Executives responsible for cybersecurity can quantify to the dollar what their organization spent last year on compliance, including training, policy enforcement, and awareness campaigns. But quantifying the benefits from those expenses is surprisingly difficult. There is no strong evidence that spending more and more on compliance produces fewer or less severe cyber incidents.