No. You did get a return, because return is not measured in a dogmaticworld of what did or did not occur, but in the stochastic world ofwhat might occur and how likely it is to occur. That is the game ofrisk; prepare for something to happen by investing in ways to stop itfrom happening.

"You can't get from the cost of security incidents directly to areturn on investment," says Thomas Koulopoulos, president, CEO andfounder of Delphi Group, an information technology research andconsulting company. "You need to focus on the intermediate step. Theprobability."