Question

An e-commerce enterprise is performing a quantitative risk assessment for its core order processing cluster, which has an estimated Asset Value ($AV$) of $\$750,000$. Security metrics indicate that a ransomware incident affecting this cluster has an Annualized Rate of Occurrence ($ARO$) of $0.20$ and an Exposure Factor ($EF$) of $40\%$. To mitigate this risk, the enterprise plans to deploy an Endpoint Detection and Response (EDR) control costing $\$18,000$ annually. This safeguard will reduce the $EF$ to $10\%$ without affecting the $ARO$. What is the net annual financial benefit, in dollars, of implementing this security safeguard?