ROSI Guide: Justify Security Budgets With Defensible Numbers

Security leaders are asked to prove the value of spending whose main output is a loss that did not happen. Return on security investment (ROSI) is the family of methods that turns that question into numbers a finance committee can test: expected loss avoided, cost of the control, and the uncertainty around both. Used well, it ranks competing proposals and exposes weak ones. Used badly, it produces a precise looking percentage built on guesses. This guide explains the classic ROSI calculation, its limits, the better alternatives that sit on top of quantified risk, and how to build an investment case that survives challenge. It is for CISOs, security architects writing business cases and risk teams supporting them, and it builds on the Cyber Risk Quantification Guide rather than repeating it.

Key takeaways

ROSI measures avoided loss, not revenue. The calculation compares the reduction in expected annual loss against the full cost of a control, so its quality depends entirely on the loss and effectiveness estimates.
Use ranges, never single points. A ROSI of 140 percent means little without the range behind it; quantified risk methods such as Open FAIR with Monte Carlo simulation give finance a distribution to test.
Compare options, do not justify one. The strongest cases show several ways to reduce the same risk, including doing nothing, and explain why the chosen one wins on risk reduced per unit of spend.
Tie spend to risk appetite. NIST CSF 2.0 expects resources commensurate with the risk strategy (GV.RR-03) and risk appetite statements (GV.RM-02); investment cases should reference both.
Measure after you buy. A ROSI estimate is a hypothesis; the post-investment review that checks control effectiveness and loss experience is what builds credibility for the next budget round.

What ROSI is and where it came from

ROSI adapts the familiar return on investment idea to security, where the benefit is a reduction in expected loss rather than new income. ENISA published its Introduction to Return on Security Investment in December 2012, framing the problem in terms that still apply: security prevents losses rather than generating profit, so organisations struggle to measure its cost effectiveness, yet teams such as CERTs must justify their budgets. The ENISA material and most textbooks use the same basic inputs:

Single loss expectancy (SLE): the expected cost of one occurrence of a loss event, such as a ransomware outage or a data breach.
Annual rate of occurrence (ARO): how many times per year the event is expected to happen. Rare events have an ARO below one, for example 0.2 for once in five years.
Annualised loss expectancy (ALE): SLE multiplied by ARO, the average annual cost of the risk.
Mitigation ratio: the proportion of the ALE the control is expected to remove.
Cost of the solution: annualised total cost of ownership, including licences, staff time, integration, training and operational overhead.

The common form of the calculation is:

ROSI = (ALE x mitigation ratio - cost of solution) / cost of solution

A positive result means the expected loss avoided exceeds the cost. The formula is simple by design, which is both its strength and its weakness.

A worked example, and what it hides

The figures below are illustrative only, to show the mechanics. Suppose a mid-sized firm estimates that a ransomware event affecting its file servers would cost 2,000,000 in recovery, downtime and response (SLE), and expects such an event roughly once every four years (ARO 0.25). The ALE is 500,000. A proposed immutable backup and recovery capability costs 120,000 a year all in, and the team estimates it would remove 60 percent of the loss.

Input	Value	Where the uncertainty sits
SLE	2,000,000	Downtime cost per hour, regulatory and legal costs, customer churn
ARO	0.25	Threat frequency for this sector and this attack surface; little local data
ALE	500,000	Product of two uncertain numbers, so error compounds
Mitigation ratio	0.6	Whether restores actually work at scale and how fast
Annual cost	120,000	Usually the best known input; hidden staff costs are the gap
ROSI	(300,000 - 120,000) / 120,000 = 150 percent	Looks precise; is only as good as the weakest input

Change the ARO from 0.25 to 0.1 and the ROSI drops to zero. Change the mitigation ratio from 0.6 to 0.2 and it turns negative. That sensitivity is the core problem with single point ROSI: the answer often reflects the optimism of whoever chose the inputs. Two practices fix most of it:

Sensitivity analysis: show which input moves the result most, and what value would make the investment break even. Finance teams find a break even threshold more useful than a headline percentage.
Ranges and simulation: express each input as a calibrated range (minimum, most likely, maximum) and run a Monte Carlo simulation to produce a distribution of avoided loss, as described in the Cyber Risk Quantification Guide.

Choosing a method: ROSI, quantified risk or cost effectiveness

ROSI is one of several ways to frame a security investment. The right one depends on the decision, the data available and the audience.

