ROI is the wrong primary metric for cybersecurity governance

At a glance

What this is: This article argues that ROI alone is a poor primary metric for cybersecurity governance because it misses avoided loss, resilience, and long-horizon protection value.

Why it matters: It matters because IAM, NHI, PAM, and broader security leaders need board-ready measures that reflect risk reduction and operational resilience, not just immediate financial return.

Context

ROI is a financial efficiency measure, not a full governance measure for security. In cybersecurity, the value of a control is often realized by preventing loss, shortening recovery, and reducing exposure, which can be difficult to capture in a backward-looking formula.

That gap matters to identity programmes as well, because IAM, PAM, and NHI controls are often justified by the incidents they stop rather than the revenue they generate. When boards only see direct return, they can miss why controls that reduce blast radius, exposure windows, and recovery time are strategically necessary.

Key questions

Q: Why is ROI a weak primary metric for cybersecurity governance?

A: ROI is weak as a primary metric because it rewards measurable financial return, while security controls are often valuable for losses they prevent. A control can be effective precisely because nothing happens. Governance should therefore use risk reduction, avoided loss, and resilience outcomes as the main decision inputs, with ROI treated as a supporting financial view.

Q: What metrics should boards use instead of ROI for security decisions?

A: Boards should look at risk reduction, cost avoidance, compliance outcomes, incident response performance, and recovery speed. These measures reflect whether a control actually lowers exposure and shortens the damage from an incident. They are more useful than ROI when the value of security is primarily preventive and operational rather than revenue-generating.

Q: What breaks when cybersecurity investments are judged only by payback period?

A: Short payback thinking pushes organisations to underinvest in controls whose benefits arrive later, such as breach prevention, resilience, and containment. That can leave exposure windows open and make recovery slower when an incident occurs. The failure is not just financial, it is governance that discounts future harm too heavily.

Q: How should security teams justify identity controls that do not show direct revenue return?

A: They should justify them by showing how they reduce standing access, narrow blast radius, improve auditability, and lower the likely cost of compromise. IAM, PAM, and NHI controls are often loss-prevention measures, so their value is best expressed in reduced exposure and better operational resilience, not in direct income generation.

Technical breakdown

Why ROI breaks down for cybersecurity governance

Return on investment assumes a relatively stable input and output relationship, but cybersecurity is probabilistic and adversarial. A control can appear to have weak financial return until the day it prevents a breach, limits lateral movement, or preserves uptime during an attack. That makes the “return” both delayed and contingent on threat behaviour. In practice, ROI underweights prevention, resilience, and avoided disruption because those benefits are counterfactuals, not booked revenue. It is a measurement tool for expenditure efficiency, not for security value under uncertainty.

Practical implication: treat ROI as one finance input, not the primary security governance metric.

Alternative metrics that better reflect security value

Risk reduction, cost avoidance, compliance adherence, and operational resilience describe security outcomes more directly than ROI. These measures can capture changes in incident frequency, mean time to recovery, control coverage, and the likelihood of adverse events, which are the things security programmes actually influence. For identity governance, this is especially relevant because authentication, privilege, and lifecycle controls reduce exposure rather than create revenue. A board decision should therefore weigh whether a control narrows attack paths and improves recovery, not just whether it pays back in the next quarter.

Practical implication: anchor board reporting on exposure reduction, recovery improvement, and avoided loss.

How regulatory pressure changes the metric conversation

Regulatory obligations change the evaluation baseline because security work is not optional once legal or sector requirements apply. The article points to GDPR and the UK PSTI Act as examples of external pressure that can make security controls necessary regardless of near-term financial return. That means governance must account for compliance cost, evidence of due care, and the risk of sanctions or forced remediation. In identity terms, controls that support traceability, access limitation, and accountable change management have value even when they do not show up cleanly in an ROI model.

Practical implication: include compliance and accountability outcomes in any security investment case.

Threat narrative

Attacker objective: The objective is to exploit governance blind spots where weak security investment decisions leave the organisation more exposed than its board believes.

