How do you demonstrate the value of an investment that, ideally, prevents an incident from happening? For an SME, measuring the return on cybersecurity investment is not about promising immediate financial gain. This involves linking protective measures to better controlled risks, a prepared recovery and business continuity.
To make a decision, you need concrete benchmarks: which services to protect as a priority, which indicators to monitor and how to present the results to management? A security measure does not always translate into a directly observable financial result. Comparing prevention, detection, response and continuity therefore requires a common framework, adapted to the activities of your company.
This guide offers you a practical method for comparing scenarios, estimating potential losses avoided and monitoring reevaluable indicators. You will see how to take into account business interruptions, data protection and FADP, while integrating Swiss data sovereignty into your thinking. The objective is to decide with greater clarity, without confusing risk control and guaranteed return.
Key Points
- Evaluate cybersecurity ROI by considering reduced risks and business continuity, not just direct financial gains.
- Choose metrics that your SMEs can actually track, such as observed outages, recovery test results, and access control.
- Compare prevention, detection, response and recovery according to their objective, indicators and interpretation limits.
- Build a defensible method from internal data, separating observed facts from assumptions.
- Link security audit, protection measures, backups and DRP to better prepare for the continuity of your business.
Table of Contents
- Return on cybersecurity investment: what does ROSI really measure?
- What benefits of reinforced cybersecurity can an SME follow?
- How to compare cybersecurity investments without reducing the decision to ROI alone?
- How to establish a method for calculating defensible cybersecurity ROI?
- How does Flux Group help SMEs connect cybersecurity and continuity?
Return on cybersecurity investment: what does ROSI really measure?
For an SME in Geneva or Switzerland, evaluating cybersecurity does not amount to considering a protection measure as a financial investment. The useful question is rather: what results can we observe, and what risk is the company seeking to better control? This distinction avoids expecting a security tool to directly generate revenue. It also makes it possible to present a decision based on operational objectives, explicit hypotheses and elements that management can re-examine.
ROI and ROSI: two readings of the value
The ROI, or return on investment, compares the results attributable to an investment with the resources mobilized, over a defined scope and period. In a commercial activity, these results can take the form of additional income. In cybersecurity, this reading remains useful, but it is not enough: effective protection does not necessarily produce sales directly attributable to its deployment.
ROSI, or return on investment in security, completes this analysis by estimating the extent to which a measure reduces exposure to a risk and the associated potential losses. This logic is part of risk management, presented in the article Risk management. To give meaning to the result, specify what is being evaluated, the period observed and the hypotheses used. A measure intended to limit the risk of interruption, for example, is not judged in the same way as an action aimed at reducing unauthorized access.
A security audit can help establish a baseline: systems concerned, protections in place and points to be addressed. This basis then facilitates the comparison between the initial situation and the indicators monitored. It also helps to avoid automatically attributing each evolution to a single measurement.
Why cyber performance is not a promise of profit
Three notions must remain distinct. A generated income is a result actually observed and attributable. An avoided potential loss is an estimated scenario, such as an interruption that could have affected an essential service. The ability to continue activities describes operational resilience: maintaining priority processes or organizing disaster recovery. These benefits can inform a decision, but they are not interchangeable.
An incident avoided is not directly observable. The company cannot know for sure what would have happened without the security measure. To remain rigorous, describe the scenario, indicate the hypotheses and separate observed facts from estimates. For example, the actual time needed to restore a service can be measured during a test. The number of interruptions that would have been avoided remains a projection.
ROSI is an estimate of the value associated with risk reduction, never a guarantee of financial gain or absence of incident. The return on cybersecurity investment thus becomes a decision-making tool: it allows you to compare options and explain the value of protection, while recognizing the limits of what can be measured.
What benefits of reinforced cybersecurity can an SME follow?
To know if your protections are progressing in the right direction, choose indicators linked to the tasks and systems on which your SME depends. A useful indicator answers a specific question: are the positions concerned protected, does access correspond to roles, and can priority services be restored according to the planned objectives? These benchmarks are easier to leverage than an overall safety score because they show where action is needed.
Organize the dashboard around three areas: equipment protection, access control and continuity preparation. For each indicator, indicate who is responsible, its source and its review frequency. You will then be able to check the results with the teams concerned and decide on any adjustments to make.
Protection and detection indicators
For workstations, track EDR coverage, i.e. the share of targeted equipment that has a detection and response tool. Also identify the positions that are not covered and the reasons for their exclusion. This survey reveals the blind spots of the IT equipment and helps plan their treatment.
