Yes, but it's hard to quantify the benefits (or even the costs) of a security measure—it's just as much a risk evaluation as it is a cost one.
So, in that sense, coming up with a precise measure of marginal cost / marginal benefit would be hard in practice.