Just because it isn't easily calculated on an individual basis doesn't mean that it is impossible to figure out. If you know how much revenue your group provide

Just because it isn't easily calculated on an individual basis doesn't mean that it is impossible to figure out. If you know how much revenue your group provides to the company and then look at who contributes what relatively as a good enough estimate. Since you bring up a security team, it absolutely can be estimated there as well, what other companies have had hacks and what did it cost them? How does that compare to the risk on your product and the damage to the business if you were compromised? Not to mention a $40k salary difference means you should be providing multiple times that difference in value to the company. Just providing $40k of additional value is a rounding error for most reasonably sized companies, I've worked on projects where two people provided >$1M of ongoing cost savings per year.