When it comes to measuring the effectiveness of security-related initiatives, the classical financial approach for ROI calculation—gain from investment minus the cost of investment, divided by the cost of investment—is not particularly appropriate. Security investments are not generally aimed at generating profit but at preventing loss. In other words, investing in security is about reducing the risks that threaten your assets.

To quantify the impact of cybersecurity on the bottom line, risk needs to be determined. The following risk concepts form the basis of the Return on Security Investment (ROSI) calculation.

Key Risk Concepts for ROSI Calculation

Single Loss Expectancy (SLE) is the expected amount of money lost during a single security incident. The calculation of SLE can vary widely depending on business objectives, cultural values, and existing security measures. For instance, one company might estimate the SLE of a stolen laptop to be the value of the laptop itself (e.g., $2,000), while another organization dealing with highly sensitive information might value this loss at $100,000, considering the impact on its reputation, potential contracts, and competitive advantage.

Annual Rate of Occurrence (ARO) measures the likelihood or probability of a security incident occurring in a year. Determining ARO often involves analyzing historical records. For example, if your company experiences about 10 security incidents per year, you might estimate a similar number for the coming year.

Annual Loss Expectancy (ALE) represents the total annual financial loss expected from security incidents. This metric indicates how much money can be lost if the business continues as usual without additional security measures. ALE is calculated using the formula:

Calculating Return on Security Investment (ROSI)

The ROSI calculation combines quantitative risk assessment and the cost of implementing security countermeasures. It compares the ALE with the expected loss savings. Implementing an effective security solution lowers the ALE; the more effective the solution, the greater the reduction in ALE.

The ROSI is defined as follows:

​

Where:

• ALE is the Annual Loss Expectancy without the security solution.
• mALE is the modified Annual Loss Expectancy with the security solution.

The difference between ALE and mALE represents the monetary loss reduction due to the security solution. This reduction can be expressed as the mitigation ratio of the solution applied to the ALE.

Example: Calculating ROSI for Acme Corp.

Let's take a simple example: Acme Corp. is considering investing in an anti-virus solution. Each year, Acme suffers 5 virus attacks (ARO = 5). The CSO estimates that each attack costs approximately $15,000 in loss of data and productivity (SLE = $15,000). The anti-virus solution is expected to block 80% of the attacks (Mitigation ratio = 80%) and costs $25,000 per year (license fees $15,000 + $10,000 for training, installation, maintenance, etc.).

First, we calculate the ALE without the anti-virus solution:

Next, we calculate the modified ALE (mALE) with the anti-virus solution. Since the solution is expected to block 80% of the attacks, only 20% of the attacks will succeed:

Finally, we calculate the ROSI:

According to this ROSI calculation, the anti-virus solution is a cost-effective investment. It indicates that for every dollar spent on the anti-virus solution, Acme Corp. can expect to save $2.40 in avoided losses.

Why ROSI Matters

Calculating ROSI is crucial for demonstrating the value of security investments to management. It translates the impact of security measures into financial terms, which are easier for executives to understand and appreciate. By focusing on loss prevention and cost savings, ROSI provides a clear picture of how cybersecurity initiatives contribute to the organization's financial health.

Conclusion

Understanding and calculating ROSI is essential for justifying cybersecurity investments. By using risk concepts such as SLE, ARO, and ALE, organizations can quantify the financial benefits of their security initiatives. Presenting these metrics in a clear and concise manner helps secure management support and ensures that cybersecurity remains a top priority. Remember, effective security investments not only protect your assets but also contribute to the overall profitability and stability of your organization.