PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Call for a New Cybersecurity Measurement Standard

hackerone.com | blog | #risk-management | #ciso | #security-metrics | #hackerone | #cybersecurity | #roi | #cybersecurity-investment | #return-on-mitigation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne argues ROI fails to capture cybersecurity's value because security prevents losses rather than generating revenue, and proposes Return on Mitigation (RoM) as the new metric.
Published
Collected

Related coverage

incident · hackerone.com
ROI Isn’t Cutting It: 6 Questions to Help CISOs Better Quantify Security Investments
HackerOne introduces Return on Mitigation (ROM), which counts mitigated losses as returns instead of net profit, and offers six questions to help CISOs quantify security investments.
blog · hackerone.com
Calculate Return on Mitigation (RoM) With Hai
HackerOne's AI copilot Hai now auto-calculates Return on Mitigation (RoM) for resolved reports, quantifying the losses avoided by fixing vulnerabilities before exploitation.
blog · hackerone.com
A New Approach to Proving Cybersecurity Value (That Isn’t ROI)
Drawing on interviews with 10 CISOs and a survey of 550+ professionals, HackerOne introduces Return on Mitigation (RoM), a framework that quantifies prevented losses to justify security budgets.
blog · hackerone.com
Quantifying the Value of Bug Bounty Programs: ROI, ROM, or Both?
Traditional ROI struggles to capture proactive security value. HackerOne shows how Return on Mitigation (ROM) complements ROI by comparing breach costs with mitigation costs in bug bounty programs.
blog · netspi.com
Q&A: Diana Kelley Discusses ROI, Application Security, and Inclusivity
Security Curve CTO Diana Kelley on communicating cybersecurity ROI through a business-profitability lens, building application security programs, and improving inclusivity in the security industry.
blog · netspi.com
Measuring Security Risks Consistently
Risk labels are subjective without shared impact thresholds. The author suggests defining organization-specific fiscal, reputational, and safety impact levels in a matrix, involving multiple roles.
Back