For alerts, measure the stages of your internal procedure: handling, qualification and closure. These delays are useful if their definition remains stable and if events are recorded consistently. Complete them with the number of pending alerts and the corrective measures still open. The volume of events analyzed by a tool or service is not enough, on its own, to demonstrate better protection.
Access control deserves separate monitoring. Document accounts reviewed, rights adjusted, and unused accounts deactivated, linking these actions to systems that contain sensitive information. The objective is to verify that access corresponds to current responsibilities, particularly after a change of function or departure.
Continuity, recovery and stakeholder trust
For essential services, track recovery test results: data recovered, steps passed, and challenges encountered. Link each test to the relevant activity, for example resuming access to documents needed to process orders. The DRP should clarify priorities and responsibilities so teams know what to restore and in what order.
Also document the actual interruptions that occurred, the services affected, and the steps taken to restore operations. This information helps target improvements and prepare discussions with management, customers or partners concerned. For a Geneva SME, data location and FADP compliance may also be part of the criteria, depending on the information processed and the company's commitments.
By linking protection coverage, access management and test results to priority activities, you obtain concrete benchmarks to manage your security measures over time. This monitoring gives the return on cybersecurity investment an operational anchor, adapted to the reality of your SME.
To structure this monitoring around your activities and your protections, discover the support of the Flux Group team.
How to compare cybersecurity investments without reducing the decision to ROI alone?
No two cybersecurity measures necessarily address the same risk. Comparing them solely on the basis of financial performance can therefore lead to favoring an attractive figure rather than the protection that your business really needs. For an SME in Geneva or Switzerland, evaluate each option according to its objective, the targeted exposure, the available indicators and the limits of what they allow to conclude.
Compare the levers according to the risk they address
Prevention, detection, response and recovery are complementary capabilities. A next-generation firewall and email filtering help to better protect access and exchanges. The EDR, installed on workstations, aims to detect and treat threats on this equipment. Immutable backups, recovery tests and the DRP, or disaster recovery plan, prepare for the return to operations after an incident. None of these levers alone replaces the others.
| Lever | Objective and targeted exposure | Possible tracking indicator | Limit of interpretation |
|---|---|---|---|
| Prevention | Reduce the exposure of access and exchanges | Planned measures deployed, coverage of affected systems | Implementation does not prove that an incident would have been avoided |
| Detection and response | Identify abnormal activity and organize its treatment | Detection and processing times, if the data is reliable | Alert volume alone does not measure risk reduction |
| Resumption | Prepare to restore priority data and services | Restoration test results and recovery goals defined | A successful test does not guarantee an identical recovery in a real situation |
This framework avoids categorizing solutions as if they were interchangeable. An SME that depends on a system essential to invoicing does not necessarily have the same priorities as a company whose activity relies primarily on the confidentiality of files. An FADP security and compliance audit can help balance existing protections, the data involved and business needs. THE Flux Group cybersecurity services are part of this evaluation logic adapted to the context of the company.
Choose comparable and honest indicators
Before comparing results, establish a reference: perimeter covered, status of measurements and observation period. Distinguish between means indicators, such as workstation coverage or deployment of a control, and observed results, such as a documented interruption or the result of a tested restoration. Keep the same definitions from one journal to another so that differences are interpretable.
Finally, record the assumptions and unknowns. A measure can reduce exposure without making the risk zero or guaranteeing a return. The return on cybersecurity investment therefore informs a trade-off, but does not provide a universal ranking: the priority depends on the processes to be protected, the data processed, the applicable obligations and the ability of the company to continue its activities.
How to establish a method for calculating defensible cybersecurity ROI?
A useful calculation begins with clear boundaries. It is not a question of producing a figure which would give artificial certainty, but of comparing a reference situation to a security scenario, then of documenting what is observed and what remains estimated. For an SME, the method must be based on accessible data, explicit hypotheses and a reviewable decision.
Define the scope and the reference situation
Start by delineating the assessment: which services, data and business processes are affected? An activity that depends on customer files or a management system does not have the same priorities as an activity based on other tools. Then identify controls in place and known inventory gaps. For an SME in Geneva, also take into account, depending on the data processed, FADP compliance and Swiss data sovereignty.
A security audit can help establish this baseline. Note the protections actually deployed, existing procedures and dependencies with external services. If the inventory is incomplete, record this limit instead of hiding it. The quality of the comparison depends first of all on that of the starting point.
