The Economics of Cybersecurity: A Case Study on SAP Cyber Resilience

Cybersecurity is often discussed in terms of security findings, severity scores, and remediation backlogs. However, identifying a vulnerability does not tell an organization whether fixing it now is worth the time, cost, and effort involved. Security teams also need to consider how likely the vulnerability is to be exploited, the potential business impact, the cost of remediation, whether the fix could disrupt operations, what compensating controls already exist, and how valuable the underlying system or business process is to the organization.

Taken together, these factors make cybersecurity as much an economic problem as a technical one. Organizations have limited budgets, engineering capacity, and maintenance windows, so every remediation decision involves weighing the risk being reduced against the resources and operational tradeoffs required to address it.

Understanding the economics of cybersecurity helps organizations evaluate these tradeoffs more systematically and determine where security investments can deliver the greatest reduction in business risk.

What does economics of cybersecurity mean?

The economics of cybersecurity examines how organizations allocate limited resources to reduce cyber risks. Rather than treating every vulnerability as equally urgent, it focuses on how much meaningful business risk can be reduced for a given investment of time, budget, and operational capacity.

This perspective becomes particularly important because cybersecurity teams operate within real-world constraints. New vulnerabilities continue to emerge as systems are upgraded or replaced, software reaches end of support, identities and permissions change, and new applications and integrations introduce additional points of exposure. As the volume and urgency of security issues grow, organizations cannot address every vulnerability at once and must decide which risks require attention first.

Verizon's 2026 Data Breach Investigations Report highlights the need for risk-based prioritization and the difficulty of remediating critical vulnerabilities at scale. Vulnerability exploitation accounted for 31% of breaches, while only 26% of critical vulnerabilities listed in CISA’s Known Exploited Vulnerabilities (KEV) Catalog were fully remediated in 2025. Median time to full resolution also increased from 32 to 43 days, highlighting the gap between the number of high-priority vulnerabilities organizations face and their ability to address them quickly.

Are CVSS scores enough to determine business risk of a vulnerability?

Common Vulnerability Scoring System (CVSS) provides a standardized way to assess the technical severity of a vulnerability, but it does not fully reflect the business risk that vulnerability creates.

Two issues with the same CVSS score can have very different consequences depending on whether they are exploitable, how exposed the affected system is, what business processes depend on it, and whether compensating controls are already in place.

Remediation requirements also vary. Some fixes can be implemented quickly with little disruption, while others require testing, engineering effort, coordination across teams, and planned downtime. These factors affect both the urgency and the practical cost of reducing the risk.

For this reason, organizations need to look beyond CVSS when prioritizing remediation. A more complete view combines technical severity with business context, exposure, remediation effort, and the expected improvement in resilience. Turning that broader assessment into a measurable score can also make security posture easier to track and communicate across technical and executive teams.

SAP Security Score is beginning to reflect this shift

SAP is taking a more consolidated approach to security measurement with the introduction of a new Security Score in the Operations View for RISE with SAP customers.

The score aggregates selected critical checks for eligible productive SAP S/4HANA systems into three security KPIs: System Hardening, Vulnerability & Lifecycle, and Identity & Access Control. SAP positions the score as a management-ready view that complements the more detailed information available through Configuration and Security Analysis.

Instead of beginning with a long list of individual technical findings, organizations can use the score to identify which security areas require greater attention and then drill down into the underlying checks. This development reflects an important change in the way cybersecurity can be communicated. Individual technical findings remain necessary, but an aggregated score can provide leadership with a clearer indication of the organization's current security posture.

However, knowing the current score introduces another question that is directly relevant to the economics of cybersecurity: What will it take, in effort, downtime, risk reduction, and investment, to move from the current state to an acceptable level of resilience?

A score can establish where an organization stands, while a more detailed assessment can determine what it will take to reach the desired level of resilience.

