The difficulty
The benefit of security is loss that did not happen. Organizations rarely disclose their own incident data, and the uncertainty is large. Those are the reasons program value so often goes unestimated.
The method here uses published sector figures and documented changes in practice. It needs no internal incident data.
The baseline
Annualized loss expectancy (ALE) is the annual rate of occurrence (ARO) multiplied by the single loss expectancy (SLE).
ALE = ARO * SLE
The worked example uses higher-education figures: a breach cost of $3.5 million and an annual frequency of 0.7, which give a base ALE of $2.45 million.
Three sources of value
A program reduces loss through three mechanisms, and each is modeled separately.
Coverage. Published data puts shadow data in 35% of breaches, at 16% higher cost, which makes it about 38% of total breach cost. If better coverage prevents or mitigates a quarter of that, ALE falls by 9.6%.
Planning. Risk-informed security planning changes how a breach unfolds. A branching activity model treats impact as the outcome of how well an organization responds, and assigns probabilities to poor, moderate and effective responses.
| Response | Cost | Probability before | Probability after |
|---|---|---|---|
| Poor: delayed, uncoordinated | $4.5M | 50% | 15% |
| Moderate | $3.5M | 35% | 45% |
| Effective: planned, rehearsed | $2.0M | 15% | 40% |
The expected cost of a breach falls from $3.775 million to $3.05 million. Add a modest 15% reduction in how often incidents become breaches, and ALE falls by about 31%.
Culture. The same model, applied to a security-engaged culture with faster and better-coordinated responses, also gives a reduction of about 31%.
Staying conservative
| Source | Modeled reduction | Confidence | Counted |
|---|---|---|---|
| Coverage | $235,200 | 80% | $188,160 |
| Planning | $769,300 | 60% | $461,580 |
| Culture | $757,050 | 70% | $529,935 |
| Subtotal | $1,179,675 |
Each estimate is discounted for confidence in its data and assumptions. The three work through largely independent mechanisms, so they can be added, but some overlap is likely. A further 20% is removed for that.
The result is about $944,000 a year, or 38.5% of the base ALE.
What the number is for
The estimate is a threshold more than a forecast. A program that delivers this reduction for less than it is worth can be justified. What Full Coverage Costs sets the traditional cost against it.
Sources
- IBM, Cost of a Data Breach Report 2024.
- Russell Cameron Thomas and others, How Bad Is It? A Branching Activity Model to Estimate the Impact of Information Security Breaches, 2013.
- National Institute of Standards and Technology, SP 800-39: Managing Information Security Risk, 2011.
- Ashley Bye, Defining and Developing a Model for an Engaged Information Security Culture, 2018.