Cybersecurity ROI Calculator

ALE = SLE × ARO; ROSI = (ALE reduction − annualised control cost) ÷ annualised control cost, where the annualised cost spreads implementation across the control's useful life. ROSI is the standard security-economics formula: quantify expected annual loss as severity times frequency, reduce it by the control's effectiveness, and compare the saving against what the control costs annualised over its life. Productivity friction is included as a real cost because controls that slow people down get bypassed or reversed, and NPV is provided because a four-year commitment justified on undiscounted cash is often marginal once discounted.

ROSI is only as good as the ARO estimate, but stating the estimate explicitly turns an argument about whether a control is worth it into an argument about a number you can research.

This calculator takes 8 inputs: Single loss expectancy, Annual rate of occurrence before the control, Reduction in likelihood or impact, One-off implementation cost, Annual running cost, Useful life of the control, Discount rate, Annual productivity or friction cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Industry incident data, your own near-miss history and threat-intelligence base rates. For genuinely rare high-impact events, run the calculation across a range — 0.05 and 0.5 — and see whether the decision changes. If it does not, the uncertainty does not matter.

Not always, and not alone. Regulatory requirements, contractual obligations and the tail risk of an existential event all justify spend that ROSI alone would reject — which is why the verdict text points to a compliance driver when the economics fail.