ROI is the wrong primary metric for cybersecurity governance

At a glance

What this is: This is an INTIGRITI analysis arguing that ROI alone is a poor way to judge cybersecurity investments because it misses risk reduction, resilience, and non-financial value.

Why it matters: It matters because IAM, NHI, and broader security teams often have to justify controls to boards using the wrong economic model, which can distort prioritisation and underfund governance.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.

👉 Read INTIGRITI's analysis of why ROI is not always a useful cybersecurity metric

Context

ROI is useful for comparing financial investments, but cybersecurity is not a normal capital project. Security controls are bought to reduce loss, constrain attack paths, preserve availability, and support compliance, so the value often appears in avoided incidents rather than direct revenue. In identity programmes, that mismatch becomes sharper because service accounts, API keys, and tokens can create risk long before any measurable financial return exists.

For IAM and NHI practitioners, the real governance challenge is translating control effectiveness into board language without reducing security to a simplistic payback calculation. The same problem shows up in human identity, workload identity, and access management programmes: if the organisation only values what can be counted immediately, it underinvests in controls that prevent low-frequency but high-impact events.

Key questions

Q: How should security teams justify cybersecurity budgets to executives?

A: Security teams should justify budgets by linking each proposed control to a measurable business outcome such as avoided loss, reduced downtime, or lower recovery cost. The strongest cases combine asset value, realistic attack scenarios, and clear assumptions so finance leaders can compare options. Technical detail still matters, but it should support the business impact rather than replace it.

Q: Why is ROI especially weak for IAM and NHI controls?

A: IAM and NHI controls often prevent events that never occur, so their value is expressed through avoided compromise, not direct revenue. A credential that is rotated, revoked, or denied may never produce an observable return, yet it still removes attack paths. That makes risk-based metrics a more accurate way to defend investment.

Q: How do you know if cybersecurity spending is actually working?

A: Look for narrower attack surface, faster access removal, better credential hygiene, fewer exposed secrets, and shorter recovery from incidents. If those indicators improve, the programme is reducing operational risk even when there is no neat ROI figure. In identity governance, control performance matters more than accounting-style return.

Q: Who is accountable for proving security controls are effective?

A: Accountability should sit with the control owner, the programme owner, and the leadership team that accepts residual risk. In practice, this means resilience evidence should be part of governance reporting, not left as an informal technical exercise. If a control cannot be proved, its risk should be visible at decision-making level.

Technical breakdown

Why cybersecurity ROI breaks down as a decision metric

ROI assumes a clean input-output relationship, but cybersecurity controls operate through uncertainty reduction. A control may never produce an observable event because its success is the absence of a breach, an outage, or a regulatory finding. That makes traditional ROI weak for evaluating prevention, especially where the benefit is dispersed across resilience, trust, and reduced incident scope. For identity programmes, the same issue applies to secrets rotation, access review, and privilege reduction. Their value is real, but it is expressed as lower exposure and faster containment rather than direct earnings.

Practical implication: measure security investments with risk, resilience, and control-effectiveness metrics, not ROI alone.

Alternative metrics that work better for identity and security governance

More useful measures include risk reduction, cost avoidance, mean time to recovery, and compliance adherence. These do not replace financial analysis, but they anchor the discussion in operational outcomes that boards can understand. In identity programmes, metrics should reflect how quickly access is revoked, how often privileged credentials are rotated, and how much standing access remains in the environment. For NHI governance, the same logic applies to service accounts and API keys because their lifecycle controls directly shape attack surface.

Practical implication: build a dashboard that pairs financial estimates with operational indicators tied to identity lifecycle and incident containment.

Board communication should translate controls into exposure and downtime

Security leaders usually lose board attention when they describe tooling rather than business impact. A stronger model is to show how a control changes the probability or blast radius of a material event, then map that to downtime, legal exposure, customer impact, or regulatory consequence. This is especially important for identity security because access failures often cascade quietly through cloud, SaaS, and automation layers. The question is not whether the control paid for itself in a narrow accounting sense, but whether it prevented a credible business loss.

Practical implication: frame identity controls as exposure reduction and continuity protection in board reporting, not as standalone cost items.

Threat narrative

Attacker objective: The attacker objective is to turn weak identity and control governance into broad access, data loss, or operational disruption with minimal resistance.

1. Entry occurs when the organisation leaves access, secrets, or privileges in place longer than necessary, creating a standing opportunity for misuse.
2. Escalation follows when attackers reuse those credentials or over-privileged accounts to move from limited access into broader systems and higher-value data.
3. Impact arrives when that access enables theft, disruption, or breach costs that far exceed any short-term savings from underinvesting in control coverage.

Breaches seen in the wild

• Dropbox Sign breach — compromised Dropbox Sign service account exposed API keys and OAuth tokens.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ROI is a useful finance term, but it is a weak security governance model. Cybersecurity controls are designed to prevent loss, not just create measurable profit, so the central value often lives in avoided incidents and preserved continuity. That makes ROI especially misleading for identity programmes, where the control may succeed precisely because nothing happened. Practitioners should treat ROI as one input, not the decision framework.

