Attempting to quantify the economic value of security-related information technology is a lot like understanding the value of an insurance policy. Value stems less from what's delivered to the buyer and more from what costs and negative impacts the buyer avoids should a catastrophic event occur. Avoiding costs can be more powerful than saving or making money. The problem is that quantifying avoided costs is only truly possible after disaster strikes.