Security ROI

Return on security investment is largely unmeasurable, because the benefit is an absence.

You cannot count the breaches that did not happen, and any figure claiming to has assumed the answer. That does not make the spending unjustifiable; it means the justification has to be about reduced likelihood, reduced impact and preserved options rather than a return calculation dressed up as finance.