For our own environment, it has reduced a lot of the unknown unpredictable costs around cloud security and vulnerability. 

Because we started with cloud security very earlier on, I don't have a traditional model to compare to. What I do have is the the number of resources and effort that it takes to detect and comply is a fairly high ratio to cloud assets. 

I don't have a number for how much we've saved or for return on investment, but there has been a return because of the time we've saved. We're not using man-hours to fix the vulnerabilities or search for them. That's where our biggest ROI is.