Return on Security Investment (ROSI): How to Measure It

Return on security investment (ROSI) compares the loss a security control is expected to prevent with what the control costs. The formula is simple, but every input in it is an estimate, so a ROSI presented as arithmetic tends to fall apart in a finance review. Keep the formula's discipline, express uncertain inputs as ranges, and separate modeled loss reduction from realized savings, which need budget, contract, payroll, or insurance records behind them.

A CFO wants to know what last year's security spend bought, and a quiet year doesn't answer that. Budgets make the question sharper: the 2026 IANS budget benchmark puts median security budget growth at 0% for the second year running, with 55% of CISOs reporting flat or shrinking budgets.

TL;DR:

• ROSI structures a risk conversation around estimated inputs. It cannot measure risk on its own, and modest changes to those inputs can turn a strongly positive result negative.
• Analyst time saved becomes a financial saving only when it shows up in the budget. Time that goes into previously ignored alerts is expanded coverage, valued through risk reduction.
• Consolidation returns count once old contracts are retired. A new platform running alongside the tools it was meant to replace adds cost.
• Finance tends to accept ranges and outcomes someone can check. Loss ranges, escalation volume tied to internal hours, and contract scope hold up better than activity counts.

The ROSI Formula and What It Assumes

Wes Sonnenreich, Jason Albanese, and Bruce Stout presented a practical quantitative ROSI model in a 2005 conference paper. A journal version followed in 2006. The version most practitioners use is:

ROSI = (ALE x mitigation ratio - cost of the control) / cost of the control

Annualized loss expectancy (ALE) is single loss expectancy (SLE) multiplied by the annual rate of occurrence (ARO). In the paper, risk exposure equals ALE.

The paper's worked example is a company called ViriCorp. Each virus infection costs $25,000 in damage and lost productivity, ViriCorp sees four a year, and a $25,000 scanner should catch three of the four. The math yields $100,000 of exposure, $75,000 mitigated, and a ROSI of 200%.

ENISA's 2012 guide runs the same math on an anti-virus purchase for CERTs: five attacks a year at €15,000 each, 80% blocked, and €25,000 a year in cost, for a ROSI of 140%.

Both examples look tidy, and the authors of both warned that the inputs are approximations.

Where ROSI Breaks Down

A finance review tests the inputs first, and that is where ROSI is weakest.

1. Every Input Is an Estimate

Sonnenreich and his co-authors cautioned that ViriCorp's scanner only looks worth buying because of assumed figures for cost per incident, catch rate, and price. None of those figures is likely to be very accurate. They then broke their own average. If three viruses cost $5,000 and one costs $85,000, the mean is still $25,000, but the scanner's return now depends on which one it misses. If it misses a $5,000 virus, ROSI rises to nearly 300%; if it misses the expensive one, in the paper's words, "the ROSI becomes negative!"

ENISA's report goes further, calling the result a product of many approximations that "can be easily manipulated" to support a decision someone has already made.

2. Avoided Loss Is a Counterfactual

Security vendor Praetorian puts it plainly: no one can prove the incident that didn't happen, and fear-based justification loses credibility after years of rising budgets with no matching incidents. In finance meetings, that means the best outcome of a security investment is often that nothing happens, which is hard to sell.

3. Soft Dollars Rarely Leave the Budget

Phil Venables, writing in 2021, gave the example of an authentication vendor whose time-saving math claims a 750% ROI on a $2M product. The time saved "only becomes real money if you then actually reduce the size of the employee base," he wrote. In his view, ROI has to rest on rigorously defined cost avoidance.

4. A Single-Year Point Estimate Hides the Tail

The FAIR Institute's practitioner guide treats ROSI as a useful screen for quick wins with payback under two years. Past that horizon a basic ROSI ignores the time value of money and assumes ALE stays flat, and a single point estimate hides uncertainty that sensitivity analysis would expose.

KPMG's risk quantification team adds that ALE overstates the typical annual loss and understates the worst case by a wide margin. For a board worried about a catastrophic incident, ALE gets the emphasis backwards. KPMG's conclusion is that no single metric suits every audience.

