As cyber budgets expand and boards demand clearer justification for security spend, CISOs and cybersecurity leaders must rethink how they define and demonstrate return on investment (ROI).