HackerOne introduces Cybersecurity Investment Metric

HackerOne has published When ROI Falls Short: A Guide to Measuring Security Investments with Return on Mitigation, a report that revealed security leaders’ negative perceptions surrounding ROI for the measurement of cybersecurity value.

The whitepaper also introduced Return on Mitigation (RoM) — a new metric that helps security leaders quantify the financial value of protecting their businesses from cyberattacks.

As the average cost of a data breach grows to nearly $5 million in the US, challenges in quantifying return on investment (ROI) for cybersecurity products have led to decreased cybersecurity budgets. ROI remains the gold standard for justifying cybersecurity spending and measuring investment efficacy, yet most security leaders say applying it to cybersecurity presents challenges.

“The hardest part of ROI in security is quantifying it,” said one VP of Security at a Fortune 500 Manufacturing Company. “It's challenging to measure the cost of a vulnerability or compare solutions, especially when considering factors like reputational damage, downtime, and revenue impact."

In HackerOne’s report, 550 security leaders—including CIOs, CISOs, and security directors—revealed:

• ROI overlooks incident response and long-term stability, which over three-quarters of security leaders (77%) prioritize in evaluating their cybersecurity approach.

• Sixty-nine percent of security leaders also believe ROI overemphasizes direct costs and fails to account for indirect costs like incident response and training.

• More than half of leaders stated that ROI fails to consider enough factors contributing to cybersecurity value, including cost savings from avoided breaches and non-financial benefits like protected brand reputation and customer trust.

“When it comes to breaches, we all intuitively know that an ounce of prevention is worth a pound of cure,” said Alex Rice, co-founder and chief technology officer, at HackerOne. “But without the right metrics, it’s hard to advocate for the value of security investments. Return on Mitigation reframes proactive and preventive work as a value driver.”

RoM is a metric that security leaders can use to gain a more holistic view of the financial impact of cybersecurity initiatives and communicate how cybersecurity efforts align with an organization’s financial goals to executives and board members. RoM’s formula quantifies the financial impact of proactive cybersecurity investments by measuring avoided financial losses from a breach — costs prevented by mitigated risks like regulatory fines, legal costs, reputational damage, and business disruptions.

“Return on Mitigation’s (RoM) data-driven approach allows us to demonstrate the real impact of proactive mitigation to the board, ensuring our security investments not only protect the bottom line but also strengthen customer trust,” said Rossini Moraes, Information Security Manager at Inter&Co.

“RoM allows me to justify a $300,000 investment against a potential $5 million critical breach,” said a Head of Cybersecurity at an enterprise financial infrastructure provider. “[With this metric], I can show how mitigating vulnerabilities through continuous, offensive security testing can prevent costly breaches and justify the spend."

New integrations, broad marketplace access empower customers using cloud, security, and...
Expanded platform offers new approach to detecting and prioritizing risk, starting with...
New AI-powered digital agents accelerate identity security operations and decision-making.
New collaboration delivers powerful automation to streamline workflows and enhance backup...
New Palo Alto Networks data shows 82% of UK organisations confident in their use of AI, despite AI...
MIT researchers crafted a new approach that could allow anyone to run operations on encrypted data...
CyberArk has released its 2025 State of Machine Identity Security Report, revealing that machine...
Strategic software upgrade drives sustainable business growth through improved user experiences,...