Skip to content
ENExplore Calculators

Cybersecurity ROI Calculator

Calculate ROSI from ALE before and after a control, including implementation and running cost, payback period and net benefit.

About Cybersecurity ROI Calculator

ROSI is the standard security-economics formula: quantify expected annual loss as severity times frequency, reduce it by the control's effectiveness, and compare the saving against what the control costs annualised over its life. Productivity friction is included as a real cost because controls that slow people down get bypassed or reversed, and NPV is provided because a four-year commitment justified on undiscounted cash is often marginal once discounted. ROSI is only as good as the ARO estimate, but stating the estimate explicitly turns an argument about whether a control is worth it into an argument about a number you can research.

Formulas

Cybersecurity ROI

ALE = SLE × ARO; ROSI = (ALE reduction − annualised control cost) ÷ annualised control cost, where the annualised cost spreads implementation across the control's useful life.

SLE
Loss from one occurrence
ARO
Expected occurrences per year
ALE reduction
aleBefore − aleAfter
annualised cost
Running cost plus implementation ÷ lifespan

Net present value

NPV = netAnnualBenefit × [(1 − (1 + r)^−n) ÷ r] − implementationCost, discounting the benefit stream at rate r over n years.

r
Discount rate
n
Useful life in years
netAnnualBenefit
Risk reduction less running and friction cost

Worked example

With the default values below, Cybersecurity ROI Calculator returns Return on Security Investment of 80.5%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Single loss expectancyaccepts 0–100,000,000,000 currency
2,500,000 currency
Annual rate of occurrence before the controlaccepts 0–1,000 events/year
0.4 events/year
Reduction in likelihood or impactaccepts 0–100 %
60 %
One-off implementation costaccepts 0–10,000,000,000 currency
450,000 currency
Annual running costaccepts 0–10,000,000,000 currency
180,000 currency
Useful life of the controlaccepts 0.5–30 years
4 years
Discount rateaccepts 0–50 %
8 %
Annual productivity or friction costaccepts 0–1,000,000,000 currency
40,000 currency

Results

Return on Security Investment
80.5%
ALE Before the Control
$1,000,000
ALE After the Control
$400,000
Annual Risk Reduction
$600,000
Net Annual Benefit
$380,000
Payback Period
14.2 months
Net Present Value Over Life
$808,608
Investment Verdict
Strong — the control pays for itself several times over its life

Step by step

  1. 1Values used
  2. 2Cybersecurity ROI
  3. 3Net present value
  4. 4Return on Security Investment= 80.5
  5. 5ALE Before the Control= 1,000,000
  6. 6ALE After the Control= 400,000
  7. 7Annual Risk Reduction= 600,000
  8. 8Net Annual Benefit= 380,000
  9. 9Payback Period= 14.2 months

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation or tax into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Cybersecurity ROI calculated?

ALE = SLE × ARO; ROSI = (ALE reduction − annualised control cost) ÷ annualised control cost, where the annualised cost spreads implementation across the control's useful life. ROSI is the standard security-economics formula: quantify expected annual loss as severity times frequency, reduce it by the control's effectiveness, and compare the saving against what the control costs annualised over its life. Productivity friction is included as a real cost because controls that slow people down get bypassed or reversed, and NPV is provided because a four-year commitment justified on undiscounted cash is often marginal once discounted.

Why does Cybersecurity ROI matter?

ROSI is only as good as the ARO estimate, but stating the estimate explicitly turns an argument about whether a control is worth it into an argument about a number you can research.

What values do I need to enter?

This calculator takes 8 inputs: Single loss expectancy, Annual rate of occurrence before the control, Reduction in likelihood or impact, One-off implementation cost, Annual running cost, Useful life of the control, Discount rate, Annual productivity or friction cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Where does ARO come from for rare events?

Industry incident data, your own near-miss history and threat-intelligence base rates. For genuinely rare high-impact events, run the calculation across a range — 0.05 and 0.5 — and see whether the decision changes. If it does not, the uncertainty does not matter.

Is ROSI enough to justify a control?

Not always, and not alone. Regulatory requirements, contractual obligations and the tail risk of an existential event all justify spend that ROSI alone would reject — which is why the verdict text points to a compliance driver when the economics fail.

Related Calculators

Cybersecurity ROI Calculator | Calcrivo