Cybersecurity Cost-Benefit Analysis: Formula, Example and Steps
Group COO & CISO
Operational excellence, governance, and information security. Aligns technology, risk, and business outcomes in complex IT environments
A cybersecurity cost-benefit analysis compares what a security control costs with the loss it is expected to prevent. You estimate annualised loss expectancy (ALE = single loss expectancy × annual rate of occurrence) before and after the control, subtract the difference from the control's annual cost, and rank investments by the result. Ranges and scenarios matter more than precise figures.
Key takeaways
- The core formula is simple: benefit = ALE before − ALE after; ROI = (benefit − annual cost) ÷ annual cost.
- Count the full cost of a control: licences, implementation, people, training, integration and the friction it adds for users.
- Count the full cost of an incident: response, downtime, lost business, notification, legal costs and regulatory fines.
- Use ranges and scenarios, not single numbers. Present low, likely and high cases to decision-makers.
- Some benefits are hard to price, such as customer trust or passing a supplier audit. List them next to the numbers rather than leaving them out.
What does a cybersecurity cost-benefit analysis measure?
It measures whether a security investment reduces expected losses by more than it costs. That turns a technical request ("we need an EDR tool") into a business decision ("this reduces our expected annual loss by X for a cost of Y").
The analysis has two sides:
- Costs of the control: what you pay to buy, run and live with it.
- Benefits of the control: the reduction in expected loss, either because incidents become less likely or because each incident costs less.
NIST recommends treating cyber risk as part of enterprise risk, using the same language as other business risks. Its NIST IR 8286, Integrating Cybersecurity and Enterprise Risk Management, describes how to record cyber risks in risk registers so they can be compared with financial and operational risks.
What costs belong in the analysis?
Use total cost of ownership over the planning period, usually three years, then annualise it.
| Cost type | Examples | Often forgotten |
|---|---|---|
| Technology | Licences, subscriptions, hardware, cloud consumption | Price rises at renewal, log storage growth |
| Implementation | Design, deployment, integration with identity, SIEM and ticketing | Internal staff time during rollout |
| Operations | Monitoring, tuning, patching, incident handling | 24/7 cover, holidays, staff turnover |
| People and training | Analysts, engineers, awareness training, certifications | Time to hire and onboard |
| Business friction | Extra login steps, blocked tools, slower change processes | Workarounds that create new risk |
| Compliance | Gap analysis, policies, audits, evidence collection | Ongoing evidence work after certification |
For managed services such as managed detection and response, compare the service fee with the full in-house alternative: tools, analysts for round-the-clock cover, training and management time. Our article on whether an MSSP is worth it walks through that comparison.
What does a cyber incident cost?
An incident costs far more than the clean-up. The main categories are:
- Detection and response: forensics, incident response retainers, overtime, external counsel.
- Business disruption: downtime, lost orders, missed deliveries, contract penalties.
- Notification and support: informing customers and authorities, call centres, credit monitoring.
- Regulatory and legal: fines, investigations, litigation and settlements.
- Lost business: customer churn and higher acquisition costs after the event.
For a benchmark, IBM's annual Cost of a Data Breach study is widely used. The 2025 edition put the global average cost of a breach at USD 4.44 million, and USD 10.22 million in the United States. Treat these as context only. Your own single loss expectancy should be built from your revenue per hour of downtime, your data volumes and your contracts.
Regulatory exposure is easier to pin down. Under GDPR, the European Commission notes that fines can reach €20 million or 4% of total annual worldwide turnover. NIS2 adds its own fines and management accountability for in-scope entities, as covered in our NIS2 compliance guide.
How do you build the analysis, step by step?
Follow five steps and document every assumption so others can challenge it.
Step 1: List assets and loss scenarios
Identify the systems and data that matter most, such as the ERP system, customer database or production network. For each, describe realistic loss scenarios: ransomware, account takeover, data theft, supplier compromise.
Step 2: Estimate single loss expectancy and frequency
For each scenario, estimate the single loss expectancy (SLE), the cost of one occurrence, and the annual rate of occurrence (ARO), how often you expect it per year. Use internal incident history, insurer data and industry reports. Give a low, likely and high value for each.
Step 3: Calculate annualised loss expectancy
ALE = SLE × ARO. This is the expected yearly cost of the risk if you do nothing more.
Step 4: Estimate the effect of each control
Decide whether the control lowers the chance of the incident, its impact, or both. Re-estimate ARO and SLE with the control in place and calculate the new ALE.
Step 5: Compare benefit with cost
Benefit = ALE before − ALE after. Return on security investment = (benefit − annual cost) ÷ annual cost. Rank the options and check whether the ranking holds across your low and high estimates.
