An organization has been the target of four phishing attacks in the last year. Each incident has cost the organization an average of $2,000. A security director researches additional anti- phishing…

Product 1 does not produce as favorable a ratio of prevented losses to product cost as Product 2 when ROI is calculated.

ROI for a security control is calculated by subtracting the product cost from the reduction in Annual Loss Expectancy (ALE) it provides. With 4 incidents per year averaging $2,000 each, the current ALE is $8,000. Product 2's detection rate applied to the 42,000 sample messages produces the largest gap between prevented losses and product cost, yielding a higher net return than any other option offered.

Product 3's detection effectiveness or price point does not yield a net return that exceeds Product 2's ROI.

Product 4 either costs too much relative to the losses it prevents or detects too few phishing attempts to surpass Product 2's total ROI.

Product 5 does not achieve the best cost-to-benefit ratio when its detection rate and cost are measured against the current annual loss exposure.