Finally, a Real Return on Security Spending

"From our perspective this will change by the end of 2002. It will bea whole different landscape. We'll know much more scientifically howto do this," says O'Neill. "What it boils down to is getting credibledata."

The insurance industry in all likelihood will be the engine thatdrives both the science of ROSI and the technology of security. Allother factors being equal, the insurance discounts will eventuallymake one Web server a better buy than another. Software vendors willbe forced to fix the holes in their products in order to benefit fromlower premiums.

In fact, that is precisely what happened with fire sprinklers. Shortlyafter Parmalee's fiery demonstration, British insurance carriers beganoffering discounts to mill owners who bought sprinklers and deeperdiscounts to owners with more advanced sprinkler systems. Naturally,insurance rates rose on mills without them.

Ultimately, because it made no business sense not to invest in firesprinklers, everyone had them. And mill owners could stop thinkingabout fires and start thinking about their business.