It doesn’t happen often, so I am compelled to point out the excellent work done by Matthew Rosenquist at Intel on how implementing three security programs led to $18 million in loss avoidance, based on empirical data. A real-life Return on Security Investment, albeit different from the way I calculate it. He even had the foresight to collect the information before the programs commenced.

Nice job!