Exercise: Opportunity Cost Analysis
Proposed Security Investment: Foundational Cyber Hygiene Program
Scope: Managed detection and response (MDR) coverage across all corporate and field endpoints via the incumbent managed service provider (MSP), with new contractual security requirements added to the MSP agreement; multi-factor authentication (MFA) on all project management, accounting, and payroll platforms with elimination of shared field logins; and consolidation of legacy unmanaged file sharing into the sanctioned BIM cloud platform.
1. For the proposed security investment
Direct costs (purchase, implementation, maintenance)
| Item | Year One | Recurring (annual) |
|---|---|---|
| MDR coverage, all endpoints and servers, including MSP contract security uplift and audit rights | $132,000 | $132,000 |
| MFA licensing for all platforms | $21,000 | $21,000 |
| Identity cleanup, elimination of shared logins, field retraining | $38,000 one-time | — |
| Data migration and retirement of legacy unsanctioned file-sharing folders | $61,000 one-time | — |
| Ongoing administration and tuning (begins in month seven, after deployment completes) | — (none in year one) | $14,000 |
| Total | $252,000 | $167,000 |
Administration begins only after the deployment phase concludes, so year one carries no administration cost; year-two and later totals of $167,000 are reduced by approximately $12,000 in retired legacy file-sharing licenses, for a net recurring cost of approximately $155,000 from year two onward.
Resources required
- Internal IT lead at approximately 0.25 FTE for six months during deployment, tapering to 0.1 FTE for steady-state administration.
- MSP coordination for MDR agent deployment, log forwarding, and the renegotiation of service agreements to include breach notification timelines, background checks on assigned technicians, and evidence of the MSP’s own security controls.
- Superintendent and foreman time for credential remediation: approximately 30 minutes per field employee across two scheduling windows, plus crew-led troubleshooting during the first month.
- Executive sponsorship from the COO to hold the line on the MFA mandate when field pushback arrives; the mandate survives only if it visibly does.
Business impacts during implementation
- Jobsite plan-room and drawing access will be slower for roughly two weeks while shared logins are replaced with individual accounts; punch-list turnaround may slip by up to a business day during that window.
- The MSP contract amendment cannot take effect until renewal, so MDR deployment proceeds under an interim letter agreement with weaker remedies; this gap is accepted rather than delaying coverage by seven months.
- Removing legacy file-sharing disrupts a long-standing habit among estimators and project managers; a four-week overlap period with both systems available is planned, and a small number of legacy links to owner documents will break and require manual re-sending.
2. For each alternative use of these resources
Alternative A: Heavy equipment purchase (crane and site logistics fleet expansion)
- Expected financial return: approximately $58,000 in annual after-financing contribution through reduced third-party crane rental spend and enablement of faster slab cycles; payback period of roughly 4.3 years.
- Strategic objectives supported: supports the prefabrication and offsite construction ambition and improves competitiveness on ground-up bids where self-performed sitework is a differentiator.
- Risks created or perpetuated: adds GPS-telematics and supply-chain dependencies; requires new vendor assessment processes the firm does not yet have. Perpetuates the current security exposure unchanged.
Alternative B: Two additional preconstruction hires (estimator and virtual design lead)
- Expected financial return: the two hires are modeled to enable $12M to $15M in additional annual bid volume at historical win rates. Assuming a realistic ramp, roughly 60% of that volume converts to won revenue in year one and full volume by year two; at the firm’s typical gross margins this yields estimated incremental gross-margin contribution of approximately $340,000 in year one and approximately $550,000 at full ramp. Incremental overhead beyond the hires themselves (workstations, software seats, delivery support on won projects) is estimated at $95,000 annually. Payback on the $240,000 year-one cost is approximately three to four months after the new hires reach productive output, which itself requires two quarters of onboarding and pipeline accumulation; realized returns depend on eligibility to bid and on winning the work.
- Strategic objectives supported: directly advances the pursuit of larger public-sector and datacenter projects and design-build capability.
