Avoided Cybersecurity Attrition

Evidence and data. Beyond the security posture factors that mandated the organizations’ investments with Immersive One, interviewees explained to Forrester that investing in their cybersecurity staff via cyber resilience training engaged staff in ways that previous efforts did not, allowing for career advancement and opportunities that improved cybersecurity staff retention and reduced organizational attrition costs.

• Prior to the Immersive relationship, the interviewee at the managed services firm explained that their organization invested in its cybersecurity staff (via certification or hands-on training) as a retention tool. While this was very effective from a retention standpoint, growth in the size of the team and the cost associated with these programs meant that it could not be scaled much further. By investing with Immersive One, these types of hands-on simulation opportunities can now be provided to the entire cybersecurity team. The interviewee noted that since then, “regrettable” churn on the team has decreased by 7%, most of which is attributable to investing in their employees at scale with Immersive.

• The interviewee at the European-headquartered bank noted that using Immersive in the recruitment process to gauge skills competency prior to hiring has ensured they fill roles with personnel of the appropriate skill sets, potentially reducing churn.

• The same interviewee explained that transparent career pathways through skills development on Immersive One helped support employee development, contributing to low attrition among the cybersecurity teams in the organization compared to the industry.

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• There are 200 cybersecurity professionals across the organization’s cybersecurity teams.

• A 12% pre-Immersive One annual attrition rate for these cybersecurity professionals, which improves to 9% with Immersive.

• In Year 1 of the analysis, the organization fills only half of its cybersecurity openings, as hiring for these roles may take up to six months. By Years 2 and 3 of the analysis, it fills each open role annually.

• The average fully burdened annual salary for a cybersecurity hire is $125,000.

• The cost to hire and onboard a cybersecurity professional is 110% of the annual salary. It should be noted that assumptions for the cost of attrition range from 100% of the annual salary to more than 125% of the annual salary, depending on the seniority of the role.

Risks. This benefit will vary based on:

• An organization’s historical attrition rate for cybersecurity personnel.

• The ability for an organization to recruit and onboard cybersecurity personnel.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.3 million.

Avoided External Cybersecurity Hires

Evidence and data. Among the organizations that invested with Immersive One, interviewees explained that both engagement (percentage of employees who completed at least one lab or exercise) and time spent on Immersive One-related activities were both considerably higher than those of previous training efforts or programs. The ability for the organization to track employee engagement and prove competency on Immersive One allowed these organizations to identify talent within cybersecurity teams that previously went unnoticed or underutilized, allowing for more frequent promotions of these personnel and a reduced burden on the organizations to hire required talent and skills from outside the organization.

• Immersive One allows the cybersecurity teams at the managed services organization define, develop, and track skill requirements and attainment for each role of seniority, resulting in clear pathways for internal skills development and promotions and potentially avoided external hiring. The interviewee summarized: “With Immersive One, we have defined our competency matrix with what we expect each tier of [cybersecurity role] should be able to do. For our top tiers, for example, we need to make sure that they can do threat hunting, that they can do the deep forensic analysis. Immersive One gives us the consistent methodology to develop and the proof that we need.”

• The same interviewee relayed an anecdote where a recent simulation performance from an unassuming team member helped the team discover the depth of knowledge this individual (unknowingly) possessed. They have recently been promoted (reducing the need for an external hire) with a high potential employee career path in front of them.

• Interviewees at several organizations noted that Immersive allowed them to formalize cybersecurity career paths based on skills development pathways and provided the ability to prove them. The interviewee at the North American bank summarized: “We’ve developed multiple pathways with Immersive [One] for development and upskilling of our [cybersecurity] workforce.”

• Some interviewees said that their organizations have been able to hire internal personnel with little to no experience in cybersecurity through upskilling on Immersive One, avoiding the need to hire externally at a greater cost to their organizations, while more experienced staff have moved to other roles or been promoted. The interviewee at the European insurance organization also noted: “There have been many sideways moves [in cybersecurity] generated off communities fostered by Immersive that have brought people closer. Some of these people wouldn’t have seen or heard about those jobs previously.”

