Maximizing ROI in security investments: The financial advantages of integrated solutions

When you invest your time, money and/or resources into something, you want to make sure it’s worth it. You don’t want to buy a car for cheap and then put in more money than it’s worth in repairs. Or grow your favorite veggies only for them to be eaten by wildlife. And you certainly don’t want to spend (lots of) money on a cybersecurity solution only for you to experience a major data breach that costs millions of dollars more and your reputation.

That’s why you spend time evaluating your return on investment (ROI). In this blog, we’ll talk about how ROI is calculated and how to maximize your return on security investment (ROSI).

Calculating ROI

Generally, your ROI is calculated by:

This applies to cybersecurity too, though with some caveats. Calculating your gain from investment isn’t as simple as inserting your profits into the equation — after all, cybersecurity isn’t generally measured this way.

Instead, to calculate your return on security investment (ROSI), you’ll need to conduct a quantitative risk assessment. The European Union Agency for Cybersecurity (ENISA) mentions these variables when determining the gain from your investment:

• Single loss expectancy (SLE): The amount of money lost from an incident, assuming it happens once. This could be direct losses like downtime, hardware replacement, or data loss replacement, or indirect losses like investigation time or loss of reputation.
• Annual rate of occurrence (ARO): The number of times an incident occurs in a year.
• Annual loss expectancy (ALE): The annual monetary loss from a specific risk on a specific asset, or ARO * SLE.
• Mitigation ratio: The effectiveness of your security solution. For example, if your solution prevents 90% of attacks, your ratio would be 0.9.

This means that the gain from your investment is how much money you expect to lose throughout a year (ALE), multiplied by the ratio of attacks your security solution could block (mitigation ratio). This makes your overall ROSI:

Obtaining these numbers isn’t a simple task. It requires an understanding of the threat landscape, and the costs a threat poses to your organization. With network and device monitoring, you can get historical numbers that help your estimates, but ultimately you are estimating. This means you won’t get exact numbers, but you’ll have a guideline to move forward.

Maximizing ROSI

So how do you know that your security solution is a cost-effective solution? Ideally, your ROSI should yield over 100%. For example, say that:

• You suffer from 10 virus attacks per year, costing $10,000 each time. This means your ARO is 10 while your SLE is $10,000. This makes your ALE = 10 * $10,000 = $100,000
• However, your security software blocks 90% of these attacks. This makes your mitigation ratio equal to 0.9.
• You spend $35,000 per year on your software solution.

This makes your ROSI:

Since this percentage is over 100%, this would be considered a good investment. So how do you make sure this number is as high as possible? The simplest ways are to:

• Lower the cost of your security solution, noting that this can affect its effectiveness
• Increase the number of threats blocked by your solution
• Minimizing risk vectors

(You can also improve this percentage by increasing the number of threats and how much these threats cost your organization — but the former is not totally in your control, and generally you’d rather minimize these costs. You’d have to consider why these costs are greater; is it because the threats are more significant or because your processes aren’t built to recover from these threats? You’d likely spend more on your security solution if significantly higher costs were at stake, which would affect your ROSI further.)

How integrated solutions optimize ROSI

Integrating your security software stack improves your ROSI. An integrated solution can cost less and more effectively block security threats. Consider these components of your security stack:

• Management to keep devices up to date, remediate security threats and monitor device health and attributes
• Identity management that provisions cloud-based identities, centralizes password management and securely connects to company resources with Zero Trust Network Access (ZTNA)
• Security software that monitors device and system health, provides rich telemetry to IT and Security teams and using machine learning for threat hunting

When each of these components works well, you’re in a good position. When they also work together, you’re in a great position. Integrated solutions work together to block attacks before they can cause damage. For example, say a user accidentally downloads malware onto a device. Your integrated solution will act quickly to automatically launch remediation workflows that:

• Identify malware has been installed on the device
• Quarantine the affected files
• Disconnect the now noncompliant device from company resources
• Notify the user of the remediation process and get them up and running quickly

This can all happen with minimal IT intervention — and fast. The speed at which this can work means less damage and data loss. Having a deep understanding of how all your systems work together also helps identify anomalous behavior that could indicate a cyber attack. Together, this means fewer threats make it to your system, improving your overall ROSI.

Integrated security with Jamf

Jamf enables this by making Trusted Access possible. Jamf offers:

• Mobile device management with Jamf Pro, Jamf School and Jamf Now
• Identity and access management with Jamf Connect
• Security with Jamf Protect and Jamf Safe Internet
• Mobile threat defense from sophisticated attacks with Jamf Executive Threat Protection