Second, the Internet of Things (IoT) is at a crossroads. RAND’s model suggests that the introduction of IoT would increase the losses that companies experience due to cyberattacks by 30% over the course of 10 years.
Third, investing in the workforce leads to fewer costs over time. Organizations with very high levels of security diligence are able to curb the costs of managing security risk by 19% in the first year and 28% by the tenth year when compared to organizations with very low diligence.
Fourth, there is no one-size-fits-all. Small to medium-sized businesses benefit most from basic tools and policies, while large organizations and high-value targets require investments in a full range of policies and tools.
And fifth, eliminating software vulnerabilities leads to major cost reductions. RAND’s model found that if the frequency of software vulnerabilities could be reduced by half, the overall cost of cybersecurity to companies would decrease by 25%.