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• There are 200 cybersecurity professionals across the organization’s cybersecurity teams.

• The organization avoids 1% to 2% of its external skills requirement through internal upskilling/promotions with Immersive One.

• In Year 1 of the analysis, the organization fills only half of its cybersecurity openings, as hiring for these roles may take up to six months. By Years 2 and 3 of the analysis, it fills each open role annually.

• The average fully burdened annual salary for a cybersecurity hire is $125,000.

• The cost to hire and onboard a cybersecurity professional is 110% of their annual salary.

Risks. This benefit will vary among organizations based on:

• The skill and capacity of an organization’s cybersecurity personnel related to their ability to develop new skills.

• The preexisting cybersecurity skills within an organization related to the need to hire externally.

• An organization’s industry related to its cybersecurity skills requirements.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $747,000.

Developer Productivity Improvements From Secure Development

Evidence and data. The Immersive One platform offers labs aimed specifically at developers to instill best practices for secure coding into SDLCs. Through more consistent developer engagement with Immersive One and adoption of these practices, organizations’ developers realize fewer hours of vulnerability remediation and coding rework by discovering or avoiding these issues early in the SDLC (and especially prior to production).

• The interviewee at the North American bank explained that Immersive One’s developer-focused training modules allow developers to train on best practices for avoiding late SDLC or production vulnerabilities, greatly reducing risk exposure for the organization while avoiding developer remediation hours.

• Given the utmost importance of secure development practices at the North American insurance organization, the interviewee explained that they mandate developers to complete labs on Immersive One to retain access to code repositories. The interviewee summarized: “In an application where a flaw is found in production, it costs a whole lot of time and money to fix it compared to preventing it [in the first place]. We’re seeing far fewer flaws in applications developed by the folks that we are training on Immersive. That is also a huge risk reduction, as well.” The interviewee estimated that training on Immersive One (among other optimizations) has contributed to reducing the amount of time developers spend on vulnerability remediation by nearly 50%.

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• Eighty percent of the organization’s 1,000 developers leverage Immersive One and exercises annually.

• Each developer spends an average of 60 hours annually on software remediation work for vulnerabilities discovered later in the SDLC.

• It can avoid an average of 5% of these hours with best practices and secure coding practices honed on Immersive.

• The average fully burdened hourly rate for a developer is $72.

• Forrester applies a 75% productivity recapture rate, as not all reclaimed hours will be used for value-adding work.

Risks. This benefit will vary among organizations based on:

• The number of developers within the organization leveraging Immersive One.

• An organization’s typical SDLC as it relates to vulnerabilities requiring remediation in production, and the time required to remediate these issues.

• The skill and capacity of an organization’s developers to implement Immersive-driven learnings into their SDLCs.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $258,000.

Avoided Legacy Cyber Resilience Training Costs

Evidence and data. By investing with Immersive One, interviewees explained that their organizations were able to retire, reduce, or offset some of the costs previously associated with cyber resilience training across cybersecurity personnel, developers, executives, and their wider workforce. In particular, interviewees noted the ability for their organizations to save on costly, in-person training sessions that required both travel and limited participant selection. Furthermore, training opportunities that were previously offered to fewer select participants would now be scaled across the entire organization.

• The interviewee at the managed services organization explained that although their firm always had a cybersecurity training budget, it typically was spent on costly in-person certification sessions. However, given a 40% increase in the size of its already significant cybersecurity team in the last three years, this model would not scale with the new organization. Investing with Immersive One allowed the organization to avoid most of this in-person training budget (estimated at more than 70%, which nearly paid for the Immersive investment)  through access to labs, crisis simulations, and cyber range exercises. In addition, with Immersive One, more cybersecurity professionals have access to hands-on training than in the previous model.

