The “return on security investment” (ROI) crowd has a problem the “ROSI” crowd has is they equate with return on return on investment. The Wikipedia entry for Rate of Return treats ROI as a synonym, so it’s a good place to go if you want to understand ROI. Security managers should be unafraid to, and instead say “My project will cost $1,000 but save the company $10,000″ because the outcome is certain, even approximate probability.”]
Source: https://taosecurity.blogspot.com/2007/07/no-roi-no-problem.html