def expected_annual_loss(threat_scenarios):
    """
    Calculate expected annual loss across threat scenarios.
 
    Each scenario has:
    - frequency: expected occurrences per year
    - impact: cost per occurrence
    - current_mitigation: fraction mitigated by existing controls (0-1)
    """
    total_eal = 0
 
    for scenario in threat_scenarios:
        residual_frequency = (
            scenario["frequency"] *
            (1 - scenario["current_mitigation"])
        )
        scenario_eal = residual_frequency * scenario["impact"]
        total_eal += scenario_eal
 
        scenario["expected_annual_loss"] = scenario_eal
 
    return {
        "total_expected_annual_loss": total_eal,
        "scenarios": threat_scenarios
    }
 
# Example threat scenarios for an AI chatbot
scenarios = [
    {
        "name": "Prompt injection data exfiltration",
        "frequency": 12,          # 12 attempts per year succeed
        "impact": 250_000,        # Average cost per incident
        "current_mitigation": 0.7  # 70% currently mitigated
    },
    {
        "name": "Jailbreak producing harmful content",
        "frequency": 50,
        "impact": 50_000,
        "current_mitigation": 0.85
    },
    {
        "name": "Training data extraction",
        "frequency": 2,
        "impact": 1_000_000,
        "current_mitigation": 0.5
    },
    {
        "name": "Reputational incident (viral AI failure)",
        "frequency": 4,
        "impact": 500_000,
        "current_mitigation": 0.6
    }
]
 
result = expected_annual_loss(scenarios)
# Total EAL = sum of unmitigated risk across scenarios

def calculate_rosi(defense_investment):
    """
    Calculate Return on Security Investment.
 
    ROSI = (Risk Reduction - Defense Cost) / Defense Cost
    """
    # Annual risk before defense
    risk_before = defense_investment["annual_risk_before"]
 
    # Annual risk after defense (risk * (1 - effectiveness))
    risk_after = risk_before * (1 - defense_investment["effectiveness"])
 
    # Annual risk reduction
    risk_reduction = risk_before - risk_after
 
    # Annual defense cost (implementation amortized + operational)
    annual_cost = (
        defense_investment["implementation_cost"] /
        defense_investment["amortization_years"] +
        defense_investment["annual_operational_cost"]
    )
 
    rosi = (risk_reduction - annual_cost) / annual_cost
 
    return {
        "rosi": rosi,
        "rosi_percent": rosi * 100,
        "risk_reduction": risk_reduction,
        "annual_cost": annual_cost,
        "payback_period_months": (
            defense_investment["implementation_cost"] /
            (risk_reduction / 12)
            if risk_reduction > 0 else float('inf')
        ),
        "recommendation": "invest" if rosi > 0 else "reconsider"
    }
 
# Example: Evaluating a prompt shield deployment
prompt_shield = {
    "annual_risk_before": 1_500_000,  # Annual risk from injection
    "effectiveness": 0.75,            # Blocks 75% of attacks
    "implementation_cost": 200_000,   # One-time engineering
    "annual_operational_cost": 50_000, # Hosting, maintenance
    "amortization_years": 3           # Amortize implementation
}
 
result = calculate_rosi(prompt_shield)
# risk_reduction = 1,125,000
# annual_cost = 66,667 + 50,000 = 116,667
# ROSI = (1,125,000 - 116,667) / 116,667 = 8.64 = 864%

def compare_defenses(defense_options, total_budget):
    """
    Compare multiple defense options and recommend optimal allocation.
    """
    analyzed = []
 
    for name, defense in defense_options.items():
        rosi = calculate_rosi(defense)
        analyzed.append({
            "name": name,
            "rosi": rosi["rosi"],
            "risk_reduction": rosi["risk_reduction"],
            "annual_cost": rosi["annual_cost"],
            "efficiency": rosi["risk_reduction"] / rosi["annual_cost"]
        })
 
    # Sort by efficiency (risk reduction per dollar)
    analyzed.sort(key=lambda x: x["efficiency"], reverse=True)
 
    # Greedy allocation: invest in highest-efficiency defenses first
    remaining_budget = total_budget
    selected = []
 
    for defense in analyzed:
        if defense["annual_cost"] <= remaining_budget:
            selected.append(defense)
            remaining_budget -= defense["annual_cost"]
 
    return {
        "selected_defenses": selected,
        "total_risk_reduction": sum(d["risk_reduction"] for d in selected),
        "total_cost": total_budget - remaining_budget,
        "remaining_budget": remaining_budget,
        "ranked_options": analyzed
    }

def red_team_roi(engagement_cost, findings):
    """
    Calculate the ROI of a red team engagement.
 
    findings: list of vulnerabilities with estimated impact
    """
    total_risk_identified = sum(
        finding["estimated_annual_impact"] *
        finding["exploitation_probability"]
        for finding in findings
    )
 
    # Assume 70% of findings are remediated
    remediation_rate = 0.7
    risk_mitigated = total_risk_identified * remediation_rate
 
    roi = (risk_mitigated - engagement_cost) / engagement_cost
 
    return {
        "engagement_cost": engagement_cost,
        "vulnerabilities_found": len(findings),
        "total_risk_identified": total_risk_identified,
        "risk_mitigated": risk_mitigated,
        "roi": roi,
        "roi_percent": roi * 100,
        "cost_per_vulnerability": engagement_cost / max(len(findings), 1)
    }