• The telecommunications organization dedicated significant personnel hours to curating a training and skills development program for its security personnel and wider workforce. However, the interviewee noted that the extreme effort required to keep modules updated and track employee skills quickly became untenable as they rolled out these skills development exercises to additional teams. By investing with Immersive One, the organization was able to reallocate five to ten full-time personnel to other endeavors within cybersecurity (depending on the year), as well as effort from content management personnel.

• Several interviewees’ organizations gained additional savings by consolidating training across several vendors serving different employee populations. For instance, the interviewee from the North American bank said they saved “tons of money” by consolidating developer-focused training with cyber resilience training on Immersive.

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• The organization sends 3% of its 200 developers to an in-person cybersecurity training or certification program (e.g., SANS) annually (on average).

• It avoids 80% of this cost annually (on average) as Immersive One’s labs, crisis simulations, and cyber range exercises allow for similar outcomes among the organization’s cybersecurity professionals.

• It spends an average of $400 per cybersecurity professional on ongoing internal training expenditure, which is now avoidable with Immersive.

Risks. This benefit will vary among organizations based on:

• The typical annual expenditure on one-off cybersecurity training and certifications.

• An organization’s current cyber resilience training programs or platforms related to the ability to reduce any of these costs on Immersive.

• The exact configuration of Immersive One products an organization contracts for.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $276,000.

Improved Organizational Security Posture

Evidence and data. Interviewees noted that by implementing Immersive One’s labs and exercises across their organizations’ personnel, engagement with these products drove inherent improvements across their organizations’ security posture. Cybersecurity personnel were able to prepare for and respond to the latest cyber threats and vulnerabilities, developers reduced the number of vulnerabilities making it to production, and the executive team and wider workforce were aware and prepared for the latest threats respective to their roles.

• Compared to other cyber resilience training programs that the managed services organization used or trialed in the past, this interviewee said that Immersive stood out for the depth and realism of the individual and team-based scenarios, providing a more actionable experience for cybersecurity staff should similar attacks occur. Penetration test catch rates improved from (at times) under 70% to 96% on average, speaking to a significant increase in security posture.

• Several interviewees commented on the speed with which Immersive delivers labs and simulations for the latest cyber threats and/or vulnerabilities, ensuring cybersecurity personnel at these organizations are in the best position to prepare for and respond to these threats. It was also noted that Immersive frequently refreshes the labs to remain current to the threat landscape and continue to engage users. The interviewee at the telecommunications organization noted that: “[Immersive] will have a training on a new attack vector within 48 hours that our staff can actually prepare with. [We] would take two months to develop it ourselves.”

• As noted by several interviewees, Immersive allowed their organizations to track and assess the skills of their personnel in a regimented and consistent manner, ensuring proper skills development and contributing to a better security posture for their organizations.

• The interviewee at the North American bank summarized the scope of Immersive deployment and adoption at their organization, with more than 500,000 labs completed annually across the workforce and a significant adoption of crisis simulations among 100 users within cybersecurity.

• By rolling out and encouraging adoption of Immersive for the wider workforce, the interviewee at the European insurance organization explained the positive impact to security posture: “The bad actors are working faster than us. There’s more money in it for them, so they’re always trying push the envelope and find new vulnerabilities. Even on the very lowest scale, having awareness on things like phishing across the entire organization with Immersive can make a huge difference.”

• The ability to track and quantify skills attainment across an organization’s cybersecurity teams on Immersive was cited as a major benefit by the interviewee at the European bank, who added: “We can quantify [skills attainment] that we can show to regulators to audit. From our executives’ perspective, this alone makes the investment [with Immersive] worthwhile. This gives us the ability to say, ‘Based on the number of threats, the type of threats, this is how deep our skills coverage is.’ We can show the quality of skills attainment as well through pass rates. We can independently attest that knowledge with Immersive. It’s not just a declaration. Immersive gives us quantifiable pieces so we can demonstrate what we’re doing.”

