ROSI is credible when the team can defend both sides of the equation: the implementation cost and the avoided loss. If impact estimates are vague or the control effect is overstated, the model becomes advocacy. It works best when tied to a specific scenario, not a generic security improvement.
Why ROSI is credible only when both cost and loss are defensible
ROSI becomes credible when the estimate is anchored in a specific control, a specific loss scenario, and a realistic implementation cost. That means the model is not trying to prove that “security is good”, it is testing whether one measure reduces a defined exposure enough to justify the spend. The closer the estimate stays to an observable business event, the more credible it is.
A useful ROSI calculation separates the avoided loss from the control cost instead of blending them into a vague business case. If the avoided loss is only a broad assumption, or if the control’s effect is assumed rather than measured, the result can look precise while still being speculative. Good ROSI usually comes from scenario modelling, not from average security intuition.
For planning, that is where credibility is won or lost. A control that reduces a clearly identified loss event, such as credential theft, outage, or fraud, can be evaluated against expected frequency and consequence. A control proposed as a general improvement to posture is harder to defend because there is no stable baseline for what it prevents.
What breaks ROSI models in practice
The most common failure is overstating either the baseline risk or the control effect. If the team inflates the likelihood of loss, ROSI becomes a sales tool. If the team assumes a control removes more exposure than it realistically can, the model stops reflecting operational reality and starts rewarding optimism.
Another failure is treating every security outcome as equally monetisable. Some losses are direct and measurable, such as recovery effort or fraud exposure. Others are indirect, such as reputation or customer trust, and can be much harder to quantify without turning the model into guesswork. ROSI is strongest when the loss type is concrete enough that finance and security can both challenge the assumptions.
Credibility also falls apart when the control is too broad. A generic “improve security” effort rarely maps cleanly to one avoided loss, while a narrowly defined control can usually be tied to one attack path, one operational dependency, or one class of incident. That specificity matters because it makes the assumptions auditable rather than rhetorical.
How to scope ROSI so it stays decision-useful
Start with the loss event, not the technology. Define the scenario in plain terms, then ask what the expected cost would be if that event happened and what portion of that cost the proposed control could realistically reduce. If the answer cannot be explained in one scenario, the model is probably too abstract to guide capital or operational planning.
A credible ROSI estimate also needs a stable implementation cost. That includes build effort, licensing, operating overhead, tuning, and any compensating controls required to keep the measure effective. When those costs are omitted, the return looks better than it really is and the comparison against alternatives becomes unreliable.
For this reason, teams should treat ROSI as a planning aid, not as proof that a control should be adopted. It is most useful when comparing options, prioritising a backlog, or explaining why one control is worth funding before another. It is least useful when used as a blanket justification for security spending without a scenario and a cost model behind it.
Risk and Threat Considerations
Overconfident ROSI models create governance risk because they can move budget toward controls that sound effective but do not materially reduce exposure. They also create threat blind spots when the assumed avoided loss is detached from the attacker’s actual path to impact.
Failure mechanism: Teams overstate loss avoidance, understate implementation cost, or use a generic improvement claim that is not tied to a specific attack or failure scenario. The model then rewards narrative confidence instead of measurable risk reduction.
Impact: Security funding can be misallocated, important controls can be underfunded, and decision makers may believe they have bought down risk when the practical effect is modest or uncertain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | RA-3 — Risk Assessment | ROSI depends on defensible loss and likelihood assumptions for a specific scenario. |
| Recommendation — Use RA-3 to tie the estimate to a documented risk scenario and expected impact. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | ROSI supports investment decisions only when linked to an explicit risk strategy. |
| GV.OV-02 — Oversight of Risk Management Strategy | ROSI is an oversight tool for comparing security investments against measurable loss reduction. | |
| Recommendation — Align ROSI assumptions to the organisation’s risk tolerance and prioritisation method. Review whether the investment case uses measurable assumptions and reviewable evidence. | ||
| ISO/IEC 27001:2022 | A.5.31 — Legal, statutory, regulatory and contractual requirements | Security value cases often depend on externally driven loss exposure and obligation-driven impact. |
| Recommendation — Map the control to the specific obligation or exposure it reduces. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | ROSI is strongest when avoided loss includes response and recovery cost reduction. |
| Recommendation — Quantify the response and recovery cost a control is expected to avoid. | ||
Practitioner Guidance
What to verify: Confirm that the control has a defensible before-and-after effect on a named loss scenario, and that the cost model includes delivery, operation, and maintenance, not just acquisition.
Decision rule: If the avoided loss cannot be described in business terms and challenged by both security and finance, treat the ROSI as directional only, not decision-grade.
Common mistake: Do not let a percentage reduction claim stand in for evidence. A credible ROSI should show the specific mechanism of reduction, such as fewer successful compromises, lower recovery effort, or reduced blast radius.
Practitioner takeaway: ROSI is credible when it is a scenario-based estimate of avoided loss versus full control cost, and not a generic expression of security value.