PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ROI Isn’t Cutting It: 6 Questions to Help CISOs Better Quantify Security Investments

hackerone.com | incident | #risk-management | #metrics | #ciso | #security-metrics | #hackerone | #roi | #security-investment | #return-on-mitigation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne introduces Return on Mitigation (ROM), which counts mitigated losses as returns instead of net profit, and offers six questions to help CISOs quantify security investments.
Published
Collected

Related coverage

blog · hackerone.com
A New Approach to Proving Cybersecurity Value (That Isn’t ROI)
Drawing on interviews with 10 CISOs and a survey of 550+ professionals, HackerOne introduces Return on Mitigation (RoM), a framework that quantifies prevented losses to justify security budgets.
blog · hackerone.com
New CTEM Metrics That Matter: How to Brief Your Board on AI-Accelerated Exposure
HackerOne argues vulnerability counts no longer brief boards well and proposes CTEM metrics like Time to Validate, as AI-accelerated discovery compresses exploitation timelines.
blog · hackerone.com
Calculate Return on Mitigation (RoM) With Hai
HackerOne's AI copilot Hai now auto-calculates Return on Mitigation (RoM) for resolved reports, quantifying the losses avoided by fixing vulnerabilities before exploitation.
blog · hackerone.com
A Call for a New Cybersecurity Measurement Standard
HackerOne argues ROI fails to capture cybersecurity's value because security prevents losses rather than generating revenue, and proposes Return on Mitigation (RoM) as the new metric.
blog · hackerone.com
The Cost Savings of Fixing Security Flaws in Development
HackerOne argues shift-left security is hard to justify via ROI and proposes Return on Mitigation (RoM), estimating avoided losses such as ~$150K for catching a high-severity SQL injection early.
blog · hackerone.com
Quantifying the Value of Bug Bounty Programs: ROI, ROM, or Both?
Traditional ROI struggles to capture proactive security value. HackerOne shows how Return on Mitigation (ROM) complements ROI by comparing breach costs with mitigation costs in bug bounty programs.
Back