What happens when organisations use ROSI to compare security options without a realistic view of their risk exposure?

How ROSI Breaks When Risk Exposure Is Estimated Poorly

ROSI only works when the risk baseline is believable. If organisations understate exposure, they can overestimate savings, because the calculation assumes losses are less likely or less severe than they really are. If they overstate exposure, they may justify controls that are oversized for the actual threat, so the model stops being a decision aid and becomes a justification exercise.

That distortion is especially dangerous when teams compare options with different operating assumptions, such as preventative controls versus detective controls, or narrow technical fixes versus broader governance changes. The apparent winner may simply be the option that was easiest to quantify, not the option that reduces the most meaningful risk.

Why False Precision Changes Security Priorities

ROSI can create a false sense of rigor because the output looks numeric, but the numbers are only as sound as the inputs. When exposure is not grounded in realistic threat frequency, asset value, control effectiveness, and likely impact, the comparison can shift attention toward the cheapest-looking measure instead of the most effective one.

That matters because security budgets are finite. A weak risk estimate can cause teams to fund controls that improve spreadsheet outcomes while leaving higher-value exposures untreated, or to reject a control that would actually reduce material loss. In practice, the organisation may optimise for cost avoidance instead of risk reduction.

When the same flawed assumptions are reused across multiple proposals, the error compounds. A portfolio can end up with inconsistent priorities, where each project appears sensible in isolation but the overall strategy is still misaligned with real exposure.

What Good ROSI Comparison Requires Before You Trust the Result

A credible comparison starts with a shared view of the threat, the asset at risk, and the loss scenario the control is meant to change. The point is not perfect certainty; it is to make sure the assumptions are explicit enough that another practitioner could challenge them and reach a similar conclusion.

For that reason, the most useful ROSI discussions usually separate the business case into a few distinct questions: what loss is being avoided, how often that loss is likely, how much the control reduces it, and what residual risk remains. If any of those pieces is vague, the comparison should be treated as directional rather than definitive.

• Use the same exposure assumptions across all options being compared.
• Separate likely loss reduction from compliance, convenience, or reputational arguments.
• Test whether the control addresses the highest-frequency or highest-impact scenario, not just the easiest one to model.

Risk and Threat Considerations

ROSI becomes risky when it hides uncertainty behind a precise-looking number. The main threat is not the formula itself, but the organisational habit of treating estimated savings as if they were measured outcomes, which can misdirect funding and leave the most material exposure untouched.

Failure mechanism: unrealistic exposure assumptions skew frequency, impact, or control-effectiveness inputs, so the comparison rewards the wrong control and underestimates the real loss pathway.

Impact: the business may accept avoidable risk, overinvest in low-value controls, or build a security roadmap that is defensible on paper but weak against actual loss conditions.

Practitioner Guidance

What to verify: Before trusting a ROSI comparison, check whether the same exposure assumptions were used for every option and whether those assumptions reflect a current threat scenario, not a legacy incident or generic benchmark. If the model cannot explain which loss event it is pricing, the result is too soft to drive investment.

Decision rule: If the comparison is being used to choose between materially different controls, prioritise exposure realism over model elegance. A simpler estimate with defensible assumptions is more useful than a sophisticated calculation built on a weak risk narrative.

Practitioner takeaway: ROSI is only decision-grade when it is anchored to a credible loss story; otherwise it measures confidence in assumptions, not the true value of the control.

Related resources from NHI Mgmt Group

• What happens when organisations try to investigate cloud incidents without a unified security data view?
• What happens when organisations use a risk dashboard without linking it to remediation?
• What happens when organisations use AI for security work without strong human review and training?
• When does secret exposure become a broader identity risk?