Calculate ROSI, payback period and 5-year NPV for any security investment. Run sensitivity scenarios and rank competing controls. Free, no signup.
This cybersecurity ROI calculator turns a proposed security investment into the three numbers a finance committee actually asks for: return on security investment in year one, payback period, and five-year net present value. It also runs a four-scenario sensitivity analysis, so you can show what happens if the control only works half as well as the vendor claims. Compare several investments side by side and the tool ranks them by NPV and suggests a deployment order.
It is built for vCISOs, IT directors, and MSPs preparing a business case — the situation where “this reduces risk” needs to become “this returns $2.40 per dollar and pays back in eleven months.” Everything runs in your browser, and the output exports to PDF with an executive summary and an APPROVE / CONSIDER / DEFER / REJECT recommendation.
ROSI is the security-specific variant of ROI. The classic formulation is that return equals avoided loss minus the cost of the control, divided by the cost of the control. This tool implements that and extends it in three ways: it separates one-time from recurring costs, it ramps the benefit over time rather than assuming a control works fully on day one, and it discounts future cash flows.
The core calculation:
Annual risk reduction = ALE × (mitigation % ÷ 100)
Year 1 benefit = annual risk reduction × ramp factor + additional benefits
Year 1 cost = implementation + annual recurring + (personnel hours × $75)
ROSI = (year 1 benefit − year 1 cost) ÷ year 1 cost × 100
The ramp factor is 1.0 for a control that is effective immediately, 0.75 for short ramp-up, 0.50 for medium, and 0.33 for long. Multi-year projections continue the ramp — a medium-ramp control delivers 50% of its benefit in year one, 75% in year two, and full benefit thereafter.
Net present value discounts each year’s figures:
NPV = Σ (benefitt − costt) ÷ (1 + 0.08)t
The 8% discount rate is a weighted average cost of capital estimate. Payback is computed as year-one cost divided by year-one benefit where the first year is already net positive, and otherwise as the one-time cost divided by the annual net benefit.
Suppose your annualised loss expectancy for the threats an MDR service addresses is $2,000,000. The service costs $25,000 to implement and $150,000 per year, and consumes 100 internal hours. It claims 45% risk mitigation with a short ramp-up, delivers SOC 2 evidence, and earns a 20% cyber insurance premium reduction.
Now run the sensitivity. The pessimistic scenario halves the mitigation to 22.5%, giving a year-one risk reduction of $337,500 and a total benefit of $392,500 — still a net gain of $210,000 and a ROSI of 115%. An investment that survives its own pessimistic case is a far easier approval than one that only works at the vendor’s claimed effectiveness.
Notice what dominates: the ALE. A 300% ROSI is entirely a function of the $2M loss expectancy you fed in. If that figure is soft, so is the return. Deriving it properly is the whole game.
The most common error in security business cases is quoting a control’s effectiveness against its own threat as though it applied to all risk. This calculator’s templates deliberately multiply the two: backup and disaster recovery is roughly 95% effective at neutralising ransomware impact, but ransomware is a fraction of total breach risk, so the modelled mitigation is about 23.75%. Security awareness training is around 70% effective against phishing, which covers roughly 35% of breach paths, giving 24.5%. Applying the raw effectiveness figure instead would overstate the return by a factor of four, and a finance reviewer who notices will discount everything else in the paper.
For scale on the underlying threat: Verizon’s 2025 Data Breach Investigations Report, based on more than 22,000 incidents and 12,195 confirmed breaches, found ransomware present in 44% of breaches overall and 88% of small and medium business breaches, and third-party involvement doubling to 30%. IBM’s Cost of a Data Breach Report 2025 found organisations using AI and automation extensively across security operations saved roughly $1.9M per breach relative to those that did not — the kind of published effect size worth anchoring a mitigation estimate against.
Return on security investment: the avoided loss a control delivers, less its cost, divided by its cost. It differs from conventional ROI because the “return” is a loss that did not happen, which makes the quality of your loss estimate the deciding factor in the result.
Multiply single loss expectancy by annual rate of occurrence. Single loss expectancy is asset value multiplied by exposure factor. The quantitative risk analysis tool builds this from an asset inventory and carries the ALE through to safeguard comparison.
It is a general weighted average cost of capital estimate used to make multi-year figures comparable to present-day spend. If your organisation uses a different hurdle rate, treat the NPV as indicative and note the assumption when you present it.
Yes. Internal deployment and operating effort is the most commonly omitted cost in security business cases, and it is often the largest hidden line. The model values it at $75 per hour fully loaded.
How fragile the case is. It rescales mitigation to 125%, 100%, 75%, and 50% of your estimate. If the conservative and pessimistic scenarios stay positive, the case is robust; if only the optimistic case clears, the investment is a bet on the vendor’s numbers.