Estimate, document and review results
Then describe the scenario assessed: the targeted risk, the processes likely to be affected and the measures envisaged. For each assumption, indicate its origin, for example an internal incident history, a recovery test, or an analysis conducted during the audit. Separate these estimates from the measured facts. If other changes have taken place at the same time, do not automatically attribute a favorable development to a single measure.
- Secure the perimeter. Identify affected systems, data, users and activities.
- Establish the baseline. Describe existing controls, documented incidents, and limitations of your data.
- Formulate the scenario. Specify the risk addressed and its possible effects on operations, without presenting a hypothesis as a fact.
- Choose the indicators. Retain trackable metrics, such as protection coverage, test results, or outages actually logged.
- Compare and validate. Present the discrepancies with the reference to IT and business managers, distinguishing between observations and projections.
- Reconsider the decision. Revise the scenario when processes, data or security measures change.
The review must lead to an understandable decision: maintain the measure, adapt it or reassess its priority. Maintain indicator definitions and assumptions used so that management can track progress over time. This traceability, more than an isolated result, makes the evaluation of the return on cybersecurity investment defensible.
To structure this assessment around your risks, your protections and your activities, check out the Flux Group team.
How does Flux Group help SMEs connect cybersecurity and continuity?
Based in Geneva, Flux Group SARL supports SMEs in their cybersecurity and IT continuity challenges. Its approach links the state of protections to the activities to be preserved, then to preparation for recovery. Companies in Geneva, Meyrin, Vernier, Eaux-Vives, Collogny, Grand-Lancy and Petit-Lancy can rely on this local expertise to examine their priorities. This approach helps organize decisions without promising financial returns or the absence of incidents.
Moving from a reference state to a security plan
An FADP security and compliance audit makes it possible to establish an inventory of the systems concerned, the data processed and the protections in place. This base helps define priorities based on business needs and Swiss data sovereignty issues.
The measures are then linked to the identified risks. A next-generation firewall helps protect network exchanges, EDR targets detection and response on workstations, and email filtering helps limit exposure to malicious messages. Each device meets a particular objective. Its implementation does not constitute, in itself, proof of a reduction in incidents. Check out the Flux Group IT and cybersecurity services to understand how these measures fit into an approach adapted to your SME.
Prepare continuity and discuss with an expert in Geneva
Preparing for recovery also involves backups and their verification. The 3-2-1-1-0 rule is a broad strategy: three copies, two media, one offsite copy, one immutable copy and zero errors. Flux Group offers encrypted, immutable and air-gapped backups, with test restores. These tests make it possible to note the results and the difficulties encountered, while the DRP organizes the return to service of priority activities.
These elements help IT and business managers to specify recovery actions and monitor areas for improvement, taking into account data and processes essential to the business. To provide further context, the guide to business cybersecurity in Switzerland complements the benchmarks discussed here.
Make your next review a starting point
To get started, choose a priority business process and designate the people who can monitor its indicators. Set a baseline, document the limits of available data, then schedule a review date. This framework gives your management a concrete basis for deciding what to strengthen, maintain, or reexamine, without presenting an assumption as a given.
The return on cybersecurity investment thus becomes an evolving decision tool. As your activities, data or priorities change, you can adjust the metrics and re-evaluate their relevance. The main thing is to keep the link between protection, continuity and the real needs of your SME.
To evaluate your priorities and link them to the continuity of your activity, contact Flux Group.
Frequently asked questions about cybersecurity performance
Can we calculate the ROI of cybersecurity without having suffered an incident?
Yes. You can start with a tabletop exercise: choose a relevant scenario, such as the unavailability of a management tool, and ask the relevant managers what decisions would be necessary. This exchange may reveal dependencies or responsibilities that need to be clarified, even without an incident history. Record findings as planning elements, not as proven losses or savings already made.
How often should the performance of cybersecurity measures be reassessed?
Include this reassessment in your management calendar, for example when preparing the budget or reviewing IT projects. This connects security decisions to business planning cycles, rather than treating the topic in isolation. If a new activity or tool change changes responsibilities, add this item to the agenda for the next review.
Can cyber insurance replace an investment in cybersecurity?
No, it does not replace protection and preparation measures. To compare its role with that of IT controls, examine the contractual conditions, exclusions and procedures planned in the event of a disaster. Then assign each device a distinct function in your management plan: reduction of exposure, organization of response or transfer of certain risks according to the contract.
Does FADP impose a precise method for calculating cyber ROI?
For your budget decision, present the financial calculation as a management tool, and not as sufficient proof of compliance with FADP. In the same file, separately identify the data protection issues to be examined and the financial elements used to arbitrate. If the application of the law to a specific situation is uncertain, have this interpretation validated by a person competent in data protection.
