We see ROI in the sense that we don't have to react because it stops anything from hurting the network. We can stop it before we have a bigger mess to clean up.

We have seen ROI.

Because of what the FireEye product does, it has significantly decreased our meantime in being able to identify and detect malicious threats. The company that I work with is a very mature organization, and we have seen the mean time to analysis decrease by at least tenfold.

I was with one of my clients last week and he told me that he's satisfied with the solution because they prevent a lot of attacks and a lot of breaches. 

Both for our clients and for ourselves, ROI was almost 200% more than we expected. We were satisfied.

It probably reduces our response time by a day or two. It also increase staff productivity.

I have seen return of investment in the way that it prevents breaches and attacks.