Security ROI: Fact or fiction?

ROI is often suggested as a measure of the worth of security measures, especially by some vendors. But it's a flawed concept and could result in bad security decisions because security is not an investment and should not be treated as such. This article expands on this view. Security ROI: Fact or fiction?