PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A New Approach to Proving Cybersecurity Value (That Isn’t ROI)

hackerone.com | blog | #risk-management | #metrics | #ciso | #roi | #security-investment | #return-on-mitigation | #white-paper
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Drawing on interviews with 10 CISOs and a survey of 550+ professionals, HackerOne introduces Return on Mitigation (RoM), a framework that quantifies prevented losses to justify security budgets.
Published
Collected

Related coverage

incident · hackerone.com
ROI Isn’t Cutting It: 6 Questions to Help CISOs Better Quantify Security Investments
HackerOne introduces Return on Mitigation (ROM), which counts mitigated losses as returns instead of net profit, and offers six questions to help CISOs quantify security investments.
blog · hackerone.com
The Cost Savings of Fixing Security Flaws in Development
HackerOne argues shift-left security is hard to justify via ROI and proposes Return on Mitigation (RoM), estimating avoided losses such as ~$150K for catching a high-severity SQL injection early.
blog · wiz.io
The ROI of DSPM: Why Data Security Posture Management Is a Business Imperative
Wiz makes the business case for DSPM: with breaches averaging $4.88M, it cuts exposure, eases GDPR, HIPAA and PCI DSS compliance and unites security and dev teams — with metrics for each gain.
blog · netspi.com
CISO Perspectives: Cybersecurity Budgeting Edition
Three CISOs share how they present cybersecurity budgets to the board, favoring maturity metrics such as NIST CSF benchmarking over fear-based arguments to justify spending and measure ROI.
blog · netspi.com
Q&A: Diana Kelley Discusses ROI, Application Security, and Inclusivity
Security Curve CTO Diana Kelley on communicating cybersecurity ROI through a business-profitability lens, building application security programs, and improving inclusivity in the security industry.
blog · hackerone.com
New CTEM Metrics That Matter: How to Brief Your Board on AI-Accelerated Exposure
HackerOne argues vulnerability counts no longer brief boards well and proposes CTEM metrics like Time to Validate, as AI-accelerated discovery compresses exploitation timelines.
Back