- Risks created or perpetuated: this alternative presumes eligibility to bid that work. In practice, growing security questionnaires on government-adjacent projects and surety inquiries about cyber controls create a real prospect of being screened out of exactly these pursuits. The alternative perpetuates the MSP single point of failure, credential sprawl, and unmanaged file sharing, and the estimators’ work product would accumulate bid and margin data in platforms with no data-loss-prevention tooling, compounding intellectual property exposure.
3. For the “do nothing” security alternative
Expected loss exposure (ALE)
| Scenario | SLE | ARO | ALE |
|---|---|---|---|
| Vendor-impersonation wire fraud recurrence (anchored to the firm’s own prior incident; controls since added reduce but do not eliminate exposure, since account compromise remains viable via shared logins) | $640,000 | 0.25 | $160,000 |
| Ransomware or destructive intrusion originating through the MSP’s domain-administrative access | $2,800,000 | 0.075 | $210,000 |
| Breach of payroll data trove (SSNs, bank details, certified payroll filings) concentrated at a single mid-sized vendor | $900,000 | 0.10 | $90,000 |
| Exfiltration of bid, estimate, and margin data from platforms with no data-loss prevention, eroding competitive win rates | $520,000 | 0.20 | $104,000 |
| Total expected annual loss exposure | $564,000 |
These ARO values are analyst judgment informed by the firm’s own targeting history and industry norms, not actuarial data. The ransomware SLE reflects an estimated two to three week disruption to active project sites, owner-relationship damage, and remediation, and is the least certain estimate; a range of $2M to $4M is reasonable.
Compliance gaps created
- Inability to answer government-adjacent project security questionnaires credibly: no MFA on project management and accounting platforms, no MDR, and no oversight of the MSP’s own controls would force disclosure of these facts on municipal and datacenter pursuits.
- Growing misalignment with the CMMC-like and utility-sector expectations attached to the firm’s target market, which function as de facto obligations for anyone who wants that work.
- Unresolved handling of prevailing-wage certified payroll and SSN data concentrated at a single vendor with no independent assurance.
Strategic initiatives potentially blocked
- Bidding larger public-sector and datacenter projects, the centerpiece of the long-term growth strategy.
- Preservation of bonding capacity: surety carriers are already making informal inquiries about cyber controls, and a material breach could reduce bonding capacity of roughly $100M to $125M, which in turn caps project size across the entire pipeline.
- The scrap and adaptive reuse reputation advantage with healthcare and hospitality clients is fragile after a payroll or owner-document breach.
4. Comparative analysis
Side-by-side comparison of financial impacts
The four options are not measured on a single yardstick, so each column’s impact category is labeled explicitly: the security program’s benefit is a modeled reduction in expected annual loss; the equipment figure is an after-financing operating contribution; the hiring figure is an estimated incremental gross-margin contribution contingent on conversion and eligibility; the do-nothing figure is retained expected loss.
