TL;DR: Forrester Consulting’s June 2026 TEI study models a composite fintech environment and finds 351% three-year ROI, $3.6M net present value, and payback in under six months, with most benefit driven by automation, reduced compliance effort, and lower cloud waste, according to Sentra research. The result is a governance case for data security that now needs to be argued in operational terms, not just risk language.
At a glance
What this is: Sentra’s TEI study uses a Forrester model to show that data security can produce board-ready financial outcomes, not just risk reduction narratives.
Why it matters: For IAM, NHI, and broader security practitioners, the study is a reminder that governance programmes now have to prove economic value alongside control effectiveness.
By the numbers:
- Forrester Consulting’s independent study found a 351% three-year ROI.
- The composite organisation managed a 100 petabyte data footprint.
Context
Data security programmes often struggle to translate control outcomes into the language of budgets, payback, and operating leverage. That gap matters because security decisions are usually approved in the same room as cloud spend, productivity targets, and audit pressure.
This article is about a TEI model, not a technical benchmark. The identity angle is indirect but real: data access, cloud governance, and AI governance all depend on knowing who or what can reach sensitive information and how much manual oversight that creates.
The studied environment is deliberately large and fluid, which makes the business case more representative of complex enterprise reality than a narrow point solution pilot.
Key questions
Q: How should security teams build a business case for data governance controls?
A: Anchor the case in measurable operating outcomes: labour saved, compliance effort reduced, cloud waste removed, and exposure scope narrowed. A credible business case ties those effects to real workflows, not to abstract risk language. If the control can shorten review cycles or eliminate manual governance tasks, show the hours and cost avoided in the same model.
Q: Why do data security programmes sometimes create operational savings instead of just risk reduction?
A: Because discovery, classification, and governance automation can replace recurring manual effort across cloud, AI, and compliance workflows. When those controls run inside the customer environment and reduce repeated reviews, they lower labour demand and infrastructure overhead at the same time. The savings come from making governance continuous rather than episodic.
Q: What are the signs that data governance is becoming too manual to keep up with compliance needs?
A: A governance process is becoming too manual when teams rely on repeated one-time scans, inconsistent labels, and slow updates to reflect new data or policy changes. That usually shows up as stale metadata, uneven enforcement, and poor visibility into regulated data. Incremental scanning and automated intelligence help reduce that drift and keep governance current.
Q: Should organisations treat AI recovery and identity governance as separate programmes?
A: No. AI recovery and identity governance intersect at the point where data becomes usable again. If the same controls do not cover who can restore, who can certify, and who can activate the recovered content, then the organisation has fragmented governance over one operational risk.
Technical breakdown
How TEI models convert control outcomes into financial value
Total Economic Impact studies are designed to express operational changes in financial terms. They estimate benefits such as labor avoided, infrastructure reduced, and risk cost offset, then compare those gains with implementation and operating costs over time. In practice, the model is only as credible as the assumptions behind the composite environment, the interview evidence, and the treatment of uncertainty. That is why TEI results should be read as decision support, not proof of universal outcomes. The important technical point is that controls like discovery, classification, and governance automation become measurable when they reduce manual work and shrink exposure scope.
Practical implication: Use TEI-style modelling to translate security work into time saved, risk reduced, and cloud waste removed.
Why data governance automation changes the economics of cloud security
The article shows that much of the value came from automation inside the customer’s own cloud account. That matters because the cost centre is not just tooling, it is the labour and operational drag of repeatedly classifying data, validating access, and proving compliance across changing environments. When a platform can identify where sensitive data lives and who can reach it without moving that data elsewhere, it reduces both control friction and infrastructure overhead. This is especially relevant in hybrid multi-cloud estates where manual governance scales poorly and exception handling quickly becomes the default operating model.
Practical implication: Prioritise controls that reduce recurring governance labour rather than adding another review layer on top of it.
What board-ready ROI means for identity and access programmes
Board-ready ROI changes the conversation for IAM-adjacent programmes because governance is no longer evaluated only as a risk obligation. If a control set can show reclaimed analyst time, lower compliance effort, and reduced cloud waste, it becomes part of the operating model rather than a pure cost of compliance. The identity intersection is strongest where access decisions determine which data and environments need review, especially in AI and test workloads with high churn. That makes access visibility and governance part of financial control as much as security control.
Practical implication: Treat access governance and data governance as a shared business case when building budget requests.
NHI Mgmt Group analysis
Board-ready security economics are becoming a governance requirement, not a marketing claim. Security programmes increasingly compete for funding against cloud optimisation and operational automation, so they have to show measurable labour reduction and cost avoidance. A TEI model is not the same as a benchmark, but it gives buying committees a structured way to compare control investments. Practitioners should expect more security decisions to be judged on economic evidence, not only on risk narratives.
