Is our project rational?
Probably: a 51% chance the plan pays off
Today, losses over 3 years are over your tolerance from €319k up; with the plan they stay within it, for an expected cost of €876k.
Proposal
It is proposed to approve an investment of €876k for implementing and operating Immutable backups with tested restores, 24/7 managed detection and response (MDR), Third-party risk management and supplier continuity plans, and Change management with staged rollouts as the investment is expected to generate a positive RoSI.
Summary
The initiative reduces expected loss by €2.4M and lowers the probability of exceeding the €3M a year once-in-20-years tolerance over 3 years by 8 percentage points, from 10% to 1%, and brings losses within the whole tolerance curve (today over it from €319k up). Expected net value comes out at €1.5M, contributing to a RoSI likely between -156% and 382% (60% CI) and a 51% chance of positive return.
Investment, expected over 3 years
Cost
€876k
Risk reduction
€2.4M
Additional benefit
€0
Net value
€1.5M
RoSI
176%
P(RoSI>0)
51%
Risk, over 3 years
Expected loss
−64%
Worst case (P95)
−64%
P(Loss>Tolerance)
−8 pts
Expected duration
−42%
Against your tolerance, over 3 years
Over 3 years, losses pass 2 of your 3 limits more often than you accept today; with the plan, none.
| Losses above | You accept | Today | With the plan |
|---|---|---|---|
| €150,000 almost every year × 3 | 95% | 92% | 80% |
| €1,200,000 half the years × 3 | 50% | 62% | 32% |
| €9,000,000 once in 20 years × 3 | 5% | 10% | 1% |
| Whole curve | Over your tolerance from €319k up | Within your whole tolerance |
Your yearly tolerance × 3 years, compared with the total loss over the horizon.
Return on Security Investment
Project description
Investment includes 4 activities with an expected cost of €876k and an expected added benefit of €0. 4 activities have risk mitigation potential.
Based on 10,000 Monte Carlo iterations over the 3-year horizon.