| Security program | Equipment purchase | Two preconstruction hires | Do nothing | |
|---|---|---|---|---|
| Year-one cost | $252,000 | $252,000 | $240,000 | $0 |
| Annual recurring cost | $155,000 from year two (net of retired licenses) | financing embedded in contribution figure | $340,000 fully loaded from year two, comprising $240,000 in base compensation and benefits for two permanent employees plus $95,000 in incremental overhead; year one is discounted to $240,000 by a signing allowance offset and because overhead ramps mid-year | $0 |
| Modeled annual financial impact | Modeled annual expected-loss reduction of approximately $379,000 | $58,000 after-financing contribution | Approximately $340,000 in year one and $550,000 at full ramp in estimated incremental gross margin, net of the $95,000 incremental overhead; both figures contingent on winning work and on eligibility | Retained modeled ALE of $564,000 |
| Benefit-to-cost ratio (modeled) | 150% ($379,000 / $252,000) | 23% ($58,000 / $252,000) | 142% year one ($340,000 / $240,000); 161% at full ramp ($550,000 / $340,000) | Not applicable; no investment |
| Net risk-reduction ROI | Approximately 50% (($379,000 − $252,000) / $252,000) | Not calculable for risk reduction; no loss reduction delivered | Not calculable for risk reduction; no loss reduction delivered | Not applicable; carries modeled ALE of $564,000 annually |
| Simple payback period | Approximately 8 months ($252,000 / $379,000) | Approximately 4.3 years ($252,000 / $58,000) | Approximately 3–4 months once productive ($240,000 / $340,000 at full ramp), reached after two quarters of onboarding and pipeline accumulation | None |
| Strategic initiative access | Enables public-sector and datacenter pursuit; protects bonding capacity | Supports prefabrication ambitions | Directly grows pursuit capacity, but only if eligible to bid | Blocks flagship growth path |
Alignment with strategic priorities
The firm’s mission is delivering projects on time and on budget through disciplined project management and early adoption of construction technology. The security program aligns most strongly: it removes the disqualification risk from the exact pursuits named in the growth strategy, protects the bonding capacity that sets the ceiling on project size, and brings construction-technology discipline to an area, third-party IT, that has run on trust and habit since before the last recession. The equipment and hiring alternatives both serve real strategic ends, which is precisely the point: they are attractive, and choosing them over the security program means consciously carrying a $564,000 modeled expected annual loss while doing so.
Post-investment residual risk basis
The $185,000 residual ALE is a modeled estimate, built from the same four scenarios with revised assumptions: MDR, MFA, and centralized file sharing cut the wire-fraud ARO to 0.05 (ALE $32,000); the amended MSP contract and MDR telemetry cut the ransomware ARO to 0.025 with a slightly lower SLE of $2,400,000 (ALE $60,000); the payroll scenario remains largely unchanged at ARO 0.075 pending an independent assurance review deferred to the mid-term plan (ALE $68,000); and bid-data exposure falls to ARO 0.05 once the legacy file-sharing platform is retired (ALE $25,000). These residuals are estimates and would be revisited after the program’s first year.
Risk/return profiles of each alternative
- Security program: strongest risk-adjusted profile. Delivers a modeled annual expected-loss reduction of approximately $379,000 against a $252,000 year-one cost, with benefits accruing even if no visible incident occurs. It must be stated plainly that expected-loss reduction is a probabilistic expectation, not a guaranteed savings line; in any given year with no incident, the cash outlay is real and the avoided loss is invisible. Principal execution risks are the MSP’s cooperation under the amended contract, which is not assured until renewal, and residual risk that is real but bounded: the subcontractor security attestation program is deferred to the next budget cycle, so roughly 200 shared-platform trade partners remain an unmeasured exposure, and a legacy plan-room account still lacks MFA pending a vendor interface the platform is slow to deliver. Both are accepted, documented residual risks for this year.
- Equipment purchase: predictable, modest return; sensible in isolation but perpetuates full exposure and adds new telematics dependencies requiring vendor assessment processes the firm does not yet have.
- Preconstruction hires: highest upside and highest variance; return depends on winning work the firm may not be qualified to pursue given current cyber posture, so some of the projected margin is fictional until the gating compliance questions are answered.
- Do nothing: preserves $252,000 of capital on paper while retaining a modeled $564,000 in expected annual loss and blocking the flagship growth strategy. ROI is not a meaningful measure for a zero-cost option; the economics are nonetheless clear. The option that appears cheapest is not.
Recommendation: Fund the foundational cyber hygiene program this budget cycle. Its modeled annual expected-loss reduction of approximately $379,000 exceeds its year-one cost of $252,000, yielding a net risk-reduction ROI of approximately 50% and a payback of roughly eight months, and unlike the alternatives, it unblocks rather than presumes access to the strategic market the firm has committed to pursuing. Revisit the deferred subcontractor attestation program and the outstanding legacy plan-room MFA gap at the mid-year checkpoint, and re-run the “do nothing” ALE before renewal negotiations with the MSP conclude.
©Kayne McGladrey – Get the full book “Cyber Risk is a Myth”