1. Entry begins when security investment decisions are evaluated through a financial lens that excludes avoided loss and operational disruption.
2. Escalation occurs when under-valued controls are deferred, leaving exposure windows open for breaches, compliance failures, and prolonged recovery.
3. Impact is measured in preventable losses, slower recovery, and weaker resilience when cyber incidents finally occur.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ROI is the wrong primary metric because cybersecurity value is realised in avoided harm, not just booked gain. A board that asks only what a control earns will systematically undervalue prevention, resilience, and blast-radius reduction. Security governance needs a metric set that reflects loss avoidance, operational continuity, and recovery speed. The practical conclusion is to make ROI secondary to risk and resilience measures.

Risk reduction metrics create a more honest governance conversation than financial return alone. The article is right that incident frequency, vulnerability reduction, and recovery performance are closer to the actual job of security controls. For IAM and NHI programmes, that means focusing on whether access controls narrow attack paths and shorten privilege exposure windows. Practitioners should report outcomes in terms the board can use to understand exposure, not just spend.

Regulatory pressure turns security from a discretionary spend into a governance obligation. When compliance duties exist, the question is not whether security delivers immediate ROI but whether the organisation can prove it exercised reasonable control. That is especially true where identity, access, and data handling intersect. The practical conclusion is to build governance narratives around accountability, evidence, and risk treatment.

Identity security is a clear example of why value must be measured at the control edge. IAM, PAM, and NHI measures often pay off by preventing compromise pathways that never show up as revenue. That makes them easy to underfund if ROI is the only language in the room. The practical conclusion is to judge these controls by exposure reduction and containment, not by quarterly payback.

What this signals

Security governance needs a control-value model, not a pure finance model. When leaders assess cybersecurity only through ROI, they undercount the controls that prevent the incidents they never have to explain. For identity programmes, that means proving how access governance and privilege containment reduce the size and cost of failure rather than chasing simplistic payback calculations.

IAM and NHI teams should expect more scrutiny on measurable loss avoidance. Boards increasingly want evidence that controls reduce exposure, support compliance, and improve recovery, not just that they were purchased and deployed. The strongest programme narratives will connect identity controls to incident containment, operational continuity, and accountability.

Security programmes that can translate technical control outcomes into business risk will be easier to fund. That translation is not about inflating ROI, it is about showing what gets protected when an organisation prevents a breach, shortens recovery, or limits lateral movement. The practical effect is better prioritisation across IAM, PAM, and broader cyber investments.

For practitioners

• Use risk reduction as the primary board metric Frame security investment cases around reduced attack exposure, fewer incidents, and better recovery rather than raw financial return.
• Track cost avoidance alongside control spend Quantify avoided breach costs, downtime, regulatory penalties, and remediation effort to show what the control set is protecting.
• Report operational resilience outcomes Include incident response time, mean time to recovery, and service uptime so leaders can see whether controls improve survivability.
• Tie identity controls to loss prevention Show how IAM, PAM, and NHI controls reduce blast radius, limit standing access, and constrain the scope of a successful attack.

Key takeaways

• ROI is a poor primary metric for cybersecurity because it does not capture avoided breaches, resilience, or the value of controls that prevent losses before they appear on a balance sheet.
• The article argues for risk reduction, cost avoidance, compliance, and operational metrics as better ways to explain why security spend matters.
• For IAM and NHI programmes, the most defensible investment case is how a control reduces exposure, constrains blast radius, and improves recovery when an incident happens.

Key terms

• Cost Avoidance: Cost avoidance is the value created by preventing an expense, loss, or operational disruption before it occurs. In cybersecurity, it includes avoided breach response, downtime, legal exposure, and recovery work. It is often more realistic than ROI for assessing preventive security controls.
• Risk Reduction Metric: A risk reduction metric shows whether testing and remediation are lowering the chance that vulnerabilities reach production. It focuses on outcomes such as time to fix, fix rate, or defects prevented. These metrics matter because they link security work to business exposure, not just to discovery activity.
• Operational Resilience: Operational resilience is the ability to keep critical services running or recover them quickly after disruption. In identity-led environments, that depends on authentication services, privilege management, and recovery procedures that can be tested under realistic failure conditions.
• Return On Security Investment: Return on Security Investment is the value a programme gets from security spend relative to the risk reduced. In bug bounty and vulnerability management, it is improved when teams stop paying repeatedly for the same flaw and can prove that fixes persist.

Deepen your knowledge

NHI Mgmt Group's NHI Foundation Level course covers NHI governance, machine identity security, IAM, and secrets management, with the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity control decisions to broader security outcomes.