• The above interviewee also stressed the importance of Immersive’s labs for their executive team members when it came to ensuring that security is top of mind in the decision-making process at the executive level.

Modeling and assumptions. For the composite organization, Forrester makes the following assumptions:

• The cumulative cost of data breaches for the composite organization is $4.4 million, based on Forrester’s 2025 Security Survey.³

• The likelihood of the composite organization experiencing one or more security breaches annually is 68%.⁴

• Immersive can address 90% of the composite organization’s breach vectors, resulting in an average annualized risk exposure addressable with Immersive of $2.4 million.

• Immersive reduces the organization’s average risk exposure by 5% annually based on improvements to threat preparedness and response and a more secure SDLC.

Risks. This benefit will vary among organizations based on:

• An organization’s size and industry related to the likelihood and costs associated with data breaches.

• The adoption of an organization’s pre-Immersive cyber resilience programs and/or solutions related to the potential for improvements with Immersive.

• An organization’s baseline security posture.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $258,000.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Higher cybersecurity awareness within the organization. Inherent with a higher adoption of cyber resilience labs and exercises across the organizations’ different roles was a higher awareness of security preparedness and response across entire organizations. By leveraging Immersive One, interviewees noted that security culture at their organizations was more top of mind. Beyond the annualized risk exposure quantified for this report, this improvement to security posture may help an organization avoid major security breaches that may result in fines or reputational damage. Several interviewees noted that regional cybersecurity teams within their organizations compete with other teams across the globe in friendly competition on Immersive, illustrating the broader security culture benefit supported by Immersive’s gamification.

• Employee experience and upskilling. Beyond the employee retention benefits as quantified for this report (benefits A and B), interviewees explained that Immersive One engages cybersecurity personnel in a way that previous options did not, driving higher engagement, skills development, and ultimately higher job satisfaction and upskilling for promotions.

• Security framework and compliance standard alignment. Several interviewees explained that Immersive One allowed their organizations to map skills and capabilities to security frameworks and meet compliance standards. The interviewee at the managed services firm noted: “Immersive [was selected over competitors] due to the completeness of the lab sets and the ability to really map our team’s capabilities back to the MITRE [ATT&CK] framework. Being able to see these competencies at an individual level and at a team level gave us consistency in how we thought about our cybersecurity team skills.” The interviewee at the European insurance organization added: “We were going after ISO 27001 as an organization, which involves talking to a lot of different people in front of auditors. Our network that’s developed and grown through Immersive One massively contributed to making that process a lot smoother than it could have been.”

• Hiring and onboarding skills assessments. Interviewees explained that Immersive One’s labs and exercises are now (or soon will be) used as part of their organizations’ hiring processes, ensuring that candidates are the most qualified for the positions for which they’re being recruited, potentially reducing onboarding costs, and further improving attrition. The interviewee at the managed services firm noted that cybersecurity onboarding times have decreased by 25% from 100 days to 75 days on average, while the telecommunications organization is using Immersive Talent to ensure that candidates have the skills they need for the roles they’re being hired for.

• Shorter SDLCs. By leveraging Immersive One across their organizations’ developer bases, some interviewees noted that developers spend less time remediating vulnerabilities further in the SDLC, not only saving developer time (as quantified in benefit C) but also accelerating software delivery to internal clients or customers.

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Immersive and later realize additional uses and business opportunities, including:

• Expanding Immersive One across other roles within the organization. Although several organizations leveraged Immersive One across all roles, some interviewees explained that there were still more roles to cover with Immersive One, potentially driving additional cost savings and security posture improvements.

• Staying current on the evolving threat landscape. Interviewees explained that when it identifies new or emerging threats or vulnerabilities, Immersive One is quick to have a lab or exercise aimed at improving preparedness or response. Over time, this may result in avoiding security breach-related costs for organizations as they continue to leverage Immersive.

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).