Applying the economics of cybersecurity to SAP with the SRI Index

The SACO Resiliency Index (SRI) developed by IT-Conductor is designed to provide a deeper level of assessment for SAP environments. Rather than measuring security only through vulnerability counts or severity scores, SRI evaluates how resilient an SAP landscape is across its ability to prevent, withstand, detect, remediate, and recover from cyber risk.

SAP environments make the economics of cybersecurity especially visible because technical risk is closely tied to business operations. A vulnerability, configuration gap, application issue, or identity risk can affect systems that support critical processes, while remediation may require coordinated testing, engineering effort, and planned downtime. This makes the balance between risk reduction and operational cost particularly important when planning SAP security improvements.

How does SRI translate resilience into action?

SRI expresses resilience as a score from 0 to 100 and evaluates the environment across four cybersecurity pillars: Platform Security, Configuration Security, Application Security, and Identity & Access. Each pillar contributes to the overall score, providing a common measure that can be understood by both technical teams and executive stakeholders.

Figure 1: SACO Resiliency Index (SRI) Report

A sample SRI assessment illustrates how this works in practice. As shown in Figure 1, the SAP environment has an overall SRI of 67.3, with scores of 58.2 for Platform Security, 71.0 for Configuration Security, 78.5 for Application Security, and 66.8 for Identity & Access. The assessment also identifies 2 critical/extreme findings out of 11 total findings, with a total weighted risk of 239.8.

Rather than presenting only a single overall score, the SRI assessment also shows where resilience is weakest, helping teams identify which areas should be prioritized for improvement.

Potential actions can then be evaluated based on their expected risk reduction, engineering effort, and downtime, allowing organizations to understand not only what needs attention, but what it may take to improve the overall resilience score.

With a target score in place, teams can compare remediation options against available resources and operational limits. This provides a clearer basis for deciding which actions can deliver the greatest improvement in resilience within the capacity the organization can realistically commit.

Every security finding is categorized into pillar components and scored

The four SRI pillars are further broken down into individual components, providing a more granular view of the SAP security posture.

Figure 2: Pillar Components

Platform Security includes:

• Vulnerability & Patch Currency
• Exposure & Segmentation
• Hardening
• Monitoring & Recovery

Configuration Security includes:

• Misconfiguration Risk
• Hardening Compliance
• Configuration Drift
• Monitoring Coverage

Application Security includes:

• Application Vulnerabilities
• Custom Code & Interface Risk
• Service / API Exposure
• Change & Transport Controls

Identity & Access includes:

• Privileged Access
• Authentication
• Identity Hygiene
• Access Governance
• Monitoring

The component-level view helps organizations move from a high-level resilience score to the specific areas influencing it. By showing how each pillar component contributes to the overall SRI, teams can see which areas have the greatest effect on the overall resilience posture.

The result is a more actionable view of cybersecurity. Rather than simply knowing that an SAP environment has a particular security score, teams can understand which areas are driving that score and where targeted improvements can make the greatest difference.

Using scenario planning to determine the remediation path to a target SRI

Scenario planning allows organizations to test those remediation options before changes are executed. Instead of evaluating each finding in isolation, teams can model how different combinations of actions affect the overall SRI while also accounting for engineering capacity, downtime, and expected risk reduction.

Based on the same SRI assessment shown in Figure 1, the modeled remediation scenario projects an SRI of 86.2, up from the current score of 67.3 and above the target of 85.0. Achieving that projected improvement requires an estimated 94 engineering hours and 10 hours of downtime.

Figure 3: Pillar Scores

The pillar scores, as shown in Figure 3, provide further context for the projected SRI of 86.2. Because each pillar is weighted differently in the overall SRI, the modeled remediation scenario also projects different scenario scores for each pillar, which shows where the greatest improvement is expected. In this case, Platform Security records the largest gain, indicating that the remediation plan for this scenario has the greatest effect on this pillar.

By viewing these factors together, security and operations teams can assess not only whether a remediation plan improves resilience, but also whether it is practical to execute within the resources and operational limits available. This makes scenario planning particularly relevant to the economics of cybersecurity because it connects the desired security outcome with the effort required to achieve it.

