Step 1:

Identify key metrics and KPIs

How to prove the ROI of cybersecurity ▸ Step 1: Identify key metrics and KPIs

Security shouldn't be viewed as an isolated function, but as an enabler of business success. Quantifying the impact of security on KPIs — such as how improved incident response times help reduce downtime and financial losses — will help teams build a compelling case for continued investment.

To effectively demonstrate ROI, security teams must align security goals with overarching business objectives. This will help clearly articulate to stakeholders how security initiatives contribute to the organization’s bottom line. Here are some key metrics to consider:

At Kyndryl, we track maturity, which is what we do within our security program, and effectiveness, which is how well we do it,” says Cory Musselman, CISO at Kyndryl, the world's largest provider of IT infrastructure services. “We’ve built a ‘cyber balance scorecard’ to measure these KPIs every quarter so we can show senior leadership and the board that we’re executing against our plan.

Cory Musselman
CISO
Kyndryl

Risk reduction	Cost savings	Revenue	Time savings	Compliance
How do your security efforts reduce the number and impact of threats?	How much money do you save by mitigating threats?	How do security investments increase revenue by attracting or retaining customers?	How do your security initiatives improve time to detect or respond to threats?	How do security efforts support compliance adherence to reduce overall risk profile?

Businesses at Work 2025 > Chapter number and title > Chapter Subtitle

Calculating the impact of a potential breach — including fines, lost revenue, and reputational harm — can also help stakeholders understand the real-world impact of security efforts. By comparing costs vs. benefits, you can demonstrate that investing in security can prevent significant losses.

+ Take the average cost of a security incident
x Multiply by how many incidents you’re likely to have in a given timeframe
- Subtract costs for security investments
= Security ROI

How to calculate security ROI:

Example
Potential cost of incident: $1,000,000
Number of incidents: 5 per year
Cost of security investments: $500,000

Step 1:
Multiply the potential cost of an incident by the number of incidents per year
$1,000,000 x 5 = $5,000,000

Step 2:
Subtract the cost of security investments from the potential costs of incidents
$5,000,000 - $500,000 = $4,500,000

In this example, the ROI of security investments is $4,500,000 per year. By investing $500,000, you can potentially avoid $4,500,000 in losses due to security incidents.

Security is an investment — but the cost of going without is much greater. Demonstrating how a robust cybersecurity posture can protect revenue streams, reduce operational costs, or mitigate risks that could hinder growth will help you secure long-term support.