Scenario 2: Return on Security Investment (ROSI) Security investment is a little more complex. There are no tangible gains in investment directed at information security. The return is measured on risk avoidance. The formula for calculating ROSI is given below. The formula for calculating ROSI is (Risk Exposure multiply by the percentage of Risk Mitigated) subtracted by the Solution Cost. It is then divided by the Solution Cost. ArmCPU has been attacked by the BAD-VIRUS before. The damage resulting from the BAD-VIRUS in 2022 was $68,000 for all occurrences and all users. Implementing an anti-virus solution was $32,000 for all its users. The anti-virus solution worked 75% of the time on BAD-VIRUS