[qzc4]

Yes, but it's hard to quantify the benefits (or even the costs) of a security measure—it's just as much a risk evaluation as it is a cost one.

[peatmoss]

Like so much of economics, the hard part is coming up with a price tag that everyone agrees on in all contexts. How much would you pay to save your grandmother's life from an illness? How much would you accept to allow me to hunt her for sport?

So, in that sense, coming up with a precise measure of marginal cost / marginal benefit would be hard in practice.