It costs 100M a year..
And the problem with thinking like a business is not everything is a "profit" line item. Government's job is never about "profit".. yes, there is a balance between expendiatures and intake. but its not exact..
Like for instance.. how most people think is:
Direct Income Taxes = Income
Everthing else = Expenses
But the reality is more complicated than that.. Like the CVE program... that 100M that the US government spends, helps to reduce cost by many companies (US and otherwise) as well as agencies by reducing threat exposure and vulnerability costs (from threat actors and breaches) which in turn make those agencies spend less money (or allow companies to generate more profit) which in turn for companies earn more in taxes (income taxes).. Same for non-US companies that deal with the US.. most have provisions and contracts in place to mitigate risk by doing audits against such CVE's which means they earn more money, and have a greater interest in doing business with the US, because of the mutual benefit), which generates "soft power" because is a tangible benefit/perk for such an arrangement..
When everything becomes a transaction, there is simply far less of an incentive to do business since everything becomes a process and cost.. many have to weigh the penalty vs. benefit.. and it starts tipping more against the US than for it. (its one reason why a lot of companies simply don't focus on specific geographic markets.. there is very little benefit so they may deal with a larger region as a whole but simply ignore the sub locations because of that "cost".
Basically 100M in the federal budget is practically free, but the benefits to US companies and others is immeasurable... and just like "insurance" everyone bitches about it UNTIL they need it and then they kiss their agent, up until that time, they curse the name as an expense.