TY  - JOUR
AU  - Yogi, Manas Kumar
AU  - Satwika, Nadiminti Sai Priya
PY  - 2026
DA  - 2026/05/12
TI  - A Quantitative Framework for Return-on-Security-Investment (RoSI) in Secure Software Engineering: Integrating Probabilistic Risk, Lifecycle Dynamics, and Data-Driven Adaptation
JO  - ICCK Journal of Software Engineering
T2  - ICCK Journal of Software Engineering
JF  - ICCK Journal of Software Engineering
VL  - 2
IS  - 2
SP  - 121
EP  - 137
DO  - 10.62762/JSE.2026.472228
UR  - https://www.icck.org/article/abs/JSE.2026.472228
KW  - Return-on-Security Investment (RoSI)
KW  - quantitative risk assessment
KW  - secure software engineering
KW  - DevSecOps
KW  - expected loss
KW  - Bayesian networks
KW  - security economics
KW  - shift-left security
KW  - FAIR framework
AB  - The concept of Return on Security Investment (RoSI) has evolved from a mere financial indicator into a comprehensive system for informed decision-making. Software-intensive organisations face mounting pressure to justify security expenditure in financially rigorous terms. Existing Return-on-Security-Investment (RoSI) models rely on deterministic approximations that ignore probability distributions over threats, temporal decay of vulnerability windows, and intangible cost categories. This paper presents a probabilistic RoSI framework grounded in the FAIR taxonomy that integrates: (i) expected-loss differentials with Bayesian updating; (ii) shift-left cost amplification across the software development lifecycle; and (iii) a compliance-cost extension for regulatory regimes such as GDPR and HIPAA. Monte Carlo simulation across a representative portfolio of 20 security controls confirms that early detection in the requirements phase yields up to 18× RoSI relative to post-deployment remediation. The framework delivers a tractable decision-support tool for CISOs seeking to optimise security investment under uncertainty.
SN  - 3069-1834
PB  - Institute of Central Computation and Knowledge
LA  - English
ER  - 

@article{Yogi2026A,
  author = {Manas Kumar Yogi and Nadiminti Sai Priya Satwika},
  title = {A Quantitative Framework for Return-on-Security-Investment (RoSI) in Secure Software Engineering: Integrating Probabilistic Risk, Lifecycle Dynamics, and Data-Driven Adaptation},
  journal = {ICCK Journal of Software Engineering},
  year = {2026},
  volume = {2},
  number = {2},
  pages = {121-137},
  doi = {10.62762/JSE.2026.472228},
  url = {https://www.icck.org/article/abs/JSE.2026.472228},
  abstract = {The concept of Return on Security Investment (RoSI) has evolved from a mere financial indicator into a comprehensive system for informed decision-making. Software-intensive organisations face mounting pressure to justify security expenditure in financially rigorous terms. Existing Return-on-Security-Investment (RoSI) models rely on deterministic approximations that ignore probability distributions over threats, temporal decay of vulnerability windows, and intangible cost categories. This paper presents a probabilistic RoSI framework grounded in the FAIR taxonomy that integrates: (i) expected-loss differentials with Bayesian updating; (ii) shift-left cost amplification across the software development lifecycle; and (iii) a compliance-cost extension for regulatory regimes such as GDPR and HIPAA. Monte Carlo simulation across a representative portfolio of 20 security controls confirms that early detection in the requirements phase yields up to 18× RoSI relative to post-deployment remediation. The framework delivers a tractable decision-support tool for CISOs seeking to optimise security investment under uncertainty.},
  keywords = {Return-on-Security Investment (RoSI), quantitative risk assessment, secure software engineering, DevSecOps, expected loss, Bayesian networks, security economics, shift-left security, FAIR framework},
  issn = {3069-1834},
  publisher = {Institute of Central Computation and Knowledge}
}