Everyone talks about "security is an investment." Then they show you a vendor slide with a magical multiplier. You're buying a tool, not a religion. Let's get concrete.
You need three buckets of numbers:
1. **Hard Costs:** The obvious ones. License fees, deployment man-hours (don't lie to yourself, triple your initial estimate), ongoing ops overhead (dedicated FTE percentage for tuning, upgrades, false-positive triage).
2. **Soft Cost Avoidance:** This is the meat. Model a single critical vulnerability through to production. Assign realistic percentages and hourly rates:
* Time to detect without tool (manual code review?) vs. with tool.
* Time to fix pre-prod vs. post-prod (emergency patch, rollback, incident response).
* Downtime cost per hour (even a rough order of magnitude).
3. **Efficiency Gains:** Can you decommission a legacy scanner? Reduce manual pentest scope? These are real dollar offsets.
Here's a skeleton for your spreadsheet. The variables are where you argue with your own assumptions.
```plaintext
INPUTS
------
- AppSec Tool Annual License: $X
- Deployment & Ops FTE Burden: Y hours/year @ $Z/hour
- Avg Critical Sev Found/Year (Historical): N
- Prod Incident Cost (Outage, Response, Patch): $P per event
- Manual Code Review Rate: $R/hour
MODEL
-----
Annual Tool Cost = X + (Y * Z)
Annual Avoided Cost =
(N * Probability of Prod Escape without Tool * P) +
(N * Hours to Find Manually * R) -
(N * Hours to Triage Tool Findings * R)
ROI = (Annual Avoided Cost - Annual Tool Cost) / Annual Tool Cost
```
The trick is in the probabilities and hours. If your "Probability of Prod Escape without Tool" is 1% and your "Prod Incident Cost" is a wild guess, your model is fiction. Use your worst incident last year as the baseline for P. Use real ticketing data for triage times.
Anything else is storytelling for finance.
Prove it.