The CFO's Guide to Security ROI: Quantifying Breach Prevention

Security spending is approved or denied in finance meetings, not in IT meetings. The CISO or technology lead presents a proposal; the CFO decides whether the investment is justified. In most Nigerian companies, the CFO makes this decision without a financial model — and so security budgets are either based on industry averages, last year's budget plus inflation, or nothing at all.

This is a framework for making the calculation properly.

---

Why "We Can't Afford a Breach" Is Not a Financial Argument

"We can't afford a breach" is a statement every CFO agrees with intuitively, but it does not help allocate capital. It does not tell you how much to spend, what to spend it on, or how to prioritise competing security investments.

The investment decision requires four numbers:

1. What is the probability of a breach in the next 12 months?
2. What would a breach cost?
3. What does the proposed control reduce that probability to?
4. What does the control cost?

If (probability × cost) > control cost, the control is justified on financial grounds alone.

This is the Annualised Loss Expectancy model, used by actuaries, insurers, and security professionals in mature markets. It is not complicated. It is just not the way most technology conversations are framed in Nigerian businesses.

---

What a Breach Actually Costs Nigerian SMBs

IBM's Cost of a Data Breach Report (2024 edition¹) is useful for global benchmarks, but Nigerian-specific data is thin. Based on NDPC enforcement records³, insurance claims from Nigerian insurers, and cases documented in the technology press, a realistic cost model for a Nigerian SMB (50–500 employees, ₦500M–₦5B annual revenue) looks like this:

Direct Costs

Incident response and forensics: ₦2M–₦8M An incident response engagement — identifying what was taken, how the attacker got in, and what systems were affected — requires specialist expertise. Local capacity is limited; the better firms charge accordingly.

Legal exposure: ₦500K–₦10M NDPC fines under NDPR range from warning letters to fines calculated as a percentage of turnover. For a business processing personal data at scale, even a modest fine plus legal defence costs is material.

Customer notification and support: ₦500K–₦3M NDPR requires notification to affected data subjects. For a customer base of 10,000+, drafting, sending, and managing responses to breach notifications is a significant operational cost.

System remediation: ₦1M–₦5M Depending on what was compromised, recovery involves re-provisioning systems, resetting credentials, and implementing new controls. This is engineering time plus any third-party cost.

Regulatory notification and audit: ₦500K–₦2M NDPC breach notification processing, potential audit engagement, and documentation costs.

Direct financial fraud losses (for fintechs and payment companies): Variable, but can dwarf all other costs combined.

Indirect Costs

Customer attrition: The most difficult to quantify but often the largest cost. Research consistently shows 20–30% of customers who receive a breach notification end their relationship with the affected company within 12 months. For a company with ₦2B ARR, 20% attrition is ₦400M in lost revenue.

Reputation damage and deal losses: Enterprise deals in negotiation are abandoned. Referral pipelines dry up. This is unrecoverable revenue that never appears in an incident cost model.

Key staff departure: A security incident is demoralising. Technical staff who could have prevented it (and know it) often leave. Recruitment and replacement costs compound.

Productivity loss: The average Nigerian tech company loses 15–20 working days per affected employee during a significant incident, across security review, system remediation, and communications work.

A Realistic Total

For a mid-market Nigerian technology company with 150 employees and ₦1B in annual revenue:

This is a conservative model. It assumes a mid-severity incident (no payment fraud), moderate customer attrition, and successful regulatory navigation. A worse outcome is plausible.

---

Calculating Your Specific Risk Exposure

The ALE model requires a probability estimate. This is where most financial models of security either give up or invent numbers. Here is a structured approach.

Step 1: Identify your threat profile.

A fintech processing card transactions has a fundamentally different threat profile than a construction company's project management system. Your threat profile is shaped by:

• Industry (financial services, healthcare, and professional services are higher targets)
• Public visibility (high-profile brands attract more targeted attacks)
• Data sensitivity (personal financial data, medical records, and authentication credentials are high-value targets)
• Attack surface (internet-facing systems, number of integrations, remote access points)

Step 2: Use base rates.

The Verizon Data Breach Investigations Report (DBIR)² provides industry-level breach probability data globally. For Nigerian companies, the NDPC's annual reports³ include sector-level incident statistics.

For a mid-market Nigerian fintech with standard internet-facing infrastructure and no mature security controls, a realistic annual breach probability is 15–25%.

