Measuring the Effectiveness of Investment in Security Treatments through a Security ROI Model

With the fast expansion of the digital economy and more adoption of data driven decision making business management process in most industries, there is an urgent need for a quantitative model abstract enough to capture the complexity of threat and security management, and practical enough to measure the effectiveness of any type of investment in security treatments towards establishing a truly tangible business return on investment. In this paper we have developed a Security ROI (Return on Investment) model which is a function of three independent variables: (a) severity of security threat, (b) the probability of threat realization, and (c) the investment on security treatments. We have demonstrated the entire process of how the model is developed. Also, through a few examples that reflect some typical real-world investment on security treatments approaches, we have applied the Security ROI model to analyze the value of security treatments on threats and tangible revenue impacts in each of these scenarios to show the usability and suitability of the model.