Cybersecurity ROI is broken as spend rises and breaches worsen

At a glance

What this is: Illumio says the cybersecurity ROI model is failing because spend, tool counts, and activity metrics are rising while breach costs and operational impact keep worsening.

Why it matters: IAM, PAM, NHI, and broader security leaders should treat this as a measurement problem: if boards fund activity instead of loss reduction, governance decisions will keep missing the controls that actually reduce blast radius and recovery cost.

Context

Cybersecurity ROI is a governance problem before it is a tooling problem. When boards can only see spend, tool counts, and patch volume, they get activity reporting instead of evidence that risk is falling. That matters across IAM, PAM, NHI, and human identity programmes because identity controls are often justified on the promise of prevention, while the real test is whether they reduce blast radius, downtime, and recovery cost when access is misused.

The article uses the M&S ransomware disruption to show why prevention-only thinking is too narrow. In a breach-heavy environment, organisations need a measurement model that captures resilience, containment, and expected loss reduction rather than assuming the right answer is simply more security activity.

Key questions

Q: What breaks when cybersecurity programmes are measured by activity instead of outcomes?

A: They produce reassurance without proof. Activity metrics can show that teams deployed more tools, patched more vulnerabilities, or completed more reviews, but they do not show whether an attacker was contained faster, whether downtime was shorter, or whether the business lost less money when something went wrong.

Q: Why does tool proliferation often fail to improve real security coverage?

A: Because separate tools rarely create a complete control picture on their own. If alerts cannot be correlated across identity, endpoint, cloud, and response layers, attackers can exploit the seams between products while teams spend more time operating the stack than reducing risk.

Q: How should security leaders measure whether resilience investments are working?

A: They should look at the business consequences of incidents, not just the presence of controls. Useful signals include reduced containment time, reduced outage scope, lower recovery cost, and a smaller expected annual loss profile after an incident path is modelled.

Q: When should boards prioritise resilience over prevention-only security metrics?

A: As soon as breach probability is no longer the main question and business impact becomes the deciding factor. In mature environments, the board needs to know how much loss a control removes, not whether the control promises to stop every attack.

Technical breakdown

Why prevention metrics distort security value

Most security programmes still report outputs such as tools deployed, alerts generated, vulnerabilities patched, and training completed. Those figures describe activity, not resilience. The technical problem is that the measurement layer sits upstream of outcome and therefore cannot prove whether controls reduced dwell time, limited lateral movement, or lowered recovery effort. For identity programmes, the same issue appears when access governance is judged by review completion rather than by whether privileged access was actually constrained at runtime.

Practical implication: Shift reporting from activity volume to incident impact, containment, and loss reduction.

Why tool sprawl does not equal control coverage

Large enterprises often accumulate dozens of security tools, each solving a local problem, but the overall architecture becomes harder to correlate and operate. When signals are fragmented, defenders lose visibility across authentication, authorisation, segmentation, and response. In identity terms, that means IAM, PAM, and NHI controls can all exist while standing privilege, over-provisioning, or orphaned access still create exploitable gaps between platforms.

Practical implication: Assess whether your control stack can correlate identity events across systems, not just generate more alerts.

Why resilience is the right economic unit

The article reframes security economics around expected loss reduction. That means measuring the cost of an incident, the business impact of downtime, containment speed, and the degree to which controls shrink the blast radius when prevention fails. This is especially relevant to identity and NHI governance because access controls are only economically meaningful if they reduce the cost of compromise, not just the chance of a breach.

Practical implication: Model security spend against reduced recovery time, reduced outage scope, and reduced expected annual loss.

Threat narrative

Attacker objective: The objective was to disrupt business operations and force a costly recovery that translated technical compromise into measurable financial damage.

1. Entry occurred through a ransomware attack that took online sales offline and disrupted logistics, showing that the initial security failure was not just compromise but business interruption.
2. Escalation was expressed through prolonged recovery, with the incident continuing to affect operations for weeks and months rather than ending at the point of detection.
3. Impact landed in financial terms, with profit evaporating as the organisation absorbed lost online sales, operational disruption, and recovery effort.