Prioritizing remediation paths across different SAP security issues

The ability to compare remediation scenarios is particularly useful because cybersecurity decisions rarely occur independently. An SAP team may simultaneously need to address a critical SAP Security Note, an overdue kernel update, weak privileged-access controls, a configuration gap, and an application security issue. Each action can require different levels of effort, downtime, and coordination while contributing differently to overall resilience.

Scenario planning allows these options to be evaluated together before changes are executed. One remediation path may deliver substantial risk reduction but exceed the available downtime, while another may fit within operational limits but fall short of the target SRI. Comparing these outcomes helps teams identify a remediation plan that balances security improvement with the resources and operational capacity available.

This approach does not replace technical expertise or business judgment. Instead, it gives decision-makers a clearer view of the consequences of different remediation choices and provides a stronger basis for determining which actions should move forward.

AI and automation can change the economics of remediation

Once a remediation path has been selected, the next consideration is how efficiently it can be executed. The effort, coordination, and downtime associated with remediation are not fixed. AI and automation can reduce the manual work involved, streamline coordination, and make remediation more efficient to execute.

In environments such as SAP, orchestration can also help reduce operational disruption by standardizing execution, coordinating dependencies, and supporting more controlled maintenance activities.

These efficiency gains matter not only because they reduce the resources required for remediation, but also because delays and operational disruption can contribute to the broader financial impact of cyber incidents. IBM’s 2026 Cost of a Data Breach Report estimates the global average cost of a breach at $4.99 million, up 12% from the previous year. The report also found that organizations making extensive use of AI and automation in security experienced an average of $1.93 million in cost savings compared with organizations using none.

Lowering the engineering effort or downtime required to achieve a given level of risk reduction changes the economics of the remediation plan. A path that initially appears too resource-intensive may become more practical when repetitive work is automated or when execution can be completed with less disruption.

If a remediation process that once consumed 20 engineering hours can be reduced to five, the organization can potentially address additional risk within the same available capacity and budget. Likewise, if orchestration reduces the downtime required for a patch or upgrade, remediation that was previously difficult to schedule may become operationally viable.

In this sense, AI and automation does more than accelerate remediation. It can increase the amount of risk an organization is able to address within the same engineering capacity and operational limits, while also helping reduce the broader financial impact associated with cyber incidents.

A proactive cyber-resilience program can also have financial benefits beyond reducing the potential impact of a cyber incident. A stronger security posture can help organizations demonstrate effective controls when managing cyber-insurance requirements and may improve the economics of coverage as insurers assess cybersecurity risk and resilience.

Assess where your security posture stands today

Cybersecurity teams will continue to operate under constraints, while the volume of security work continues to compete for limited time, budget, engineering capacity, and operational windows. For SAP environments, this makes it important to understand not only what risks exist, but which actions can produce the greatest improvement in resilience with the resources available. That starts with establishing a clear view of the current security posture and identifying which areas of the landscape need the most improvement.

The SACO Resiliency Index (SRI) helps translate that posture into a measurable baseline across Platform Security, Configuration Security, Application Security, and Identity & Access. From there, organizations can evaluate the effort, downtime, and risk reduction associated with moving toward a stronger resilience target.

Scenario planning adds another layer by allowing teams to compare remediation paths before execution and determine which combination of actions best fits available resources and operational limits. AI and automation can further improve the economics of remediation by reducing the effort and disruption required to carry out those actions.

Figure 4: SRI Improvement Simulation

The economics of cybersecurity ultimately comes down to how effectively organizations use limited resources to strengthen resilience. The goal is not simply to do more security work, but to understand which investments produce the greatest reduction in business risk and provide a practical path toward a stronger, more resilient security posture.

Request a free SACO Resiliency Assessment to see where the SAP environment stands today, identify the areas that need the most attention, and understand what it may take to strengthen overall cyber resilience.