Method	What it answers	Best for	Main weakness
Classic ROSI (point estimate)	Does expected loss avoided exceed cost?	Quick screening of small proposals	False precision; easy to manipulate inputs
Quantified risk (Open FAIR with simulation)	How does the loss distribution change, including tail risk?	Large investments and board level decisions	Needs trained analysts and calibrated estimates
Net present value and payback	What is the multi-year value after discounting?	Multi-year programmes competing with other capital spend	Still needs a loss reduction estimate per year
Cost effectiveness ranking	Which option reduces a defined risk most per unit of spend?	Comparing alternative controls for the same risk	Does not say whether any option is worth doing
Compliance or obligation driven	What is the cheapest way to meet a mandatory requirement?	Regulatory deadlines, contractual clauses	Risk reduction beyond the minimum is ignored
Maturity or coverage gap	How far is the control set from a target profile?	Programme roadmaps tied to frameworks	Coverage is not the same as loss reduction

Decision guidance:

Small organisations: a simple ROSI with explicit ranges and a break even point is usually enough. The effort of full quantification can exceed the value of the decision.
Large organisations: use Open FAIR style analysis for any investment above an agreed threshold, and keep ROSI as a screening tool for smaller items. The Open Group publishes the Open FAIR Risk Taxonomy (O-RT) and Risk Analysis (O-RA) standards that define the factors; see the FAIR Model and Open FAIR Standard Guide.
Regulated obligations: where a law or regulator mandates a control, present it as a compliance cost, then use cost effectiveness to choose how to meet it. Do not invent a ROSI to make a mandatory item look discretionary.
Platform or foundational spend: identity, logging and asset inventory reduce many risks at once. Attribute benefit across the scenarios they affect rather than forcing them into one.

How much to spend: the Gordon and Loeb result

Economists Lawrence Gordon and Martin Loeb published a widely cited model in 2002 suggesting that, under their assumptions, the optimal investment to protect a given information set should not exceed about 37 percent (1/e) of the expected loss from a breach of it, a result that holds for the classes of breach probability functions they studied rather than in general. Check the original paper before quoting the figure. It is a useful sanity check that spend should be proportionate to expected loss, but the model's assumptions are stylised, so treat it as a ceiling heuristic for discussion rather than a budgeting rule.

Building an investment case that survives challenge

NIST IR 8286 Rev. 1, Integrating Cybersecurity and Enterprise Risk Management, published in December 2025, describes using risk registers to record cybersecurity risk and rolling risk measures up from system and organisational levels to the enterprise. An investment case that plugs into that structure speaks the language of the enterprise risk function. A practical sequence:

Start from the risk register. Name the risk scenario the investment addresses, using the same identifier and owner as in the enterprise or cybersecurity risk register. If the risk is not on the register, fix that first.
Agree the loss model with finance. Agree the cost categories (response, downtime, replacement, fines and judgements, reputation) and the values per hour or per record before any security estimate is made. Business impact analysis outputs, as described in NIST IR 8286D, are the usual source for downtime and mission impact.
Estimate current risk with ranges. Gather frequency evidence from incident history, sector threat intelligence and control test results. Record the source and confidence of each estimate.
Define two to four options. Include doing nothing, a minimal option and the preferred option. For each, estimate the change in frequency or impact and the full annual cost.
Calculate and test. Compute ROSI or avoided loss distributions per option, run sensitivity analysis, and find the break even value for the most uncertain input.
Check against risk appetite. Show where residual risk lands relative to the board's stated appetite and tolerance. An option that is cost effective but leaves risk above tolerance is not sufficient.
Peer review. Ask someone outside the proposing team, ideally from risk or finance, to challenge the inputs. Record the challenges and the changes made.
Set success measures before approval. Define the leading indicators and the review date that will test whether the predicted risk reduction happened.

For the document itself, the Security Business Case Template gives a structure, and the Security Budget and Investment Planning Guide covers the annual budget cycle that these cases feed.

