now that cybersecurity is on the agenda of executive committees.

“To convince a finance department, cyber risk has to be translated into operating losses, remediation costs and impact on profitability. Indirect effects on image, customer trust and company valuation come on top of direct costs. In this trade-off, employee awareness often remains the most profitable investment, especially as NIS2 will strengthen the accountability of executives,” adds Corentin Paimparé.

Denis Boyer offers executives facing a pile-up of good practices the approach of Cybermalveillance.gouv.fr: take an inventory of assets, assess the criticality of equipment, organize the implementation of measures, then appoint a DPO (data protection officer). This last step is growing in importance in the face of the multiplication of data breaches: requests for assistance related to them rose by 40% in 2025 (2) among companies and associations, he points out. Thierry Rouquet also sees AI as an unprecedented attack surface, prone to leaks of sensitive information.

“For an executive, the issue is knowing whether their company will last on the market. Some players do not recover from a cyberattack, and deepfakes are now multiplying the ways to hit them. Conversely, an organization that controls its digital risks gains a competitive advantage from it. Investing in cybersecurity therefore means protecting one’s longevity,” concludes Laini Cultier.

KEY TAKEAWAYS

How do you measure the profitability of a cybersecurity investment? Beyond the attacks avoided, four indicators make it possible to assess its value: potential financial losses, residual risk exposure, business recovery times and the commercial opportunities preserved. This puts cybersecurity back at the heart of strategic decisions.

FAQ – measuring cybersecurity ROI

How do you calculate the return on investment (ROI) of cybersecurity?

The return on investment in cybersecurity can be assessed using the ROSI (Return on Security Investment). This indicator compares the cost of protective measures with the financial losses they help avoid: business interruptions, remediation, penalties or lost business. Its calculation relies, however, on risk estimates, not on guaranteed financial gains.

Which indicators make it possible to measure the performance of a cybersecurity investment?

Several indicators can be presented to a senior management team: residual financial exposure, the maximum credible loss in the event of an incident, the recovery time objective (RTO) and the maximum tolerable data loss, expressed as a duration (RPO). They make it possible to link cyber investments to their economic consequences.

Why is cybersecurity considered a cost center?

Unlike a commercial investment, cybersecurity does not generally generate directly measurable revenue. Its value lies mainly in the incidents avoided, business continuity and the reduction of financial risks. It can also facilitate access to certain markets and strengthen customer trust.

How do you convince a senior management team to invest in cybersecurity?

To convince an executive committee, cybersecurity managers must translate technical risks into financial and operational consequences. Presenting concrete scenarios, such as the shutdown of a sales platform or the loss of critical data, makes it possible to compare the cost of protections with potential losses and to prioritize investments.

What is the ROSI in cybersecurity?

The ROSI (Return on Security Investment) is an indicator used to assess the profitability of a cybersecurity investment. It compares the estimated financial losses that a protective measure helps avoid with its implementation cost. It helps companies justify their security spending and prioritize their investments.

What is the RTO in cybersecurity?

The RTO (Recovery Time Objective) refers to the maximum acceptable time to restore an activity or a system after an incident. It allows companies to define their business continuity requirements and size their recovery arrangements.

What is the RPO in cybersecurity?

The RPO (Recovery Point Objective) corresponds to the maximum duration of data loss that an organization can accept after an incident. For example, an RPO of four hours means the company must be able to restore its data from a backup point dating from no more than four hours before the incident. This indicator is used in particular to determine backup frequency.

Sources and references:
1 – IDC study
2 – What are the main cyber threats targeting professionals in 2025?