There are good reasons not to analyze the ROI of security-related technology. First, the value of security technology is reminiscent of an insurance policy since you experience its true value only when something bad happens. Consequently, its benefits are the costs avoided in not falling victim to the various security threats lurking in the ether -- benefits that can be difficult to quantify. Second, regulations and laws have a way of influencing investment behavior.