Security Investment ROI Calculator
Build a ROSI case for a control: ALE before and after, total annual cost, net benefit, payback, discounted NPV and the break-even mitigation rate.
About Security Investment ROI Calculator
The break-even mitigation rate is the most useful output because it inverts the hardest assumption: instead of defending a claim that the control removes 65% of the loss, you only have to argue that it removes more than the break-even figure. Productivity cost is included because controls that slow people down have a real price, and NPV is shown separately since a control with a positive annual return can still fail to justify its up-front spend. Security spending competes with everything else for capital, and finance functions discount arguments that arrive without an ALE, a cost and a payback period. ALE is the product of two estimates, so treat ROSI as a way to rank competing controls rather than as a forecast return.
Formulas
Security Investment ROI
ROSI = (ALE reduction − total annualised cost) ÷ total annualised cost, where ALE = SLE × ARO and the reduction is ALE × mitigation rate.
- ALE
- Annualised loss expectancy = single loss expectancy × annual rate of occurrence
- mitigation rate
- Share of the annualised loss the control actually removes
- total annualised cost
- Amortised implementation + annual run cost + productivity cost
NPV and break-even
NPV = annual cash benefit × annuity factor − implementation cost, with annuity factor = (1 − (1 + r)^−n) ÷ r; break-even mitigation = total annual cost ÷ ALE before.
- r
- Discount rate
- n
- Amortisation years
- break-even mitigation
- The mitigation rate at which the control exactly pays for itself
Worked example
With the default values below, Security Investment ROI Calculator returns Return on Security Investment of 56.0%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Single loss expectancyaccepts 0–100,000,000,000 $
- 1,800,000 $
- Annual rate of occurrence before the controlaccepts 0–500 per year
- 0.4 per year
- Share of the loss the control removesaccepts 0–100 %
- 65 %
- One-off implementation costaccepts 0–10,000,000,000 $
- 450,000 $
- Annual licence and operating costaccepts 0–10,000,000,000 $
- 120,000 $
- Annual productivity or friction costaccepts 0–10,000,000,000 $
- 30,000 $
- Years to amortise the implementationaccepts 1–10 years
- 3 years
- Discount rateaccepts 0–50 %
- 8 %
Results
- Return on Security Investment
- 56.0%
- ALE Before the Control
- $720,000
- ALE After the Control
- $252,000
- Annual Loss Avoided
- $468,000
- Total Annualised Cost
- $300,000
- Annual Net Benefit
- $168,000
- Payback Period
- 17.0 months
- Net Present Value
- $369,517
- Break-Even Mitigation Rate
- 41.7%
- Investment Verdict
- Positive but sensitive — the case rests on the mitigation estimate, so state that assumption explicitly when you present it
Step by step
- 1Values used
- 2Security Investment ROI
- 3NPV and break-even
- 4Return on Security Investment= 56.0
- 5ALE Before the Control= 720,000
- 6ALE After the Control= 252,000
- 7Annual Loss Avoided= 468,000
- 8Total Annualised Cost= 300,000
- 9Annual Net Benefit= 168,000
Assumptions and limits
- The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation or tax into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Security Investment ROI calculated?
ROSI = (ALE reduction − total annualised cost) ÷ total annualised cost, where ALE = SLE × ARO and the reduction is ALE × mitigation rate. The break-even mitigation rate is the most useful output because it inverts the hardest assumption: instead of defending a claim that the control removes 65% of the loss, you only have to argue that it removes more than the break-even figure. Productivity cost is included because controls that slow people down have a real price, and NPV is shown separately since a control with a positive annual return can still fail to justify its up-front spend.
Why does Security Investment ROI matter?
Security spending competes with everything else for capital, and finance functions discount arguments that arrive without an ALE, a cost and a payback period. ALE is the product of two estimates, so treat ROSI as a way to rank competing controls rather than as a forecast return.
What values do I need to enter?
This calculator takes 8 inputs: Single loss expectancy, Annual rate of occurrence before the control, Share of the loss the control removes, One-off implementation cost, Annual licence and operating cost, Annual productivity or friction cost, Years to amortise the implementation, Discount rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I estimate the ARO for something that has never happened?
Use external frequency data as a starting anchor, express the answer as a range rather than a point, and be honest that a one-in-twenty-year event is a guess. Then use the break-even mitigation rate and a sensitivity run at half and double your ARO: if the decision holds across the range, the imprecision does not matter.
Why include productivity cost?
Because it is often the largest real cost and the one that gets omitted. A control that adds thirty seconds to a workflow performed a thousand times a day costs more in aggregate than its licence, and ignoring it is how controls get deployed and then quietly bypassed.