Breaches seen in the wild

• Marks and Spencer cyberattack 2025: Impersonation of a third-party user led to ransomware, stolen customer data and weeks without online orders at M&S.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cybersecurity ROI has been measured against the wrong unit. Activity metrics can tell executives what the security team did, but they cannot show whether the organisation is harder to exploit or cheaper to recover. That is why boards keep seeing spend rise while confidence in security outcomes falls. The practical conclusion is that governance must move from control counting to loss reduction.

Blast-radius reduction is the economic test that matters now. When a breach is statistically inevitable, the decisive question is how much damage the organisation can absorb before business disruption becomes material. That applies directly to IAM, PAM, and NHI controls because identity compromise is often the first path to broader operational loss. Practitioners should treat containment as the primary value measure, not deployment volume.

Security tool proliferation creates measurement debt. More tools can produce more data, but data without correlation does not equal control. The article's core warning is that fragmented tooling can make teams feel protected while gaps persist between identity, endpoint, cloud, and response layers. Security leaders should judge whether their architecture produces a coherent risk picture or just a larger reporting burden.

Expected loss reduction is a more defensible board language than prevention claims. Boards do not need guarantees that breaches will never happen. They need a model that shows how much an investment lowers downtime, recovery cost, and business interruption when something gets through. For identity governance, that means proving that access controls reduce the cost of compromise, not merely the count of risky accounts.

Cybersecurity ROI fails when resilience is treated as a side effect. The article shows that the industry has spent years optimising for prevention narratives while the cost of recovery keeps rising. That exposes a governance gap, not a technology gap: the programme is judged on what it buys, not on what it saves. Practitioners should reframe control value around interruption avoided and recovery accelerated.

What this signals

Security programmes are entering a loss-accounting era. Boards are increasingly less interested in how many controls exist and more interested in how much damage those controls prevent when something fails. That shift is especially important for identity governance, where access decisions can determine whether compromise stays local or becomes an enterprise outage.

Identity controls are economically relevant only when they change blast radius. IAM, PAM, and NHI governance should be evaluated by whether they reduce the scope and duration of disruption after misuse or compromise. If they only improve policy completion rates, they do not yet justify their cost in board terms.

For practitioners

• Rebase security reporting on resilience metrics Replace tool counts and training completion rates with measures of containment time, outage duration, and recovery cost after incidents.
• Quantify expected loss reduction Translate major controls into reduced annual loss by linking each to lower business interruption, reduced remediation cost, and smaller blast radius.
• Build board cases from real incident benchmarks Use public examples such as prolonged retailer outages to show how your architecture would reduce downtime from weeks to hours.
• Consolidate identity and access evidence Correlate IAM, PAM, and NHI signals so that privilege scope, authentication, and containment performance can be evaluated together.

Key takeaways

• Cybersecurity ROI weakens when programmes are judged by activity, because activity does not show whether the organisation is safer or cheaper to recover.
• The article's central evidence is that spend keeps rising while breach costs and disruption remain on an upward trajectory.
• The practical response is to value controls by expected loss reduction, containment speed, and blast-radius reduction rather than by deployment counts.

Key terms

• Expected Loss Reduction: Expected loss reduction is the decrease in anticipated business impact after security controls are applied. It shifts the question from whether a breach can be prevented to how much damage, downtime, and recovery cost the organisation can avoid when prevention fails.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Containment Time: Containment time is the period between detecting a security incident and limiting its spread or impact. Shorter containment time generally reduces the number of affected systems, the volume of data exposed, and the cost of recovery. It is a practical measure of how effectively detection and response processes are working.
• Activity metric: An activity metric shows whether an identity process moved or completed, such as a certification being closed or a ticket being resolved. It is useful for operations, but it does not prove that access became safer, more appropriate, or better governed.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is a practical option for teams that need to connect identity controls to measurable risk reduction across modern security programmes.