Security teams should explain cyber value in terms executives can act on: potential financial exposure, disruption to important services, resilience, and the effect of security work on those outcomes. Vulnerability counts and patch rates can show activity, but alone they do not tell leaders which business services are safer or how much impact has been reduced.
What it means to measure cyber value
A useful security update answers more than “How much work did we complete?” It addresses questions such as “What would a breach actually cost us?” and “How much risk have we taken off the table?” The aim is to connect a specific exposure and a security intervention to a business consequence—not to translate every technical metric into a dollar figure.
For a finance leader, that means distinguishing among possible loss, spending that may be reduced, and time or effort saved. It also means showing the assumptions behind any estimate so a modeled benefit is not mistaken for money already saved.
The Business Value Assessment framework
A 2025 contributed article by David Lettvin, Inside Channel Account Manager at XM Cyber, proposes a Business Value Assessment (BVA) to connect exposures with likely costs and security actions with outcomes. The article is vendor-contributed and promotes XM Cyber’s ROI Calculator; treat BVA as the author’s proposed approach, not an independently validated standard. Its three categories can help organize an assessment:
#1 Best Overall
Cost avoidance
Estimate the potential loss associated with a defined exposure and how prioritized remediation could reduce that exposure. This is a modeled avoided-loss estimate, not a claim that the organization has earned or saved the full amount.
Cost reduction
Identify actual spending or effort that a security change may lower—for example, manual work or the scope of testing. Separate documented reductions from expected ones, and specify the period and costs included.
Efficiency gains
Estimate time and effort saved through better prioritization or appropriate automation. Explain whose time is affected and how the estimate was calculated; time released is not automatically a cash saving unless it changes expenditure or capacity use.
Build estimates executives can scrutinize
For each estimate, define the asset and business service in scope, the threat or loss scenario, the likelihood and impact assumptions, the time horizon, and the uncertainty range. Record the evidence behind each assumption and distinguish observed costs from modeled estimates. A useful assessment should let finance, operations, and security teams challenge the inputs rather than rely on a single precise-looking total.
- Map exposure to a service: identify which business-critical process depends on the affected asset.
- Describe the scenario: state what could happen, such as service interruption, response costs, or recovery work, without treating every scenario as equally likely.
- Show the intervention: specify the proposed remediation and the change in exposure or recovery capability it is expected to produce.
- Make uncertainty visible: disclose the estimate range, time period, and important assumptions.
- Check against internal records: compare estimates with incident, finance, and operational data where available.
Use breach-cost benchmarks carefully
IBM’s 2025 Cost of a Data Breach report put the global average breach cost at USD 4.44 million, 9% below its 2024 figure. IBM’s 2026 report put the global average at USD 4.99 million. These are report-level averages, not forecasts for an individual company; the two figures refer to different report years and should not be blended into one estimate. IBM’s 2025 report and IBM’s 2026 report provide the benchmark context.
IBM’s 2026 report also associated extensive security AI and automation use with USD 1.93 million in average breach-cost savings compared with no use. That is a study comparison, not proof that adopting a particular product will cause the same saving or deliver a specific return to any one organization. Industry, geography, incident type, company size, detection and response capability, and downtime exposure can all affect an organization’s impact.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Turn the assessment into a decision
Business framing is useful when it helps leaders choose among actions, fund a control, or accept a clearly described risk. Before relying on a BVA or calculator output, ask whether it maps estimates to business-critical services; includes financial, operational, and resilience effects; discloses its evidence, assumptions, time horizon, and uncertainty; ties remediation to a measurable change in exposure or recovery; and can be checked against internal data.
Lettvin’s article names XM Cyber’s online ROI Calculator as a call to action. Its inclusion is an example of a vendor’s assessment framing, not independent validation of the calculator or a recommendation to use it. The original contributed article is available at The Hacker News.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
