AegisAI Perspectives · 050
Justify email security investment to the CFO by pricing the risk: expected annual loss with and without the control, against its cost, every input cited.
A CFO cannot fund a risk that has no price. Justify email security investment by pricing it: a breach averages $4.44 million worldwide1, so show expected annual loss with and without the control, against its cost. AegisAI checks every payment request against the sender's history22, so a pilot on live mail produces counts the CFO can check.
Write the case as a risk register entry that carries a price and a frequency. The cost of treatment goes beside it, and each step adds one line the CFO can test.
NIST IR 8286 Rev. 1 uses risk registers to set out cybersecurity risk and roll it up to the enterprise level15. Name one scenario per line. "Fraudulent change of supplier bank details by email" is a scenario; "phishing" is a category.
IBM's 2025 report puts the global average breach at $4.44 million and the U.S. average at a record $10.22 million2. Use the figure for the region where the company operates.
IC3 describes business email compromise as a scam aimed at whoever performs a transfer of funds, frequently run from compromised legitimate business accounts6. Microsoft Learn lists the senders it forges: financial officers, customers and trusted partners9.
Count fraudulent payment-change attempts and reported incidents from the last year, and mark the result as assumed. NIST IR 8286B ranks each risk by its potential impact on enterprise objectives16.
Multiply events per year by loss per event. One business case guide defines the cost of not investing as exactly this figure for the scenario18.
NIST IR 8286B records the selected response and its projected cost in the cybersecurity risk register. Divide the annual cost of the control by the annualized loss exposure. The result is the break-even reduction the control must deliver.
IC3 advises verifying account change requests through a secondary channel or two-factor authentication, and calling the originating bank at once to request a recall. Verification lowers how often a fraud succeeds and a fast recall lowers loss per event, so the model counts both.
Microsoft 365 reports live on the Email and collaboration reports page of the Defender portal10. The Google Workspace security dashboard shows up to 180 days of data13. Agree on three counts before the pilot starts.
One wrong number lets a CFO set aside the whole deck. Check each figure for its edition year and a named source before it goes in.
| Figure | What it measures | Status | Use it? |
|---|---|---|---|
| $4.44 million | Global average breach cost, IBM 2025 | Current edition, named source | Yes |
| $10.22 million | U.S. average breach cost, IBM 2025 | Current edition, named source | Yes, for a U.S. company |
| Nearly $21 billion4 | Cyber-enabled crime losses reported to the FBI for 2025 | Current edition, FBI release | Yes, as scale for the whole problem |
| $4.88M20 | The 2024 IBM average, printed in a 2026 guide | Prior edition | No, use $4.44 million |
| $4.5 million19 | An "industry-wide" breach average in a 2026 guide | No named source | No |
| 15 to 40% premium reduction | A cyber insurance discount in a 2026 guide | No named source | No, ask your broker for a quote |
The model below prices two scenarios and finds the break-even point. Every input is cited or marked assumed.
Illustrative example, figures are fictional. Northfield Parts is a fictional U.S. manufacturer with 1,800 mailboxes and 400 active suppliers.
Scenario 1 is a breach that starts in email. Loss per event: $10.22 million, the IBM 2025 U.S. average. Likelihood per year: 2% (assumed, fictional). Annualized loss exposure: $204,400.
Scenario 2 is a fraudulent change of supplier bank details. Loss per event: $180,000 after a bank recall attempt, as IC3 advises (assumed, fictional). Events per year: 1.5 (assumed, fictional). Annualized loss exposure: $270,000.
Total annualized loss exposure: $474,400. Annual control cost: $95,000 (assumed, fictional). Break-even reduction: $95,000 divided by $474,400, or 20%.
The CFO now has one testable question. Does the control remove at least 20% of expected loss? The 30 day pilot supplies the counts that answer it.
