Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteTo make an identity-security proposal financeable, price a specific business scenario—not “identity risk” as a universal number. Map a compromised account to the services it can reach, estimate the resulting losses with your organization’s own data, show the assumptions and uncertainty, then compare controls by cost and the exposure they reduce.
What should the estimate measure?
Measure the financial consequences of a plausible identity compromise to your organization, not the abstract value of identity security. The scenario might involve a stolen employee account, misuse of a privileged account, a supplier login, or business email compromise (BEC). Each can lead to a different business impact.
As an Amazon Associate I earn from qualifying purchases.
Start with the assets and services that support mission objectives. NIST’s 2025 guidance says business impact analysis (BIA) helps determine impact values and protection requirements, and provides a foundation for integrating cybersecurity risk management with enterprise risk management. Use that framing to keep the estimate tied to business services and their criticality, rather than a count of accounts or security alerts. Read NIST’s BIA guidance.
Recommended Free Tools
How to build a scenario-based estimate
- Choose a credible event. Define whose identity is compromised, how access is obtained or misused, and what the attacker could do. For example: an attacker takes over an accounts-payable employee’s email, uses an existing vendor conversation to change payment instructions, and redirects an invoice.
- Trace the access path. Map the identity to the applications, data, workflows, and business services it can reach. Include supplier and partner access where it connects to your environment. Verizon reported that third-party involvement doubled to 30% of breaches in its 2025 release; that observed share is a reason to examine external access, not a forecast of your organization’s likelihood of an incident. See Verizon’s 2025 release.
- List the consequences. Estimate direct fraud or extortion loss, investigation and recovery effort, interrupted operations, delayed transactions, and legal or notification costs where applicable. Add other documented financial effects that fit the scenario. Avoid counting the same cost in multiple categories.
- Use local inputs and ranges. Draw on your incident records, finance data, response estimates, workflow dependencies, and business-impact analysis. Where the amount or duration is uncertain, show low, central, and high cases with the assumptions behind each. Do not fill data gaps with a generic industry figure presented as your own exposure.
- Separate impact from likelihood. A single-event loss estimate answers “what could this event cost?” An annualized estimate also needs a defensible estimate of how often it could happen. If your organization cannot estimate frequency credibly, present the scenario impacts and say that probability is not established; do not manufacture an annual loss figure.
- Show what can be recovered. Distinguish gross potential loss from amounts that might be recovered or insured. State the conditions and uncertainty attached to recovery, and show the gross exposure as well as any supported net estimate.
What public breach figures can—and cannot—tell you
Verizon’s 2025 Data Breach Investigations Report release says credential abuse was an initial attack vector in 22% of confirmed breaches in its dataset of 12,195 confirmed breaches and more than 22,000 security incidents. The edition covers incidents from November 1, 2023 through October 31, 2024. This is evidence that credential abuse is a significant observed pathway; it is not the probability that your company will suffer one. Verizon’s 2025 release and its 2025 DBIR page provide the report context.
#1 Best Overall
BEC offers a concrete example of how identity compromise can become a business loss. Verizon’s 2026 Breach Impact Study describes attackers using a stolen email chain to impersonate a vendor or partner and redirect invoice payments. It reports that BEC represented 12% of DBIR data for the study’s 2019–2025 window. In the study’s insurance-claim analysis, median economic loss hovered around the mid-$50,000 range, response and recovery accounted for 64% of total claim dollars, and occasional incidents reached around $10 million. These figures describe that study’s data, not a typical outcome or expected loss for an individual organization. Read Verizon’s 2026 Breach Impact Study.
How to compare proposed controls
Compare each option against the same scenario and decision criteria. A control’s value depends on which identities and systems it covers and how it changes the pathway, consequences, detection, or recovery—not on a universal price tag.
| Decision factor | Questions to answer |
|---|---|
| Cost | What are the implementation costs and continuing operating costs? |
| Coverage | Which workforce, privileged, supplier, and partner identities are covered, and which critical applications or workflows remain outside scope? |
| Risk effect | How could the option affect the likelihood of the scenario, its blast radius, detection time, or recovery time? What residual exposure remains? |
| Operational impact | What deployment effort, workflow changes, and user friction should the business expect? |
| Evidence confidence | What internal incident data, tests, or other evidence supports the estimated effect? How much is assumption? |
Verizon lists multifactor authentication, software updates, employee training, encryption, testing, and incident-response planning as measures that can help prevent breaches. Its cited material does not assign a universal dollar return to any one control. Do not claim precise control ROI unless your organization has defensible before-and-after data. Verizon’s 2025 DBIR page.
What to put in the funding request
Give finance a decision it can evaluate: the scenario and business service at risk; the estimated impact range and assumptions; the proposed control or process change and its implementation and operating cost; the expected change to likelihood, severity, detection, or recovery; and the residual exposure the organization would accept. Identify what you will measure and when you will revisit the assumptions.
Rank #3
Useful measures depend on the proposal and may include the identities and critical services brought into scope, time to detect or contain relevant events, recovery time, and exercise or incident findings. Set a review point so the business can compare actual results and new evidence with the estimate. An explicit range and a visible uncertainty are more decision-useful than a precise-looking number unsupported by company data.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