A worked example
The numbers below are illustrative, to show the method. Replace them with your own estimates.
| Item | Value |
|---|---|
| Scenario | Ransomware stops order handling |
| SLE (one incident) | €500,000 |
| ARO before control | 0.2 (once every five years) |
| ALE before | €100,000 per year |
| Control | Managed EDR with 24/7 response, plus tested offline backups |
| ARO after / SLE after | 0.1 / €200,000 (faster containment and restore) |
| ALE after | €20,000 per year |
| Benefit | €80,000 per year |
| Annual cost of control | €45,000 |
| Return on security investment | (80,000 − 45,000) ÷ 45,000 ≈ 0.78, or 78% |
Now test it. If one incident costs €250,000 instead (and €100,000 with the control), the benefit falls to €40,000 and the control costs more than it saves on this scenario alone. That is a useful result: it tells you to check whether the same control also reduces other scenarios, such as account takeover, before deciding.
Which controls usually give the best return?
Controls that are cheap to run and reduce many scenarios at once usually rank highest. Common examples are:
- Multi-factor authentication: Microsoft reported in 2019 that MFA can prevent 99.9% of attacks on accounts. Phishing-resistant methods give the most protection.
- Patching and vulnerability management: mostly process discipline. See our patch management service.
- Tested backups: offline or immutable copies cut the impact of ransomware sharply, as long as restores are rehearsed.
- Security awareness training: low cost per user and reduces phishing success.
- Monitoring and response: faster detection reduces the cost of each incident. A SOC service is often cheaper than building 24/7 cover in-house.
Economists have also studied how much to spend overall. The Gordon-Loeb model (Gordon and Loeb, 2002, ACM Transactions on Information and System Security) shows that the optimal investment to protect an information set is normally only a fraction of the expected loss. Use it as a sanity check on total budget, not as a precise target.
Why are some benefits hard to quantify?
Because they depend on rare events and on reactions you cannot observe in advance. Reputational damage, lost future deals and intellectual property theft are real, but estimates vary widely.
Handle this uncertainty openly:
- Show ranges and a sensitivity table for the inputs that drive the result.
- Run two or three named scenarios, for example "ERP down for one week".
- List non-financial benefits separately: passing customer security audits, meeting NIS2 duties, better cyber insurance terms.
- Review estimates yearly, and after every significant incident or near miss.
Example: a structured compliance programme at Löfbergs
Compliance obligations are often what triggers the analysis. Löfbergs, the Karlstad coffee roaster, falls under NIS2 and Sweden's Cybersecurity Act. As described in the Löfbergs NIS2 case, Opsio ran the work in four phases: a gap analysis against the NIS2 requirement areas, a prioritised roadmap based on risk exposure, implementation of the most critical controls first, and continuous compliance support. Prioritising by risk is the same logic as a cost-benefit analysis: spend first where the reduction in risk is largest.
How Opsio helps
Opsio runs security assessments that map your risks, rank controls by risk reduction and cost, and produce a roadmap you can take to management. We also provide the controls themselves as managed services, including SOC, managed detection and response, and patch management, so you can compare a known service fee with the in-house alternative.
Frequently asked questions
How do you calculate ROI for a security system?
Estimate the annualised loss expectancy for the risks the system addresses, with and without it. The difference is the benefit. Return on security investment = (benefit − annual cost of the system) ÷ annual cost. Use ranges and check whether the result holds in your low case.
What is annualised loss expectancy (ALE)?
ALE is the expected yearly cost of a risk. It equals single loss expectancy (the cost of one incident) multiplied by annual rate of occurrence (how many times a year you expect it). An incident costing €200,000 expected once every four years has an ALE of €50,000.
How should we calculate TCO for a managed detection and response service?
Add the service fee, any tool licences you still need, internal staff time for onboarding and incident follow-up, and log ingestion or storage costs. Compare that with an in-house alternative that includes tools, enough analysts for 24/7 cover, training and management.
Is it worth investing in cyber resilience tools versus paying for breach recovery?
Usually yes for controls that reduce many scenarios, such as MFA, tested backups and monitoring. Recovery costs include downtime, lost business and possible fines, which are often far higher than prevention. Run the numbers for your own scenarios before deciding.
How often should a cybersecurity cost-benefit analysis be updated?
At least once a year, at budget time, and after major changes such as a new system, an acquisition, a new regulation or a serious incident.
Related reading: Cloud Cost Analysis.
Related Articles
About the Author
Group COO & CISO
Fredrik is the Group Chief Operating Officer and Chief Information Security Officer at Opsio. He focuses on operational excellence, governance, and information security, working closely with delivery and leadership teams to align technology, risk, and business outcomes in complex IT environments. He leads Opsio's security practice including SOC services, penetration testing, and compliance frameworks.
Editorial standards: This article was written by a certified practitioner, named in the byline above. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.
