PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Calculating Cybersecurity ROI with Return on Mitigation (RoM)

hackerone.com | blog | #bug-bounty | #risk-management | #vdp | #return-on-mitigation | #cybersecurity-roi | #loss-prevention
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Return on Mitigation (RoM) reframes cybersecurity ROI around avoided losses. A HackerOne case study shows a financial services firm saved $25.7M across three years through its VDP and bug bounty.
Published
Collected

Related coverage

blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Turning Risk Reduction into a Living Metric: The RoM Dashboard is Here
See your security program's ROI in real time with the new RoM Dashboard. Track mitigated losses, benchmark performance, and align with business goals.
blog · hackerone.com
Making the Business Case for AI Security: How to Show Value with Return on Mitigation
HackerOne's new whitepaper promotes Return on Mitigation (RoM) to quantify avoided losses versus mitigation cost, helping security leaders justify AI security budgets, based on a 550-leader survey.
blog · hackerone.com
Calculate Return on Mitigation (RoM) With Hai
HackerOne's AI copilot Hai now auto-calculates Return on Mitigation (RoM) for resolved reports, quantifying the losses avoided by fixing vulnerabilities before exploitation.
blog · hackerone.com
A Call for a New Cybersecurity Measurement Standard
HackerOne argues ROI fails to capture cybersecurity's value because security prevents losses rather than generating revenue, and proposes Return on Mitigation (RoM) as the new metric.
blog · hackerone.com
The Cost Savings of Fixing Security Flaws in Development
HackerOne argues shift-left security is hard to justify via ROI and proposes Return on Mitigation (RoM), estimating avoided losses such as ~$150K for catching a high-severity SQL injection early.
Back