ROSI breaks down when the underlying metrics are burdensome, irrelevant, or too imprecise to use repeatedly. In that case, the calculation becomes a reporting exercise instead of a decision tool. Teams lose the ability to compare investments consistently, and the model stops supporting budget or strategy decisions with credible evidence.
Why ROSI Stops Being Decision-Grade When Measurement Cost Rises
ROSI depends on repeatable, decision-useful inputs. Once a metric takes too much effort to gather, validate, or refresh, the model starts consuming more time than it saves. The calculation may still produce a number, but it no longer helps teams compare options quickly or keep pace with changing risk conditions.
Costly measurement also distorts the process itself. Teams may narrow the analysis to whatever is easiest to count, not what is most material to the decision, which weakens the business case and makes the output less credible to budget owners.
How Vagueness Breaks Comparability
ROSI is most useful when the inputs are defined tightly enough that the same control, loss type, or exposure can be measured the same way over time. If the metric is vague, different analysts will interpret it differently, and the result becomes hard to compare across projects, time periods, or business units.
That ambiguity is not a minor reporting issue. It changes the meaning of the output, because a model built on inconsistent assumptions can make one investment look better or worse without any real change in underlying security value.
Why Hard-to-Collect Metrics Undercut Trust in the Model
When a security metric is difficult to collect, the data often arrives late, incomplete, or via manual approximation. That weakens the chain from observed condition to financial estimate, and the ROSI result becomes more like a one-off estimate than a tool for ongoing decision support.
Over time, teams stop relying on the model because they cannot reproduce the number with confidence. At that point, ROSI ceases to guide prioritisation and becomes a justification document that is revisited only when someone needs a slide for stakeholders.
Risk and Threat Considerations
When metrics are expensive, vague, or hard to collect, the main risk is not a bad formula, it is a bad decision process. Security leaders may keep investing in controls that are easy to measure rather than controls that actually reduce exposure, while attackers benefit from the resulting blind spots and delayed prioritisation.
Failure mechanism: Burdensome or imprecise measurement pushes the organisation toward infrequent, manual, or selectively sampled inputs, which weakens comparability and allows subjective assumptions to dominate the calculation.
Impact: Budget decisions lose credibility, security teams struggle to defend priorities, and the organisation may underfund controls whose value is real but difficult to quantify cleanly.
Practitioner Guidance
What to prioritise: Use ROSI only for metrics that can be collected consistently enough to support repeated comparison. If the data source is unstable or the definition is fuzzy, treat the result as directional input rather than a decision threshold.
What to verify: Check whether the metric can be refreshed without disproportionate analyst effort and whether two independent reviewers would derive the same value from the same evidence. If not, the metric is too weak to anchor investment decisions.
Practitioner takeaway: The test is not whether ROSI can be calculated once, but whether the measurement can be repeated cheaply and consistently enough to support real prioritisation.