ROI is not something that you can really quantify on a security product. Look at some of the companies that have been hacked. It'd be very difficult to justify that. 

We have been able to secure more things using this product. 

With security, it's hard to articulate a return on the investment. It's a cost burden. We could probably say that it's a lower cost burden, but I think that we're a year out from being able to really determine that. I believe that it is a lower cost to operate. For sure it's going to be a lower cost to create the security controls. Probably in a year's time we'll know more. We'll see that our AppDev teams are able to build their own security policies, for example, but that's more of a vision statement than it is reality, right now.

When you bring in a new vendor, typically you bring them in together with your existing vendor, so there's a bit of a cost bump. Then, as you start to relinquish licensing of your old vendors, not renewing them, those prices drop. We are actually expecting our costs to drop in the coming year, but it is just a matter of the licensing expiring. That is going to happen in the next six months or so. Then, we will start to see a decrease in overall spend.

Previously, it might have taken us three to four weeks to provision VPCs and environments in the cloud. Very often, we would end up missing certain security groups because we were applying policy in multiple places. Applications wouldn't work right off the bat, so there was a lot of troubleshooting that would come with that, which was part of the reason why it was taking three to four weeks to get things done. Today, all this is thought of ahead of time. Security policies are now applied as applications are going up. Because it's automated, we don't have the three to four week delay. The insertion of applications in the cloud for us dropped from an average of three to four weeks to a couple of days.