Practical guide
How to calculate the ROSI of security awareness training
ROSI (Return on Security Investment) answers a simple question: for every euro I invest, how much risk do I avoid? It’s the figure HR takes to the board to get the training budget approved.
Three numbers and a formula
The method is the one used in risk management and also described by the European Union Agency for Cybersecurity (ENISA, Introduction to Return on Security Investment).
- 1
What an incident costs
The average damage of a single serious incident: downtime, recovery, fines, lost customers. Textbooks call it SLE (single loss expectancy).
- 2
How likely it is in a year
The probability that such an incident happens within a year. Textbooks call it ARO (annualised rate of occurrence).
- 3
How much training reduces it
How much the risk drops when people recognise phishing, scams and dangerous behaviour.
- €
How much you invest
The annual cost of training: for PensieroSicuro Premium, the fee for the number of people.
Expected loss in a year = cost of an incident × probability in a yearRisk avoided = expected loss × reduction thanks to trainingROSI = (risk avoided − investment) ÷ investmentWhere our numbers come from
The calculator starts from these values. They are cautious assumptions: you can replace them with your company’s data.
| Value | What it represents | Source |
|---|---|---|
| €300,000 | Average cost of an incident for an affected company, used up to 250 people | Clusit Report, October 2025 |
| €3.31 million | Average cost of a data breach in Italy, used above 250 people | IBM, Cost of a Data Breach, 2025 edition |
| 10% | Probability of a serious incident in a year | Our cautious assumption, to be adapted |
| 30% | Risk reduction thanks to training | Our cautious assumption, to be adapted |
Two examples, step by step
Prices come from the PensieroSicuro Premium price list, excluding VAT.
A company with 500 people, 3-year contract
Try it with your own numbers
Change the assumptions: the result updates as you type.
How to read it, and what it doesn’t say
- Positive means it pays off: the risk you avoid is worth more than what you spend. A ROSI of 200% means each euro invested avoids, on average, three euros of damage.
- It’s an estimate, not a promise: it depends on the assumptions. Try halving the probability or the reduction and see whether it stays positive: it’s the most honest way to present it.
- It doesn’t count everything: it leaves out benefits that are hard to measure, such as reputation or the training required by GDPR and NIS2, and internal costs such as people’s time in training.
- Use your own data when you have it: incidents in recent years, downtime costs, fines received. The calculation becomes more solid and easier to defend.
The words of ROSI
SLESingle Loss Expectancy: the expected loss from a single incident.
AROAnnualised Rate of Occurrence: how many times a year the incident is expected.
ALEAnnualised Loss Expectancy: the expected loss in a year, i.e. SLE × ARO.
Want to take it to the board? Prepare the proposal with the Premium calculator (in Italian) or read why HR teams choose Premium.