Which of the following is the BEST way to express the value of financial investments in cybersecurity?

Payback period only measures the time it takes for an investment to recoup its initial cost, not its overall value or profitability, especially for risk mitigation.

Cost-benefit analysis is the best method because it systematically identifies and quantifies both the costs of implementing cybersecurity controls and the benefits derived from reducing risks and avoiding potential losses. It directly addresses the "value" by showing the return on investment in terms of mitigated damages and enhanced business operations.

Net present value (NPV) quantifies the present value of future cash flows, which is useful for profitability but doesn't inherently capture the qualitative or hard-to-quantify benefits of cybersecurity risk reduction without significant estimation.

Internal rate of return (IRR) is a discount rate that makes the NPV of all cash flows from a particular project equal to zero; it's a profitability metric but less direct for expressing the broad value of cybersecurity's risk mitigation.