Estimating mitigation honestly

The mitigation ratio is where most ROSI cases fail. Vendors quote detection rates measured in lab conditions; real effectiveness depends on deployment coverage, configuration and the people who respond. Ways to ground the estimate:

Coverage first: a control deployed to 70 percent of endpoints cannot reduce endpoint risk by more than 70 percent, whatever its detection rate. Multiply efficacy by coverage.
Attack path reasoning: map the control to the specific steps of the scenario it disrupts, for example initial access or recovery, using MITRE ATT&CK techniques where helpful. A control that blocks one of several alternative paths reduces frequency less than one that blocks a mandatory step.
Test evidence: use penetration test, red team and control validation results from your own environment ahead of vendor claims.
Decay and drift: controls lose effectiveness as environments change. Build a decline into multi-year estimates unless operational budget is included to maintain them.
Overlap: two controls that each claim 50 percent reduction of the same risk do not combine to 100 percent. Model them together.

Where identity fits

Identity investments are among the hardest to value with classic ROSI because they reduce many scenarios at once: credential theft, privilege escalation, insider misuse and abuse of service accounts and API keys. They are also among the most measurable after deployment, because coverage metrics such as the share of privileged access through managed paths or the number of long-lived secrets are easy to count. Allocate avoided loss across the scenarios that identity controls touch, and use those coverage metrics as the leading indicators. The IAM Business Case and ROI Guide works through this in detail for identity programmes.

Measuring value after the investment

Post-investment review is what turns ROSI from a sales document into a management tool. NIST CSF 2.0 expects organisations to evaluate risk management performance and identify improvements (GV.OV-03, ID.IM-01), and SP 800-53 Rev. 5 control PM-6 Measures of Performance asks for outcome based measures. Useful metrics:

Prediction accuracy: the share of approved cases whose post-review loss and effectiveness indicators fell inside the predicted range.
Coverage achieved: percentage of the intended scope (hosts, accounts, applications) where the control is live and correctly configured, against the plan.
Control effectiveness evidence: pass rate in control validation or attack simulation tests that target the scenario.
Loss experience: incident frequency and cost for the scenario, compared with the baseline estimate, accepting that rare events make short term comparisons noisy.
Cost variance: actual annual total cost against the estimate, including staff time.
Residual risk position: movement of the scenario on the risk register relative to appetite.

Report these at the review date set in the original case, whether the result is good or bad. Admitting a missed estimate is what earns trust for the next request.

Framework mapping

Framework	Reference	How investment cases support it
NIST CSF 2.0	GV.RM-02	Investments justified against stated risk appetite and tolerance
NIST CSF 2.0	GV.RM-03	Cyber risk and investment decisions included in enterprise risk management
NIST CSF 2.0	GV.RM-06	Standardised method for calculating and prioritising risk
NIST CSF 2.0	GV.RR-03	Resources allocated commensurate with the risk strategy
NIST CSF 2.0	GV.OV-03	Performance of risk management evaluated and adjusted
NIST SP 800-53 Rev. 5	PM-3, PM-9, RA-3, RA-7, PM-6	Resourcing, risk strategy, risk assessment, risk response and measures of performance
NIST IR 8286 series	Risk registers and BIA	Structure for linking cases to enterprise risk

Common failure patterns

Working backwards from the answer. Choosing inputs until the ROSI clears a hurdle is common and obvious to experienced finance reviewers; it damages credibility for every later case.
Using industry average breach costs as SLE. Headline averages from surveys rarely match a specific organisation's size, sector and data. Build the SLE from your own cost categories.
Ignoring the cost of running the control. Licence cost alone understates total cost; the staff time to tune, monitor and respond is often larger.
Counting the same avoided loss twice. Separate cases for overlapping controls each claim the full reduction of one risk, inflating the portfolio benefit.
No review after purchase. Without a planned review, there is no evidence to improve estimates and no defence when the budget is questioned.
Treating ROSI as the only criterion. Legal obligations, contractual commitments and tail risks that threaten survival can justify spend that a mean based ROSI undervalues.

Practitioner checklist

Link every investment case to a named risk on the enterprise or cybersecurity risk register.
Agree loss categories and unit costs with finance before estimating.
Express SLE, frequency and mitigation as ranges with a recorded source and confidence.
Include total annual cost of ownership, with staff time, not just licences.
Present at least two alternatives plus doing nothing, ranked by risk reduced per unit of spend.
Run sensitivity analysis and state the break even value of the most uncertain input.
Show residual risk against the board's risk appetite and tolerance.
Have the case challenged by someone outside the proposing team.
Define leading indicators and a review date before approval.
Publish the post-investment review and use it to calibrate future estimates.

Security Investment and ROSI Guide: Justify Security Budgets With Defensible Numbers