AegisAI's AI agents check every payment request against the sender's history. They read the thread the way an analyst would: the sender's history, the change being asked for and where the reply actually goes23. Every verdict arrives with the evidence, so an analyst can confirm it. AegisAI connects by API and works after delivery. It runs in monitoring mode on live mail with no MX change before removal is turned on.
The request arrives as a cost with no matching loss line. A breach average without a frequency is a headline, and a CFO funds lines with both. IBM's 2025 report found 16% of breaches involved attackers using AI tools, most often for phishing or deepfake impersonation3. The figure describes attackers, so your company's frequency stays your own input, ranked by impact as NIST IR 8286B describes16.
It misses requests that look routine and pass authentication. IC3 says business email compromise is frequently run from compromised legitimate business accounts6. A message from a real account carries that domain's real SPF, DKIM and DMARC results. The FBI names compromised corporate e-mails among the costly tactics behind its 2025 losses5. Ask the current tool owner for one number: how many payment-change requests reached users last quarter, and how many were verified through a second channel.
Calculate it as avoided expected loss minus the control's annual cost, divided by that cost. The cost of not investing is the annualized loss exposure for the scenario18, so avoided loss is that exposure multiplied by the reduction the control delivers. Lead with the break-even reduction from step 6, because it asks the CFO to judge one assumption. Leave vendor ROI calculators out of the deck; the CFO will ask whose losses they model. For where an AI email control shows a return first, see why ROI shows up in email first.
The IBM 2025 averages hold up: $4.44 million global and $10.22 million U.S.2. Annualized loss expectancy is frequency multiplied by loss per event, and it holds up only when both inputs are named. For fraud scale, the FBI reports nearly $21 billion lost to cyber-enabled crime in 2025 across 1,008,597 complaints4. Older figures still circulate. One 2026 guide prints the 2024 IBM average of $4.88M20, and another prints $4.5 million with no source19.
Build it as one page that a CFO can read in the meeting. Lead with the scenario as it reads in the risk register15. Give the price from the current IBM edition1, with frequency marked as assumed. Show the projected cost of the response next to the exposure, as NIST IR 8286B places it17. Close with the pilot and the decision rule agreed in advance. The controls behind the case are set out in how to prevent business email compromise.
Track three numbers from day one, each from a report the mail platform or the pilot already keeps.
Payment-change requests reviewed. Count every email that asks to change bank details, and how many were verified through a second channel as IC3 advises7. The pilot's verdict log holds the count, with the evidence for each verdict23.
User reports. In Microsoft 365, the User reported messages report shows what users reported as junk, phishing or good mail11. In Google Workspace, the User reports panel keeps this for 30 days14, so export it before the window closes.
Messages removed after delivery. In Microsoft 365 with Defender for Office 365 Plan 2, the Post-delivery activities report shows the lifecycle of ZAP removals12. Compare all three counts with the break-even reduction from the cost model. For the method behind a miss rate, see how to measure detection accuracy and miss rate.
Price the risk. Show the annualized loss exposure for one or two named scenarios next to the projected cost of the control, as NIST IR 8286B records it. Use IBM's 2025 averages for severity and mark frequency as your assumption.
Explain it as expected loss avoided per year minus the control's cost. Put the break-even reduction first: the control's annual cost divided by the annualized loss exposure, which one business case guide calls the cost of not investing. It rests on one assumption the CFO can challenge.
Use the figure for where the company operates. IBM's 2025 U.S. average is $10.22 million, more than twice the $4.44 million global average. A U.S. company quoting the global figure understates its own exposure.
Count it only with a quote from your own broker. The 15 to 40% premium reduction printed in one 2026 guide names no source. A number the CFO cannot trace weakens every other line in the case.
Report the counts anyway. A month with no fraudulent payment request still gives the number of requests reviewed and the user reports logged. Extend the window if needed: the Google Workspace dashboard shows up to 180 days.
Call the originating bank at once and ask for a recall or reversal, which IC3 says may reduce or eliminate the loss. Then log the event in the risk register, so next year's frequency is a count instead of an assumption.