Inputs That Survive a Finance Review

Someone outside the security team should be able to check each input against financial records or published distributions, and ledgers and contracts carry most of that evidence.

1. Loss Avoided, Stated as a Range

FAIR analyses use Monte Carlo simulation to produce a loss exceedance curve, which plots the probability of exceeding each loss value. A 2018 FAIR Institute example asks whether a $3.5M cyber insurance limit is adequate; the curve shows a 52% probability of losses above $3.5M. An abstract risk becomes a coverage decision. Each range needs a rationale others can inspect; output without one deserves suspicion.

Published benchmarks can calibrate those ranges. IBM's 2026 breach report puts the global average cost of a breach at USD 4.99M. Organizations using security AI and automation extensively had average breach costs USD 1.93M lower than those using none. These are sample averages and comparisons that give context for your range; they are not loss bounds or a forecast of your loss.

2. Analyst Time, Tied to Budgeted Cost

Time-saved claims are among the easiest inputs to inflate. The usual formula multiplies reclaimed hours by a fully loaded hourly rate. BLS data puts the US median annual wage for information security analyst roles at $129,180 in May 2025. The BLS figure excludes benefits and overhead, so use your finance team's loaded rate.

Then apply a version of Venables' test. Count reclaimed time as a financial saving only when it reduces spend or avoids a documented, budgeted cost such as an approved requisition. When it lets the team investigate alerts it used to drop, report it as expanded coverage and value it separately through a defensible estimate of risk reduction.

Staffing data explains why reclaimed time usually ends up as coverage. A vendor-sponsored SANS white paper from March 2026 reports that two-thirds of SOC teams cannot keep pace with alert volume. Only 11% of CISOs in the 2025 IANS benchmark said their teams were adequately staffed. Artico Search's Steve Martano described the pattern in the same report: CISOs get budget for tooling but not for more staff.

3. Consolidation, Counted in Retired Contracts

A January 2025 study by IBM's Institute for Business Value and Palo Alto Networks found the average organization runs 83 security tools from 29 vendors. Organizations that had consolidated onto platforms reported an average ROI of 101%, against 28% for those that had not. Those figures show a correlation in a survey co-produced with a platform vendor, and they don't measure before-and-after savings.

Realized savings are harder to find. In August 2025, Munich Reinsurance said it expected to save $4 million a year once it fully merges its SOC, SIEM, threat intelligence, threat hunting, and EDR operations. The figure was a forecast at the time.

A CSO Online columnist describes a cautionary scenario: a CISO finds 11 tools doing the work of four, buys a platform, and six months later all 11 are still running.

4. Premiums, Compliance, and Deal Gates

Insurance offers one of the few externally priced returns, because the insurer sets the premium independently of the security vendor. A 2023 Marsh McLennan study identified EDR, MFA, and privileged access management as the controls insurers recommend most often. Its 2025 follow-up shifts the focus from whether a control is in place to how it is deployed. Use your insurer's own pricing or changes to your insurance terms as the evidence.

Market conditions move premiums too: Marsh reported that cyber rates fell 4% globally in Q3 2026, the thirteenth straight quarterly decline. Part of any premium drop may come from the market, and that share belongs outside your controls' return.

Compliance mostly works as a revenue gate. IANS faculty member Olivia Rose has described buyers granting vendors access on the strength of a questionnaire and a SOC 2 report. She doesn't put a number on the revenue involved, so treat these checks as customer-access requirements unless your own deal records support an estimate of revenue enabled or retained.

5. Managed Service Records

Escalations, verdicts, response actions, and contract terms can all be checked after the fact, which makes them usable inputs once you price them. Building a SOC in-house and buying a service have different cost structures; on the return side, these inputs tend to hold up:

• Escalation volume per month, priced in the internal hours each one consumes
• The share of alerts the provider investigates all the way to a verdict
• Response authority, meaning whether the provider contains threats or stops at a notification
• Contract scope, including whether breach response sits inside the engagement or requires a separate IR firm

Response authority deserves the closest read, since BD Emerson notes that MSSP service levels can stop at notification. Public escalation benchmarks are scarce, so compare against your own history.

