The best approach in calculating the Return on Security Investment or the need to invest is by digging into the company's own past security incidents and their business impact expressed in monetary value (or legal impact). Avoid where possible qualitative approaches here, but go for quantitative ones (numbers, costs in EURO's). Whether we as security professionals like it or not Cybersecurity is and will be driven by Risk avoidance criteria's (lost revenue, additional legal costs, additional liabilities). Comparative market studies help (but are often driven by marketing FUD) BUT at the end of the road the only real value is how it affects the bottom line...

Show the finance team a simple simulation: take a potential threat, turn it into a risk, and demonstrate its impact in a sandbox environment. Highlight how it could disrupt operations or cause financial loss. This practical approach makes the risks real and underscores the need for investment.

Tomo sempre por base que o custo da segurança da informação não existe por necessidade propria. isto é, não faço um gasto de um projeto, novo controle ou similar para a própria segurança. Implemento controles para proteger a organização em relação aos seus objetivos corporativos e para a proteção operacional do negocio no que depende da informação. Sendo assim, tendo uma Gestão de Riscos, fica facil apresentar para a area de finanças que quem deve justificar o investimento em segurança são as áreas de negócio e o Corpo Diretivo. Simples assim. Mas reconheço que depende da maturidade organizacional.

The importance is evident when it comes to playing real time. It comes from within, the more you invest the sweeter it gets.

Cyber risk quantification can show the potential risk to the business and by how much each control can reduce the risk. This then becomes an ROI discussion. Additionally, some solutions can help to reduce bottom line cost like DSPM and SAM which can find unnecessary storage or unused licenses.

I would have a meeting with the finance team and talk about the following terms: 1-Explain how risk assessments can identify potential vulnerabilities in an organization's cybersecurity infrastructure, allowing you to target investments in the areas that will have the greatest impact. 2-Highlight the cost-effectiveness of risk assessments compared to the potential costs of a data breach. 3-Emphasize that risk assessments are a crucial part of an effective cybersecurity strategy, and can help to ensure that the organization's resources are being used efficiently. 4-Use real-life examples of companies that have suffered significant financial losses due to cyberattacks, to demonstrate the potential impact of not investing in cybersecurity.

Simply by demonestrating the damage if someone got access to financial data and manipulate it . What will be the damage cost ?

If your are hit by cyberattack unprepared, there is no further need to keep finance people around. Maybe except the one to handle liquidation process.