What indicators should be presented to management to justify a cybersecurity measure?
Present each indicator with its manager, its source and the decision it should inform. A one-page sheet can, for example, associate a business issue with the current state of the system, the points still open and the next proposed action. This format helps management distinguish a problem requiring arbitration from an operational task that the IT team can handle in its daily monitoring.
Is the performance of a cybersecurity solution the same for all SMEs?
No. The comparison varies depending on IT dependencies, data processed and how the company provides its services. To make the evaluation concrete, describe a precise business journey, from the first step to the service provided to the customer, then identify the tools and stakeholders on which it depends. This mapping helps to avoid taking over the priorities of another SME without checking their relevance for your organization.
Article by
Delyan TZONEV
Passionate entrepreneur and manager, I am CEO of Flux Group and Hype Swiss. I support companies in their digital transformation thanks to innovative solutions in IT, telecommunications and software development. My goal is to design high-performance technologies that simplify the daily lives of businesses and support their growth.
Disclaimer
The articles published on the Flux Group blog aim to share our expertise, our field experience and best practices in IT, cybersecurity, cloud, telecommunications and digital transformation of SMEs.
We strive to provide reliable, up-to-date and relevant information at the time of publication. However, technologies, regulations and service offerings are evolving rapidly. The published content is therefore provided for informational purposes and does not constitute personalized, legal, tax, financial or technical advice.
Each company has specific needs, we recommend that you seek professional support before making a decision or implementing a solution presented in our articles.
The opinions, recommendations and comparisons published on this blog reflect our analysis and experience. When we talk about partners or publishers such as Microsoft, Swisscom or Infomaniak, our objective is to present the solutions objectively, highlighting their advantages as well as their limitations depending on the different contexts of use.
Flux Group cannot be held responsible for any direct or indirect consequences resulting from the use of the information published on this blog. Links to external sites are provided to complete the information; their content is the responsibility of their respective publishers.
© Flux Group – All rights reserved.
Our services
If you wish to be supported in the choice, deployment or optimization of your IT solutions, the Flux Group experts are at your disposal. We support SMEs in Geneva, Switzerland and Pays de Gex in their Microsoft 365, cybersecurity, cloud, telecommunications, managed IT services and IT infrastructure projects.
Questions fréquentes
Can we calculate the ROI of cybersecurity without having suffered an incident?
Yes. You can start with a tabletop exercise: choose a relevant scenario, such as the unavailability of a management tool, and ask the relevant managers what decisions would be necessary. This exchange may reveal dependencies or responsibilities that need to be clarified, even without an incident history. Record findings as planning elements, not as proven losses or savings already made.
How often should the performance of cybersecurity measures be reassessed?
Include this reassessment in your management calendar, for example when preparing the budget or reviewing IT projects. This connects security decisions to business planning cycles, rather than treating the topic in isolation. If a new activity or tool change changes responsibilities, add this item to the agenda for the next review.
Can cyber insurance replace an investment in cybersecurity?
No, it does not replace protection and preparation measures. To compare its role with that of IT controls, examine the contractual conditions, exclusions and procedures planned in the event of a disaster. Then assign each device a distinct function in your management plan: reduction of exposure, organization of response or transfer of certain risks according to the contract.
Does FADP impose a precise method for calculating cyber ROI?
For your budget decision, present the financial calculation as a management tool, and not as sufficient proof of compliance with FADP. In the same file, separately identify the data protection issues to be examined and the financial elements used to arbitrate. If the application of the law to a specific situation is uncertain, have this interpretation validated by a person competent in data protection.
What indicators should be presented to management to justify a cybersecurity measure?
Present each indicator with its manager, its source and the decision it should inform. A one-page sheet can, for example, associate a business issue with the current state of the system, the points still open and the next proposed action. This format helps management distinguish a problem requiring arbitration from an operational task that the IT team can handle in its daily monitoring.
Is the performance of a cybersecurity solution the same for all SMEs?
No. The comparison varies depending on IT dependencies, data processed and how the company provides its services. To make the evaluation concrete, describe a precise business journey, from the first step to the service provided to the customer, then identify the tools and stakeholders on which it depends. This mapping helps to avoid taking over the priorities of another SME without checking their relevance for your organization.
Besoin d'un accompagnement IT à Genève ?
Parlons de votre infrastructure, de votre sécurité ou de votre téléphonie. Sans engagement.
Contacter Flux Group