We have seen a very high return on investment using Black Duck.

It is difficult to determine ROI when it comes to security because it depends on many things.  For example, it may tell you how much knowledge your developers have about licensing, or security, which may ultimately reduce the cost of training.

On the other hand, it may increase the rate at which you find bugs or problems with specific components. This, again, may contribute to the ROI. However, it is difficult to say without a set of predefined metrics.