To measure your security investment, you should calculate the number of dropped packets per month. At the bottom of the table, you should also write down the average cost of an attack. For example, if your website were attacked six times, the average cost per incident would be $1.2 million. Using the same calculation, you should be able to calculate your Return on Security Investment (ROSI) - a metric that measures how much money your security investment has saved you by preventing losses.

 

Some people argue that security is a zero-sum game - a losing proposition. In reality, security is not zero-sum because it can be a business enabler if you focus on the right areas. For example, a simple security chart can be provided to executives periodically. This is an excellent way to show executives how much they're saving with the security they're paying for. Security investments should be a percentage of the company's revenue.