Business & Policy
Return on security investment
Return on security investment compares expected risk reduction and operational benefit with the full cost of a control.
Why it matters
The most credible model combines scenario ranges with technical evidence from the organisation’s own software and product lifecycle.
In brief
Return on security investment compares expected risk reduction and operational benefit with the full cost of a control. For CHERI, the analysis should support a decision under uncertainty, not promise a precise financial return from sparse incident data.
Key considerations
1. Exposure
Estimate relevant incident likelihood and consequence using internal defect, vulnerability and operational data.
2. Effect
Model how prevention, fault detection and containment change each scenario; avoid assuming every memory-safety failure disappears.
3. Investment
Include evaluation, hardware, porting, skills, assurance, coexistence and ongoing maintenance, with timing and confidence ranges.
Evidence and caveats
Low-frequency, high-consequence events make point estimates unstable. Show sensitivity to the assumptions that drive the result.
Show assumptions, ranges, dates and owners for economic or policy claims. Recheck legislation, guidance, product status and prices at the decision date.