For the same company with multi-factor authentication on all admin accounts, network segmentation between production and staff systems, and regular penetration testing, that probability drops to roughly 5–8%.

Step 3: Calculate ALE.

ALE = breach probability × expected breach cost

Without mature controls: 20% × ₦141M = ₦28.2M annual expected loss With mature controls: 6% × ₦141M = ₦8.5M annual expected loss

Annual risk reduction value: ₦28.2M − ₦8.5M = ₦19.7M

---

What Controls Produce That Risk Reduction

The 14–20 percentage point reduction in breach probability in the model above comes from a specific set of controls. Here is what delivers the majority of the risk reduction:

Multi-factor authentication on all privileged accounts (highest impact) Most successful breaches involve compromised credentials. MFA on admin accounts, cloud consoles, and infrastructure access blocks the most common attack path. Cost to implement: near zero for most cloud services; ₦200K–₦500K for an enterprise SSO implementation.

Privileged access management Limiting which staff have production system access and logging every privileged session eliminates the insider threat and significantly reduces the blast radius of a compromised account.

Network segmentation Separating production environments from office networks means a ransomware infection that starts on a staff laptop does not automatically spread to customer databases. Cost: primarily architecture and implementation time; ongoing cost is minimal.

Regular penetration testing An annual penetration test by a qualified external firm identifies exploitable vulnerabilities before attackers do. Cost: ₦1.5M–₦4M per engagement for a mid-market system.

Security monitoring and alerting The average time between an attacker gaining access and a company detecting the breach globally is approximately 194 days (IBM/Ponemon⁶), with Nigerian detection times estimated at 150–200+ days given lower adoption of monitoring infrastructure. Logging, monitoring, and alerting infrastructure reduces detection time dramatically, limiting breach scope and total cost.

---

Building the Business Case

If you are presenting this to a board or finance committee, the structure is:

1. Current risk exposure: Our estimated ALE without additional controls is ₦28M per year
2. Proposed investment: ₦6M over 12 months for the specified control set
3. Risk reduction: Expected ALE after implementation falls to ₦8M per year — ₦20M annual risk reduction
4. ROI: ₦20M risk reduction on ₦6M investment in the first year; the controls persist at maintenance cost thereafter
5. Cyber insurance impact: Demonstrable security controls reduce insurance premiums; expected annual saving of ₦300K–₦600K

The investment pays for itself in risk reduction terms in the first year. The ongoing cost (maintenance, monitoring, annual pen test) is approximately ₦2M–₦3M per year against ₦20M in sustained risk reduction.

---

The Conversation to Have This Week

If you are a CFO reading this, ask your technology lead these questions:

1. What is our current annual penetration testing schedule? When was the last external test conducted?
2. Which administrator and cloud console accounts have MFA enabled? Which do not?
3. What is our mean time to detect a security incident? Do we have any detection capability?
4. If a staff laptop were infected with ransomware today, which systems could it reach?

The answers to these questions will tell you immediately whether you have a ₦28M annual risk exposure or a ₦8M one. The gap between those numbers is the budget justification for your next security investment.

---

Related Articles

• Penetration Testing for Nigerian SMBs: What It Is, What It Costs, What You Get — A detailed guide to one of the highest-impact security investments referenced in this article, including Nigerian market pricing and vendor evaluation.
• Building a Zero-Trust System on a Startup Budget — How to implement the core security controls that drive the risk reduction modelled in this article, for under ₦4.5M.
• From Reactive to Proactive: Security Automation That Pays for Itself — The specific automated monitoring controls that reduce breach detection time from months to minutes.

---

Sources

1. IBM Security, Cost of a Data Breach Report 2024 — global breach cost benchmarks and industry breakdown. ibm.com/reports/data-breach
2. Verizon, 2024 Data Breach Investigations Report (DBIR) — industry-level breach probability data and attack vector analysis. verizon.com/dbir
3. Nigeria Data Protection Commission (NDPC), Nigeria Data Protection Regulation (NDPR) 2019 — breach notification requirements, registration obligations, and penalty framework. ndpc.gov.ng
4. National Pension Commission (PenCom), Pension Reform Act 2014 — employer/employee contribution rates and late remittance surcharge provisions. pencom.gov.ng
5. NIST, Cybersecurity Framework (CSF) 2.0 — risk management framework referenced in control prioritisation. nist.gov/cyberframework
6. Ponemon Institute / IBM, Cost of a Data Breach: Mean Time to Identify and Contain — detection time benchmarks used for Nigerian estimates.