Topic starter
10/07/2026 9:10 pm
TL;DR: Cybersecurity spending keeps rising, with Gartner putting worldwide information security spend at $193 billion in 2024 and projecting $240 billion in 2026, according to Illumio, while breach costs and incident impact continue to climb. The model is broken because it measures activity and prevention promises instead of resilience and expected loss reduction.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “More Spend, More Breaches: The Uncomfortable Truth About Cybersecurity ROI”.
Key questions
Q: What breaks when cybersecurity programmes are measured by activity instead of outcomes?
A: They produce reassurance without proof.
Q: Why does tool proliferation often fail to improve real security coverage?
A: Because separate tools rarely create a complete control picture on their own.
Q: How should security leaders measure whether resilience investments are working?
A: They should look at the business consequences of incidents, not just the presence of controls.
Practitioner guidance
- Rebase security reporting on resilience metrics Replace tool counts and training completion rates with measures of containment time, outage duration, and recovery cost after incidents.
- Quantify expected loss reduction Translate major controls into reduced annual loss by linking each to lower business interruption, reduced remediation cost, and smaller blast radius.
- Build board cases from real incident benchmarks Use public examples such as prolonged retailer outages to show how your architecture would reduce downtime from weeks to hours.
Bottom line: Cybersecurity ROI weakens when programmes are judged by activity, because activity does not show whether the organisation is safer or cheaper to recover.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:33 pm
Cybersecurity ROI has been measured against the wrong unit. Activity metrics can tell executives what the security team did, but they cannot show whether the organisation is harder to exploit or cheaper to recover. That is why boards keep seeing spend rise while confidence in security outcomes falls. The practical conclusion is that governance must move from control counting to loss reduction.
A question worth separating out:
Q: When should boards prioritise resilience over prevention-only security metrics?
A: As soon as breach probability is no longer the main question and business impact becomes the deciding factor. In mature environments, the board needs to know how much loss a control removes, not whether the control promises to stop every attack.
👉 Read our full editorial: Cybersecurity ROI is broken as spend rises and breaches worsen