"I'm afraid that the InfoSec community has been unsucessfully persuing the idea of "RoI" for security activities for a long time (I remember debating the idea 1

"I'm afraid that the InfoSec community has been unsucessfully persuing the idea of "RoI" for security activities for a long time (I remember debating the idea 10+ years ago..)" I've always suggested they focus on confidence in control of assets and IT. The upper management are usually control freaks that like knowing what's happening is what they want to happen. A good, security program puts them in control of the businesses assets. A bad, security program puts a 14 yr old troll or competitor wanting their marketing/I.P. in control. A list of their asssets, esp those easy to move, next to the cost of a reasonable security program is next move. I'd love to see more data on attempts at doing this along with the responses. I know the scheme has already worked for people selling life insurance. I learned it from one of them. Might help on security since ROI is a dead end for most companies.