HackerOne, a global leader in finding and fixing critical vulnerabilities and AI safety issues, today published When ROI Falls Short: A Guide to Measuring Security Investments with Return on Mitigation, a report that revealed security leaders’ negative perceptions surrounding ROI for the measurement of cybersecurity value. The whitepaper also introduced Return on Mitigation (RoM) — a new metric that helps security leaders quantify the financial value of protecting their businesses from cyberattacks.

As the average cost of a data breach grows to nearly $5 million in the US, challenges in quantifying return on investment (ROI) for cybersecurity products have led to decreased cybersecurity budgets. ROI remains the gold standard for justifying cybersecurity spending and measuring investment efficacy, yet most security leaders say applying it to cybersecurity presents challenges. 

“The hardest part of ROI in security is quantifying it,” said one VP of Security at a Fortune 500 Manufacturing Company. “It’s challenging to measure the cost of a vulnerability or compare solutions, especially when considering factors like reputational damage, downtime, and revenue impact.”

In HackerOne’s report, 550 security leaders—including CIOs, CISOs, and security directors—revealed:

ROI overlooks incident response and long-term stability, which over three-quarters of security leaders (77%) prioritize in evaluating their cybersecurity approach. 

Sixty-nine percent of security leaders also believe ROI overemphasizes direct costs and fails to account for indirect costs like incident response and training. 

More than half of leaders stated that ROI fails to consider enough factors contributing to cybersecurity value, including cost savings from avoided breaches and non-financial benefits like protected brand reputation and customer trust. 

“When it comes to breaches, we all intuitively know that an ounce of prevention is worth a pound of cure,” said Alex Rice, co-founder and chief technology officer, at HackerOne. “But without the right metrics, it’s hard to advocate for the value of security investments. Return on Mitigation reframes proactive and preventive work as a value driver.”

RoM is a metric that security leaders can use to gain a more holistic view of the financial impact of cybersecurity initiatives and communicate how cybersecurity efforts align with an organization’s financial goals to executives and board members. RoM’s formula quantifies the financial impact of proactive cybersecurity investments by measuring avoided financial losses from a breach — costs prevented by mitigated risks like regulatory fines, legal costs, reputational damage, and business disruptions. 

“Return on Mitigation’s (RoM) data-driven approach allows us to demonstrate the real impact of proactive mitigation to the board, ensuring our security investments not only protect the bottom line but also strengthen customer trust,” said Rossini Moraes, Information Security Manager at Inter&Co.

“RoM allows me to justify a $300,000 investment against a potential $5 million critical breach,” said a Head of Cybersecurity at an enterprise financial infrastructure provider. “[With this metric], I can show how mitigating vulnerabilities through continuous, offensive security testing can prevent costly breaches and justify the spend.”

HackerOne customers can experiment with RoM with the platform’s AI copilot, Hai.  Download the full report here and join HackerOne’s webinar: Quantify the Financial Impact of Cybersecurity with Return on Mitigation on March 12 to learn how to apply RoM.