How CISOs Present ROI to Finance and the Board

Principle Five of the 2026 NACD cyber handbook calls for standardized, quantitative reports in business, financial, and operational terms, and the handbook expects those reports at least quarterly. Gartner's Paul Proctor reframes the CFO's question as whether finance leaders can defend their cybersecurity choices to key stakeholders. Gartner recommends protection-level agreements, which tie a defined cost to a measurable level of protection, such as patching critical systems within 30 days.

Finance responds to a decision set against a range. A FAIR Institute example from Liberty Mutual's program describes a hypothetical system earning $25 million in revenue with $1 million to $10 million in annualized loss exposure. A $250,000 remediation that materially cuts that exposure is an easy call.

Gary Hayslip plugged his security risk register into the enterprise risk platform the board already reviews. Renee Guttmann, another CISO quoted by CSO Online, had a Big Four firm her CFO trusted validate her risk, remediation, and cost figures, which made the CFO more comfortable with them.

Choosing How to Measure Security ROI

For a single control with a short payback, such as under two years, ROSI works as a practical screen, with low and high estimates for every input. Multi-year investments and tail risk call for FAIR with Monte Carlo ranges, fed into discounted cash flow as the FAIR Institute's white paper recommends.

The analyst-time and consolidation tests above apply unchanged, with support agreements counted alongside retired contracts. Board reporting follows NACD's quarterly, financially framed format, with cyber risk placed in the enterprise risk register.

For a managed service, measure escalation volume, investigated share, response authority, and contract scope, and tie the invoice to investigation records that show who owned each outcome. A proof of concept should test investigation quality on your own alerts.

Record the baseline before the service starts and compare it with steady-state performance after onboarding. Daylight, which runs an AI-native MDR service, says building the business context its investigations rely on takes several months. Agree up front on the scope and acceptance criteria that mark when a fair comparison can begin.

Most programs will use several of these at once, matched to the size and horizon of each decision.

Frequently Asked Questions About Return on Security Investment

Is a ROSI of 1,000% Believable?

It is mathematically possible, but the percentage alone doesn't show that an investment is attractive. A 2019 FAIR Institute post argued by analogy to insurance that ROSI often runs between 1,000% and 2,000% against roughly 10% to 20% for traditional ROI, but it offered no measured benchmark. Show the baseline expected loss, the estimated reduction, the full control cost, the analysis period, and how sensitive the result is to each assumption. Check that no one has used a maximum possible loss where the probability-weighted expected loss belongs.

Should the Gordon-Loeb 37% Rule Cap Our Security Budget?

No. The 37% ceiling holds only under the model's assumptions. Gordon and Loeb's 2002 model found the optimal spend to protect an information set generally should not exceed 37% (about 1/e) of the expected loss. Their work also found that the most vulnerable assets are not always the best place to spend, since protecting them can be inordinately expensive. Jan Willemson showed in 2006 that optimal investment can reach 50%, and Henry Skeoch's 2021 paper summarizes Willemson's cases that approach 100% under relaxed requirements.

How Often Should We Recalculate Security ROI?

Rerun it whenever the loss range or the cost side moves: after a material incident, a significant change in risk exposure, a contract renewal, or a retired tool. On top of quarterly reporting, the NACD handbook asks for cyber risk reporting immediately after material incidents and significant changes in exposure, which are the same moments your ROI inputs go stale.

Which Breach Cost Benchmark Should We Use?

Pick the benchmark that matches the loss scenario you're modeling, and label it with its edition. IBM's average covers data breaches; for a ransomware scenario, Sophos's 2026 ransomware survey puts the average cost to recover, excluding any ransom, at $1.7 million. The two measure different outcomes in different samples, so don't use them as the two ends of a single range.

How Should We Treat Vendor MTTD and MTTR Improvement Claims?

Ask how the clock is defined before comparing anything. NIST SP 800-55 defines mean time to detect as the average time a problem exists before it is found, and leaves the start event for you to specify. Check whether a vendor's clock starts at incident onset, first observable evidence, or first alert, and where it stops. Then confirm whether the figure is a mean or a median, and whether the before and after periods used the same definition.