Why proving ROI is hard, and how to do it honestly
The reason most security awareness teams cannot prove ROI is not that the value is not there. It is that they measure the wrong thing. Training completion and click rates are activity metrics. They tell you something happened, not whether risk went down. SANS research across more than 2,700 practitioners found only about 12 percent can demonstrate ROI. The other 88 percent are doing real work with no defensible number to show for it.
The model behind this calculator
Honest ROI starts from expected loss: how many human-driven incidents you see in a year, multiplied by what each one actually costs you. A more mature program reduces the likelihood of those incidents. The avoided loss is that expected annual loss multiplied by the reduction you can credibly attribute to the program. Subtract program cost, divide by program cost, and you have an ROI figure that survives scrutiny because every assumption is visible.
Be conservative on purpose
The fastest way to lose a CFO is an inflated reduction percentage. Use a number you can defend, ideally tied to your own incident trend before and after program changes. A defensible 20 to 30 percent beats an unprovable 70 percent every time. The point of showing the math is that the conversation moves from "trust me" to "here are the inputs, challenge any of them."
From a number to evidence
A calculator gives you a business case. Defending it over time requires showing the program is genuinely maturing, not just busier. That is what a SEAT maturity assessment provides: a structured, dated baseline across Strategy, Engage, Assess, and Train that ties spending to measurable improvement, so next year's ROI claim rests on evidence rather than a spreadsheet.