For a security tool, ROI is always a little harder to get at. Was there some breach that could have happened if we didn't have Awake? Maybe. We don't really know and can't quantify it concretely.

But it does save time for us not having to manually correlate across different network devices to investigate something funny that's happening. Instead, we essentially have the Awake team monitoring it for us and making us aware of any kinds of funny activity. Beyond that, there have been time savings because of one of our use cases which is using the query language to debug and ask questions of the network. We can do that instead of having to manually correlate across systems.

We have seen a return on our investment indirectly. Our security posture is more comprehensive. As we talk to clients or go through audits or do insurance, having this capability for our security portfolio is a big plus. It shows that we are really taking a comprehensive approach to our security.

The current legacy service is strictly based off of logs. Incidents are being generated by the rules algorithms. With Awake Security, their approach is different due to the network context. Awake Security has allowed us to focus on other items, not just on incident response.

We have seen ROI. The alerts that come through, they're all things that we want to follow up on. There are things that help us improve our security stance over time. As we've addressed those issues, I think they've led to improvements in the process by engineering teams. They've led to better security controls. Those are the two biggest areas of improvement.

When you compare the cost of hiring and retaining a sophisticated analyst, the Awake Security Platform pays for itself in a matter of months and goes on to save me money, longer-term. In addition, finding an analyst of that caliber in this market can be a challenge in itself. 

The bottom line is that this solution not only gives me the peace of mind and the same level of comfort as having an uber analyst, it also allows me to defer hiring for longer.

We have seen ROI. Fortunately, we haven't seen anything really bad from a malicious standpoint. However, some of the visibility Awake gave us into some of those compliance, architecture, and system engineering flaws that we were not previously aware about has let us remediate them.

We have seen return on investment but we don't really have the data points around that yet. It's kind of hard to quantify data points with a network security appliance. But we had zero visibility into our network before and so now we have visibility into our network.

Return on investment is usually easier to show with numbers in other IT applications than in security. But the biggest benefit of having an outsourced managed monitoring team is that we don't tie up our internal resources or have to hire additional resources for that. Comparing the cost of the appliance and MNDR service to other resources we would need, the ROI is certainly there, and it is a benefit for us.

ROI is a very hard exercise in security. I believe a couple of people have tried to come up with a quantified data point to say $2 million, or $3 million; every compromise costs a company $3.47 million. It's difficult to put a financial number on it.

I can point to the fact that we haven't had a successful compromise, and that is likely as a result of Awake's technology.

The time from finding threats to remediation is almost instantaneous. For example, I found a threat this morning and remediated it in less than five minutes. The issue that I encountered today was definitely data exfiltration. It was a malware that was hitting domain generated algorithms and also attempting to use Tor to obfuscate the data exfiltration. I found that within three minutes, and then the next following two minutes, we interjected, did the remediation, and had the node off the network. 

When you're trying to put a dollar value on the protection of personally identifiable information, potential financial information, and the loss there of, it is very difficult. However, in this instance, it could have been a lot worse. In terms of grey dollars and my staff's time, you're looking at a $1000 worth of savings because we would had to glean through logs, identify the device, chase it down, and understand what it was doing on the network.

The solution has saved thousands of dollars within the first day. Our ROI has to be in the tens of thousands of dollars since October last year. It's about the peace of mind and my ability to pass by the CEO, and say to him, "Don't worry, I got that. There was a network incident, but I'm confident that we caught this endpoint before there was any data exfiltration. I know what it was talking to and what the nature of the issue was." That is powerful right there.

The solution is worth its money.