a security business case the CFO reads to the end

A business case is the buyer’s document. It exists for people who were never in your sales cycle: the budget holder’s manager, the finance partner, procurement, sometimes a board. Your job is to help the champion write a credible one, on the buyer’s numbers, conservative enough to survive the first question from finance. For security, that means expressing value as a change in probable loss or a cheaper way to meet an obligation, never as an industry breach average multiplied by a guess.

a seller’s ROI slide can hurt

Gong reported that presenting ROI at any point in a sales process correlated with a 27% drop in close rates. Gong itself calls this a correlation and suggests a reason: ROI often appears as a last attempt to save a deal that is already failing. Either way, the number on your slide is not what moves the deal.

What tends to stop deals is fear of making a mistake. A case that reduces the buyer’s perceived risk does more work than one that raises the claimed return. Forrester reported in its 2026 State of Business Buying research that procurement is a decision maker in 53% of B2B purchase cycles. Procurement reads a large claimed return as room for a discount.

finance reads for the weak spots

A CFO reads a business case as a forecast made by an interested party, and looks for where it breaks. The questions are predictable:

1. What is the baseline, and where did it come from?
2. Which benefits are hard cash and which are soft productivity?
3. Who owns each benefit, and will that person put it in their own budget?
4. What are the total costs, including internal effort and costs after year three?
5. What happens if adoption is half the plan?
6. What are the alternatives, including doing nothing?

A case that answers all six on one page usually gets approved faster than a longer one that answers three.

everyone is optimistic about their own project

The best public evidence on technology forecasts is old but sobering. McKinsey’s 2012 work with the University of Oxford on more than 5,400 IT projects found that large projects delivered on average 56% less value than predicted. Those were large internal IT projects rather than software purchases. The direction still holds.

Public sector appraisal handles this openly. The UK Treasury’s Green Book requires appraisers to adjust for optimism bias from the start, by raising cost estimates and lowering benefit estimates. It also warns against the opposite trick: overstating the cost and risk of doing nothing to make the project look better.

Do the same in your case. Cut the benefits by a visible percentage, raise the costs, and show that the case still works. A seller who haircuts its own numbers gains credibility with finance that no ROI percentage can buy.

three honest ways to value security

1. riska change in probable lossHow often a loss event is expected, how large it could be across a range, and which of those the control changes.
2. compliancea cheaper way to meet an obligationWhere NIS2 or DORA requires a capability, compare ways of meeting it. Closer to a cost comparison than an ROI.
3. insurancea confirmed change in termsEligibility, premium or deductible, if the insurer confirms it in writing. The hardest number available.

Risk, framed with an explicit method. FAIR, the Factor Analysis of Information Risk, defines risk as the probable frequency and probable magnitude of future loss, and breaks both into factors that can be estimated. Its value in a sale is structural. It forces the case to say which factor your product changes: how often threat events happen, how vulnerable the organisation is to them, or how large the loss is once they happen. A privileged access control, for example, reduces the chance that a compromised credential becomes a significant loss. Say that, with a range, rather than a single saving.

Most years nothing serious happens, and occasionally something very costly does. A case that presents security value as a steady annual saving misrepresents how the risk behaves. Show a range.

Breach averages, used carefully. IBM and the Ponemon Institute’s Cost of a Data Breach Report 2026 puts the global average cost of a breach at USD 4.99 million. That is an average, pulled up by a few very large events, and it describes no specific buyer. Use it, or a sector median, as a reference point, then adjust with the buyer’s own incident history, regulatory exposure and size. Never use it as the buyer’s expected loss.

A sanity check on spend. The Gordon-Loeb model concluded in 2002 that, under its assumptions, the optimal investment to protect an information set does not exceed about 37% of the expected loss. Later research has challenged how general that bound is. It is still useful as a check: if the control costs more than the loss it is meant to reduce, the case won’t hold.

how to use a commissioned ROI study

Commissioned studies such as Forrester’s Total Economic Impact series follow a standard shape: a handful of customer interviews, chosen with the vendor’s help, combined into a fictional composite organisation, with benefits and costs modelled over three years and modest risk adjustments. Forrester’s own policy states it doesn’t endorse the vendor, and its studies tell readers to use their own estimates.

Use one well, and you gain trust. Label it as vendor-commissioned when you share it. Use its benefit and cost categories as a checklist for the buyer’s own model. And point out which benefits you think are least likely to apply to this buyer. That last step costs nothing and is rare enough to be noticed.

a one-page structure

Section	What it contains
Decision requested	What, how much, for how long, by when
Problem and baseline	The situation today, in the buyer’s numbers, with the source of each
Options	At least three, including doing nothing and the cheapest alternative
Value	Risk, compliance or insurance basis, as ranges, with a stated haircut
Total cost	Licences, services, internal effort, and years four and five
Sensitivity	The result if adoption is half the plan, or costs are 20% higher
Owners	Who owns each benefit and each cost line
Measures	What will be measured at 90 days and at renewal

The last row matters more than it looks. The baseline and measures you agree during the sale become the evidence at renewal.

the question for your champion

Who in your finance team will read this, and what was the last technology case they sent back?