Data governance automation is now an operating model question, not just a tooling question. The article’s strongest signal is that value came from reducing repeated manual work inside the customer’s environment. That shifts the discussion from point-in-time classification to continuous governance of sensitive data, access, and exposure. Teams should evaluate whether their current controls are designed to scale with change or merely document it after the fact.
AI governance and data governance are converging at the access layer. The study highlights manual effort around production data and AI governance, which is where identity, access, and data control start to overlap. If AI systems can see sensitive data, then governance must answer who or what is entitled to that visibility and how it is reviewed over time. Practitioner conclusion: separate AI risk management from data governance at your peril.
Cloud waste is becoming a security signal as much as a finance signal. The article ties removed shadow data to avoided cloud infrastructure cost, which means dormant or redundant data assets are no longer just a storage issue. They are an exposure issue, an audit issue, and a spend issue. Practitioners should treat data sprawl as a control failure with measurable economic consequences.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: Identity and NHI Security Business Case Guide
What this signals
Board-ready ROI is now part of security governance. When a control programme can show reduced labour, lower cloud waste, and faster payback, it stops being framed as a discretionary spend item and starts being judged like an operating investment. For security and identity leaders, that changes how controls are prioritised, funded, and defended in front of finance.
Continuous governance beats periodic review in hybrid environments. The article points to a core operational shift: if data, AI workloads, and contractor-heavy environments change constantly, governance value comes from automation that keeps pace with the environment. That is the same logic driving broader interest in access visibility, entitlement control, and continuous discovery.
Third-party exposure remains a board-level blind spot. According to the Ultimate Guide to NHIs, 92% of organisations expose NHIs to third parties, raising concerns about supply chain security. In practical terms, any financial model that ignores external access paths will understate both the cost and the risk of data governance failure.
For practitioners
- Model security ROI in operating terms Translate labour saved, compliance effort reduced, and infrastructure avoided into a board-facing business case for data security controls.
- Measure governance labour by workflow Track how much analyst time is spent on classification, access review, and exception handling across production and non-production environments.
- Review cloud waste as a security problem Identify redundant or shadow data stores that increase both spend and exposure, then fold them into remediation prioritisation.
- Separate data movement from data visibility Prefer architectures that keep sensitive content inside the customer cloud account while exporting only labels and risk signals for governance.
- Connect AI governance to access governance Assess which AI and testing workloads can see sensitive data, then align entitlements, monitoring, and review ownership to those exposures.
Key takeaways
- The article argues that data security has to compete on measurable business outcomes, not just on control language.
- The TEI model attributes value to reduced manual governance, lower compliance burden, and avoided cloud waste in a large hybrid environment.
- For practitioners, the message is to tie data, access, and AI governance to the same operating and budget model.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The article is about framing security investment as measurable business risk and value. |
| PR.DS-01 — Data-at-rest is protected | The study is built around protecting sensitive data while keeping it in the customer's environment. | |
| Recommendation — Use risk-management metrics to present data security investments in board and budget discussions. Protect sensitive data in place and minimise unnecessary movement across environments. | ||
| CIS Controls v8 | CIS-3 — Data Protection | Data governance, classification, and exposure reduction are central to the article's value case. |
| Recommendation — Map sensitive-data handling to data-protection controls and measure the labour they eliminate. | ||
| NIST SP 800-53 Rev 5 | RA-3 — Risk Assessment | The TEI model turns operational changes into assessed business value and residual risk. |
| CA-7 — Continuous Monitoring | The article emphasises ongoing governance in fast-changing hybrid environments. | |
| Recommendation — Tie control investments to formal risk assessments that include labour, exposure, and cost impacts. Use continuous monitoring to keep data exposure and access governance aligned with environment changes. | ||
Key terms
- Total Economic Impact: A Total Economic Impact study estimates the financial effect of a technology investment by combining interview-based input, a composite organisation, and quantified costs and benefits. It is useful for budget conversations, but it remains a model, not a guarantee of realised results in every environment.
- Net Present Value: Net present value is the current worth of expected benefits after discounting future cash flows. In security buying decisions, it helps compare long-term gains against upfront and ongoing costs, making programmes easier to evaluate alongside other business investments.
- Hybrid Multicloud Environment: A hybrid multicloud environment is an operating model where an organisation uses more than one cloud platform and may also retain on premises systems. This mix improves flexibility, but it also complicates identity, secrets, auditing, and workflow integration because controls must work consistently across different technical boundaries.
- Governance Automation: Governance automation is the use of software-driven workflows to perform recurring compliance and access control tasks with less manual effort. In ERP and cloud environments, it helps standardise reviews, reporting, and exception handling while preserving oversight, evidence, and accountability for decisions.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It helps practitioners connect identity controls to the broader security and governance decisions their programmes depend on.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org