Which of the following presents the GREATEST challenge in calculating return on investment (ROI) in the security environment?

A. Number of incidents cannot be predetermined
B. Project cost overruns cannot be anticipated
C. Cost of security tools is difficult to estimate
D. Costs of security incidents cannot be estimated