By thresholds on year-one ROSI, payback, and five-year NPV. Above 100% ROSI with payback under eighteen months, or above 50% with payback under three years, returns APPROVE. Positive but modest returns give CONSIDER. Strongly negative returns give REJECT.
Yes. Add multiple investments and the tool ranks them by five-year NPV, computes a combined risk reduction capped at 95%, and suggests a deployment order sorted by payback period.
An estimate for planning. It is only as sound as the ALE and mitigation percentage you supply. Its real value is making those two assumptions explicit and testable rather than buried in a narrative.
Cybersecurity ROI (Return on Investment) measures the financial value gained from security investments relative to their cost. Unlike traditional ROI which compares revenue generated to money spent, cybersecurity ROI quantifies risk reduction — the difference between expected losses without a security control and expected losses with it, minus the control's cost.
Demonstrating ROI is how security leaders justify budget requests to CFOs and boards who think in financial terms. Without ROI data, security budgets are often the first cut during cost-reduction exercises because their value appears intangible.
| Method | Formula | Best For |
|---|---|---|
| Classic ROI | (Risk Reduction - Control Cost) / Control Cost x 100 | Simple, single-control justification |
| ROSI (Return on Security Investment) | (ALE Before - ALE After - Cost) / Cost x 100 | Annualized risk-based analysis |
| Net Present Value | Discounted future risk reduction - initial investment | Multi-year security programs |
| Total Cost of Ownership | All costs over lifetime (purchase, maintenance, training, operations) | Comparing security solutions |
| Cost Avoidance | Expected breach cost x probability reduction | Breach prevention programs |
| Factor | Value |
|---|---|
| ALE without control (expected annual breach loss) | $500,000 |
| Risk reduction from implementing EDR | 65% |
| ALE with EDR | $175,000 |
| Annual EDR cost (license + operations) | $120,000 |
| Annual risk reduction | $325,000 |
| ROSI | (325,000 - 120,000) / 120,000 = 171% |
Cybersecurity ROI = (Risk Reduction Value - Security Investment Cost) / Security Investment Cost × 100. Risk reduction includes avoided breach costs, prevented downtime, compliance fine avoidance, and reduced insurance premiums. Factor in breach probability and potential impact. Include both direct costs (breach response) and indirect costs (reputation damage, customer loss). Three-year timeframe typical for calculating returns.
Strong cybersecurity investments typically yield 200-500% ROI over 3 years when factoring risk reduction and efficiency gains. Foundational controls (MFA, patching, EDR) often exceed 300% ROI. Advanced capabilities (SIEM, threat intelligence) may show 150-250% ROI. However, some security is necessary regardless of ROI—it's risk management. Focus on highest-risk areas for best returns.
Include implementation costs (software licenses, hardware, professional services), ongoing costs (maintenance, subscriptions, staff time), training expenses, and opportunity costs. Also factor efficiency gains from automation, reduced incident response costs, lower insurance premiums, avoided compliance penalties, prevented breach costs, and reduced downtime. Three-year total cost of ownership provides accurate picture.
Calculate Annual Loss Expectancy (ALE): Probability of breach × Average breach cost. Use industry data (Ponemon: $4.45M average breach) adjusted for your size and sector. Estimate how much security control reduces probability (e.g., MFA reduces account compromise 99%). Risk reduction value = Baseline ALE - Post-control ALE. Include both high-probability/low-impact and low-probability/high-impact scenarios.
Intangible benefits include enhanced customer trust and loyalty, improved brand reputation, competitive advantage in security-conscious markets, increased employee confidence, better vendor relationships, faster sales cycles (especially B2B), and ability to pursue new business opportunities requiring security certifications. While hard to quantify precisely, these often exceed direct financial returns for mature organizations.
Frame security as insurance and business enabler, not just breach prevention. Highlight: compliance requirement achievement enabling business in regulated markets, operational efficiencies from automation, reduced manual effort, faster incident detection and resolution, improved system uptime and reliability, and risk transfer benefits. Compare to other insurance—you don't wait for disaster to buy coverage.
Typically highest ROI: Multi-factor authentication (99% reduction in account compromise), automated patch management (reduces vulnerability window), endpoint detection and response (early threat detection), security awareness training (reduces human risk 70%), and privileged access management (prevents lateral movement). Focus on foundational controls addressing most common attack vectors before advanced capabilities.
Key metrics include: mean time to detect (MTTD) and respond (MTTR) to incidents, number and severity of security events, vulnerability remediation time, employee phishing test results, percentage of assets with current patches, compliance audit findings, and security tool effectiveness rates. Track trends over time. Benchmark against industry peers. Tie metrics to business risk reduction.