Know how to calculate your ROSI - Return On Security Investment?

CALCULATING THE RETURN ON INVESTMENT - ROSI

Calculating ROSI, or Return On Security Investment, can be a tough task for a company's cybersecurity department, especially when the value of possible losses is often intangible.

There’s really no way to measure alleged occurrences and the impact of all variables. But one thing’s for sure in cyber security - the cost of doing nothing is far greater. These days, the risk is just too high to bet on luck. If you continue to use hope as a tactic, the possible losses can be unimaginable.

Maybe it’s time for a different nomenclature when calculating return-on-investment in regards to cybersecurity. In many ways, ROSI is quite different from ROI, even though the objectives are the same. Start by thinking about the questions that the cybersecurity department should ask the company's board - and not the other way around.

Generally, directors want to know the return on each investment because they are naturally more focused on business results. So, like investments in marketing, they calculate investments in security with an eye on the financial increase that the initiative can bring. That’s not always how it is in cybersecurity. Let's clarify this difference before we get to the calculation.

First, don’t focus on what, on the surface, may seem like the most pressing questions: 

“How can a security solution affect the productivity of your business?” 

“How big is the financial impact of a threat?

“If I don't invest in security, can it really affect business?

“What is the most accessible solution?”

Instead, ask yourself these questions: 

“The company needs to become more secure. How much security do we need to reach the desired level?”

“How much time and how many resources do we need to invest into our security?”

Notice that the approach is different, because the problem is omnipresent and therefore very serious. When the manager uses this inverse reasoning, he/she is calculating the investment from the standpoint of high risk, and is better able to choose among the available solutions.

CALCULATING THE ROSI

In the formula for calculating the Return on Investment in Security (ROSI), the cost of the security awareness solution is the annual expectation of losses derived from the risks.

The quantification of the ROSI formula is measured by the impact of the investment on the final result. This metric can be your best weapon in the battle to convince company directors about the need for better security. Let's figure it out step by step:

Annual Loss Expectation (ALE) - is the total expected financial loss from security incidents based on the company's history. In this case we estimate how much can be lost without investing in security. ALE is calculated by multiplying the annual rate of occurrences (ARO) by the single loss expectation (SLE).

Annual Occurrence Rate (ARO) - Also measured by history is the probability that a cyber security incident will occur within a year.

Single Loss Expectation (SLE) - is the total financial loss of a single security incident. This loss is based only on data assets that have value within the organization. It also represents the direct costs of financial loss and the indirect costs associated with precipitating data breaches.

Expected Annual Loss Expectation (EALE) - this is ALE, plus the savings that the security solution offers. This represents the percentage of threats stopped by the security solution.

For example, we can say that the cybersecurity solution has an annual investment of $100,000 USD to prevent 10 cyber security incidents that resulted in $20,000 USD in data loss. According to the cybersecurity offer, the solution will block 95% of cyber attacks.

ROSI = ((10 x 20,000) x 0.95 - $ 100,000) ÷ $ 100,000

ROSI = 90%

The calculation reveals that the investment in security generates a return of 90%, or about $100,000 USD annually. Feel free to use this example as your go-to guide for calculating the size of your Return on Investment in Security. (Source CSO,2017)

Living Security is a startup with innovative training solutions for security awareness in companies. The company's science-based approach drives user engagement and reinforces positive security behaviors across the enterprise. Living Security recognized that traditional security awareness programs were failing to move the needle and it was time for a fresh approach. Our immersive training experiences engage the enterprise using science backed techniques to motivate behavior change and refreshed content that’s relevant for the current threat landscape.