Model the breach-cost reduction your zero trust investment buys. Inputs are your industry, employee count, current security maturity, and your estimated implementation cost. Outputs are payback period, three-year ROI, and annual breach-cost saving, grounded in IBM's published Cost of a Data Breach data.
Industry breach costs and the modeled zero trust reduction
Industry
Avg breach cost (IBM 2024)
Modeled reduction
With mature zero trust (modeled)
Healthcare
$9.77M
31%
$6.74M
Financial services
$6.08M
34%
$4.01M
Technology / SaaS
$5.20M
36%
$3.33M
Retail
$3.48M
28%
$2.51M
Government / public
$2.58M
29%
$1.83M
Cross-industry mean
$4.88M
30%
$3.42M
Avg breach cost: IBM Security, Cost of a Data Breach Report 2024 (industry-weighted means). The reduction and zero-trust columns are this calculator's model, anchored on IBM's single published cross-industry zero trust effect of 42.3% ($1.76M) lower cost (IBM 2025) and held below it per industry to stay conservative. Specific outcomes vary by control depth and breach scope.
Beyond breach savings
ROI components most calculators leave out
The breach-cost saving is the largest ROI component but not the only one. Three additional categories meaningfully shift three-year economics.
Operational savings. Zero trust ZTNA replacing legacy VPN reduces help-desk access tickets by 60-70% (Forrester), eliminates VPN hardware refresh cycles ($15K-$100K every 4-5 years for hardware, plus $5K-$30K/year maintenance), and shortens employee onboarding from days to hours. For a 1,000-person organisation, these line items typically aggregate to $150K-$400K/year in soft savings.
Cyber insurance premium reduction. Carriers now price MFA, EDR, immutable backups, and least-privilege access into base premiums. Implementing these reduces premiums by 10-25% for mid-market and avoids coverage refusal at large enterprise. For a typical $50K-$200K mid-market premium, this is $7.5K-$30K/year recoverable.
Compliance fine avoidance. GDPR (up to 4% global revenue), HIPAA ($100K-$1.9M per tier), PCI DSS ($5K-$100K/month for non-compliance), and CMMC contract loss are all probabilistic but real. Zero trust controls (MFA, audit logging, access reviews, encryption, microsegmentation) directly address the most-cited regulatory deficiencies. A 10-15% probability-weighted addition to the ROI model is reasonable for regulated estates.
When ROI is weak
Honest scenarios where zero trust does not pay back fast
Very small businesses (under 25 users) with no regulated data, no remote workforce, and a single SaaS application stack. The implementation overhead can outweigh the breach-cost reduction; a simpler stack of universal MFA, endpoint protection, and encrypted backups captures most of the benefit at a fraction of the cost.
Organisations with high existing security maturity. The marginal benefit of zero trust over a competent perimeter-plus-MFA-plus-EDR estate is smaller than over a low-maturity baseline. Payback can stretch beyond three years.
Pure on-premise organisations with no cloud workloads or remote workforce (rare, but exists). Many of zero trust's strongest controls (ZTNA, conditional access, CASB) target the cloud and remote-access threat model. ROI is best where most of the workforce or most of the workloads sit outside the traditional perimeter.
Frequently asked
ROI questions
How is the ROI calculation done?
The model takes your employee count, industry, current security maturity, and zero trust implementation cost. It calculates an expected annual loss (ALE) before zero trust by multiplying your industry's annual breach probability (Ponemon-style estimate) by the size-scaled breach cost (IBM 2024 industry averages, scaled sub-linearly with workforce). It then applies a modeled zero trust breach-cost reduction (28-36% depending on industry, set deliberately below IBM's single published cross-industry figure of 42.3% to stay conservative) to derive an ALE after zero trust. The annual saving is the delta. Three-year ROI is total savings minus three-year implementation cost (year 1 plus 40% ongoing in years 2 and 3).
What does IBM's data actually say about zero trust ROI?
IBM's 2025 Cost of a Data Breach report found organisations with mature zero trust paid an average of $1.76M (42.3%) less per breach than organisations that had not begun a zero trust programme, the single largest cost mitigator IBM measured after a tested incident-response plan and extensive security AI/automation. IBM reports this as one cross-industry figure rather than an industry-by-industry split. The savings come primarily from limiting lateral movement and reducing the scope of compromise once an initial intrusion happens.
What does Forrester TEI data show?
Published Forrester Total Economic Impact studies for major ZTNA platforms (Zscaler, Microsoft, Palo Alto, Cisco) typically show 130-180% three-year ROI with 12-18 month payback. Savings come from VPN hardware retirement, reduced help-desk load (60-70% fewer access tickets), faster employee onboarding/offboarding, and avoided breach cost. These vendor-commissioned studies are upper-bound estimates and assume best-case adoption, but the underlying mechanics are sound.
When is zero trust NOT worth the cost?
For organisations under 25 employees with no regulated data, no remote workforce, and a single SaaS application stack, the implementation overhead can outweigh the breach-cost reduction. A simpler stack of universal MFA (free in M365 / Google Workspace), endpoint protection, and encrypted backups achieves most of the benefit at a fraction of the cost. ROI also weakens if your existing security maturity is already high, the marginal benefit of zero trust over a competent perimeter-plus-MFA estate is smaller than the marginal benefit over a low-maturity baseline.
How do compliance fines factor into ROI?
Most ROI models leave compliance fines out because they are probabilistic and politically sensitive. They matter at the margin: GDPR penalties run up to 4% of global annual revenue, HIPAA $100K-$1.9M per violation tier, PCI DSS $5K-$100K per month for non-compliance, and CMMC contract loss for defence suppliers. Zero trust controls (MFA, audit logging, access reviews, encryption, microsegmentation) directly address the most commonly cited deficiencies in regulator findings. Including a 10-15% probability-weighted compliance-fine avoidance in the ROI model is reasonable for regulated estates.
What about cyber insurance premium reduction?
Most carriers now require MFA, EDR, encrypted backups, and least-privilege access as prerequisites for coverage. Implementing these zero trust controls can reduce premiums by 10-25% for mid-market organisations and avoid coverage refusal for larger ones. For a $50K-$200K annual cyber insurance premium (typical mid-market), a 15% reduction is $7.5K-$30K/year, a non-trivial line item in the ROI model that the calculator above does not include.