Identity controls need exposure-based economics, not simplistic payback logic. Access reviews, secrets rotation, and privilege minimisation change the probability and blast radius of compromise, which is closer to risk engineering than investment accounting. This is where IAM, PAM, and NHI governance overlap: each reduces the cost of failure by shrinking the amount of access that can be abused. The practitioner conclusion is to quantify exposure reduction, not just expenditure.

Board reporting should translate technical control performance into business resilience. Executives understand downtime, customer churn, legal cost, and regulatory friction more readily than security tool categories. A board pack that shows reduced standing privilege, faster revocation, and fewer exposed credentials is more decision-useful than one that reports only spend efficiency. Practitioners should report the control outcome, not the product outcome.

Cost avoidance is the right language for NHI and human identity governance. The same logic that makes ROI weak for cyber also applies to service accounts, API keys, and authentication controls. The organisation does not need to prove a breach happened to justify reducing the attack surface. Practitioners should evaluate whether identity controls measurably reduce the cost of the worst credible event.

Zero Trust depends on a metrics model that values reduced trust, not just reduced spend. If the board only funds controls with short financial payback, it will systematically underinvest in the identity guardrails Zero Trust requires. That creates a governance gap where the architecture is promised but not operationalised. Practitioners should align funding decisions to trust reduction, containment, and recovery outcomes.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs , Key Challenges and Risks.
• This is why Ultimate Guide to NHIs , Why NHI Security Matters Now is the right next read for teams rethinking identity risk and governance.

What this signals

Metric discipline is becoming a governance issue, not just a finance issue. When security teams cannot show how a control reduces exposure, board conversations drift back to cost and away from resilience. For identity programmes, that means access reviews, secret rotation, and offboarding need outcome metrics that survive finance scrutiny and operational reality.

NHI governance exposes the weakness of generic ROI models most clearly. The gap between what the business spends and what the attack surface still looks like forces teams to use control effectiveness, not payback, as the organising principle. That is why lifecycle visibility and privilege reduction matter more than headline efficiency.

5.7% of organisations have full visibility into their service accounts according to our Ultimate Guide to NHIs, and that number signals a deeper reporting problem. If you cannot see the identity estate, you cannot credibly claim return on the controls meant to protect it.

For practitioners

• Use risk reduction as the primary control metric Replace single-point ROI arguments with measures such as reduced exposed accounts, shorter credential lifetime, and lower incident blast radius. Link these metrics to business impact so the board sees security value in operational terms.
• Build identity-specific cost avoidance models Estimate the cost of avoided credential abuse, privilege escalation, and account takeover across IAM and NHI programmes. Include downtime, response labour, legal exposure, and customer impact rather than only license or staffing costs.
• Report control effectiveness, not just spend efficiency Track the percentage of privileged accounts reviewed, revoked, or rotated within policy windows, and show how those controls change exposure. Use the data to support funding decisions for secrets management and access governance.
• Tie funding requests to resilience outcomes Present security investments alongside mean time to recovery, containment speed, and the number of systems that would remain exposed during an incident. That gives leadership a clearer basis for prioritising identity controls over generic cost metrics.

Key takeaways

• ROI is too narrow to describe cybersecurity value because most security benefit appears as risk avoided rather than profit created.
• Identity programmes are especially hard to price with ROI because access controls change exposure, blast radius, and recovery more than immediate revenue.
• Boards need evidence of resilience, containment, and control effectiveness before they can make sound funding decisions.

Key terms

• Risk Reduction Metric: A risk reduction metric shows whether testing and remediation are lowering the chance that vulnerabilities reach production. It focuses on outcomes such as time to fix, fix rate, or defects prevented. These metrics matter because they link security work to business exposure, not just to discovery activity.
• Cost Avoidance: Cost avoidance is the value created by preventing an expense, loss, or operational disruption before it occurs. In cybersecurity, it includes avoided breach response, downtime, legal exposure, and recovery work. It is often more realistic than ROI for assessing preventive security controls.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Mean Time to Clean Recovery: Mean Time to Clean Recovery measures how long it takes to restore data or services to a verified, uncompromised, and usable state. It is more useful than restore speed alone because it captures whether recovery produced trusted operations, not just a technically restarted environment.

What's in the full article

INTIGRITI's full article covers the practical framing this post intentionally leaves for the source:

• How the author positions ROI versus ROSI and cost avoidance in board conversations
• The examples used to explain why intangible security benefits resist financial quantification
• The discussion of when ROI can still be useful for smaller, well-scoped cybersecurity decisions
• The operational metrics cited for uptime, incident response time, and recovery performance

👉 The full INTIGRITI article covers the board communication examples and alternative metrics in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and identity lifecycle controls that shape real-world risk decisions. It helps practitioners connect technical controls to the business outcomes boards expect to see.