IMHO, you can't try to get any useable ROI figure for security features. Whatever security feature you add, it's supposed to handle an unlikely event. Should that event never happen, whatever money invested would prove totally worthless. However, _if_ you encounter an issue, then you'll be happy to have spent enough money into security.

AFAIK, you consider security the same way you consider insurance (or as an insurance complement): How much your business continuity's worth? Should you be hacked/DDoSed, how will it affect your revenue? How much money would you need to get it all back online? You'll also need to consider how intrusive your security is: data backup solutions sometimes require you to stop services while they are processed. If you want backups to be non-intrusive, again, you'll consider how much these stopped services cost. Same goes for services availability (clustering, replication, off-site disaster recovery plans).

In short : your security investments are business specific. No easy rule of thumb in here, I'm afraid.

Hope this helps.