ROI measures the financial return of an investment in the usual business sense, while ROSI measures how much security investment reduces expected loss from cyber incidents. In security, the purpose is often to fund the right level of protection rather than to maximise profit. That makes ROSI a risk based decision tool, not a simple sales metric.
Why ROI and ROSI answer different planning questions
ROI asks whether a spend produces net financial gain in the usual business sense. ROSI asks a different question: whether a security control reduces expected cyber loss enough to justify its cost. That distinction matters because many security investments are not designed to create profit, they are designed to reduce exposure, limit blast radius, or avoid larger losses.
In practice, ROI works best when the outcome is a direct revenue or productivity return. ROSI is better when the benefit is risk reduction, because the value is tied to avoided incidents, lower likelihood of compromise, or smaller impact if an event occurs. A project can look weak on ROI and still be the right security decision on ROSI grounds.
- ROI is a general investment lens, useful for capital allocation across business initiatives.
- ROSI is a security planning lens, useful for comparing controls against the expected cost of loss.
- Security teams usually need both views, but they should not be forced into the same formula.
Where this becomes especially visible is in identity and secrets management, where weak controls can create broad exposure. NHIMG research notes that 97% of NHIs carry excessive privileges, which is exactly the sort of condition that can make a control look expensive until the avoided loss is modelled correctly.
How to interpret ROSI in a real security budget
ROSI is not a promise that a control will “pay for itself” in a clean accounting sense. It is a decision aid that compares the cost of a control with the reduction in expected loss, usually by considering probability, impact, and residual risk. That means the output is only as good as the assumptions behind the scenario.
For practitioners, the useful question is not “Will this investment make money?” but “Does this investment reduce loss more efficiently than the next best option?” That is why ROSI is often used alongside threat modelling, control prioritisation, and exposure analysis. It helps rank options such as detection, hardening, rotation, segregation, or monitoring when all of them reduce risk in different ways.
- Use ROI for business cases where benefit is directly measurable revenue or cost savings.
- Use ROSI when the benefit is lower expected loss from incidents, fraud, misuse, or breach.
- Compare controls by the reduction in expected loss, not by the illusion of a guaranteed return.
For a broader security planning view, the CISA cyber threat advisories and CISA Known Exploited Vulnerabilities Catalog are useful reference points when you want to translate threat likelihood into control priority.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.1 — Cybersecurity Risk Management Strategy | ROSI is a risk-based planning method for prioritising security investment. |
| ID.RA — Risk Assessment | ROSI depends on estimating likelihood and impact of cyber loss. | |
| Recommendation — Use GV.1 to tie security spending to quantified risk reduction and business tolerance. Apply ID.RA to estimate expected loss before comparing control options. | ||
| CIS Controls v8 | CIS 17 — Security Awareness and Skills Training | Planning security spend often requires control selection and cost justification. |
| CIS 8 — Audit Log Management | Controls like logging are often justified through reduced detection and response loss. | |
| CIS 6 — Access Control Management | Access controls frequently drive ROSI calculations through avoided compromise and misuse losses. | |
| Recommendation — Use CIS 17 to align security investments with the most material loss-reduction gaps. Use CIS 8 to justify monitoring investment by measuring reduced dwell time and response cost. Use CIS 6 to prioritise least-privilege controls where they most reduce expected loss. | ||
Practitioner Guidance
What to verify: When someone presents “ROI” for a security initiative, check whether the numbers are really modelling avoided loss, reduced incident likelihood, or lower recovery cost. If so, the analysis is closer to ROSI even if it is labelled as ROI.
Decision rule: If the control meaningfully reduces the expected impact of compromise, privilege abuse, or data exposure, evaluate it with ROSI. If the proposal is mainly about efficiency, growth, or revenue creation, ROI is the better lens.
What practitioners underestimate: ROSI depends heavily on the assumptions for incident frequency and impact, so weak input data can make the result look precise when it is only directional. Treat ROSI as a prioritisation tool, not a final proof of value.
Practitioner takeaway: The key judgement is to match the metric to the decision, ROI for business return, ROSI for cyber loss reduction, because security funding is usually justified by avoided damage rather than profit generation.
Related resources from NHI Mgmt Group
- What is the difference between a functional control model and a layered technical model in cybersecurity planning?
- What is the difference between a mental model and a control framework in cybersecurity planning?
- What is the difference between IGA ROI and broader identity security ROI?
- What is the difference between ransomware containment and recovery planning?
