As I said, manually checking vulnerability is not really feasible. We had to have some kind of solution. The ROI is clear. We could not live without it. Now we are getting back a picture of the vulnerability and we are able to fix severe security/vulnerability bugs.

I'm not sure if I can place any numeric values on ROI but, considering that we went from zero security to having full visibility and the ability to create policies to enforce our requirements, I think it was a reasonable investment. Going from zero to, say, 80 to 90 percent capabilities was a good deal.