ROI

I've heard last week, on a Executive Board meeting, a CEO complaining about IT budget requests that he was receiving trying to justify the expenses by showing a ROI. He mentioned that almost all were wrong, as they were based on cost avoidance and not cost reduction. Although none of them were related to security, I found his comments extremely pertinent to the famous ROSI discussion. I'm glad to see that my personal opinion about it is aligned with what the CEO of the company that I work for thinks.