def expected_annual_loss(threat_scenarios):
    """
    跨威脅情境計算預期年度損失。
 
    每個情境具：
    - frequency：每年預期發生次數
    - impact：每次發生之成本
    - current_mitigation：既有控制所緩解之比例（0-1）
    """
    total_eal = 0
 
    for scenario in threat_scenarios:
        residual_frequency = (
            scenario["frequency"] *
            (1 - scenario["current_mitigation"])
        )
        scenario_eal = residual_frequency * scenario["impact"]
        total_eal += scenario_eal
 
        scenario["expected_annual_loss"] = scenario_eal
 
    return {
        "total_expected_annual_loss": total_eal,
        "scenarios": threat_scenarios
    }
 
# AI 聊天機器人之威脅情境範例
scenarios = [
    {
        "name": "Prompt injection data exfiltration",
        "frequency": 12,          # 每年 12 次嘗試成功
        "impact": 250_000,        # 每事件平均成本
        "current_mitigation": 0.7  # 目前緩解 70%
    },
    {
        "name": "Jailbreak producing harmful content",
        "frequency": 50,
        "impact": 50_000,
        "current_mitigation": 0.85
    },
    {
        "name": "Training data extraction",
        "frequency": 2,
        "impact": 1_000_000,
        "current_mitigation": 0.5
    },
    {
        "name": "Reputational incident (viral AI failure)",
        "frequency": 4,
        "impact": 500_000,
        "current_mitigation": 0.6
    }
]
 
result = expected_annual_loss(scenarios)
# 總 EAL = 跨情境之未緩解風險之總和

def calculate_rosi(defense_investment):
    """
    計算 Return on Security Investment。
 
    ROSI = (風險降低 - 防禦成本) / 防禦成本
    """
    # 防禦前之年度風險
    risk_before = defense_investment["annual_risk_before"]
 
    # 防禦後之年度風險（risk * (1 - effectiveness)）
    risk_after = risk_before * (1 - defense_investment["effectiveness"])
 
    # 年度風險降低
    risk_reduction = risk_before - risk_after
 
    # 年度防禦成本（實施攤提 + 營運）
    annual_cost = (
        defense_investment["implementation_cost"] /
        defense_investment["amortization_years"] +
        defense_investment["annual_operational_cost"]
    )
 
    rosi = (risk_reduction - annual_cost) / annual_cost
 
    return {
        "rosi": rosi,
        "rosi_percent": rosi * 100,
        "risk_reduction": risk_reduction,
        "annual_cost": annual_cost,
        "payback_period_months": (
            defense_investment["implementation_cost"] /
            (risk_reduction / 12)
            if risk_reduction > 0 else float('inf')
        ),
        "recommendation": "invest" if rosi > 0 else "reconsider"
    }
 
# 範例：評估 prompt shield 部署
prompt_shield = {
    "annual_risk_before": 1_500_000,  # 注入之年度風險
    "effectiveness": 0.75,            # 擋下 75% 攻擊
    "implementation_cost": 200_000,   # 一次性工程
    "annual_operational_cost": 50_000, # 託管、維護
    "amortization_years": 3           # 攤提實施
}
 
result = calculate_rosi(prompt_shield)
# risk_reduction = 1,125,000
# annual_cost = 66,667 + 50,000 = 116,667
# ROSI = (1,125,000 - 116,667) / 116,667 = 8.64 = 864%

def compare_defenses(defense_options, total_budget):
    """
    比較多個防禦選項並建議最佳配置。
    """
    analyzed = []
 
    for name, defense in defense_options.items():
        rosi = calculate_rosi(defense)
        analyzed.append({
            "name": name,
            "rosi": rosi["rosi"],
            "risk_reduction": rosi["risk_reduction"],
            "annual_cost": rosi["annual_cost"],
            "efficiency": rosi["risk_reduction"] / rosi["annual_cost"]
        })
 
    # 依效率排序（每元風險降低）
    analyzed.sort(key=lambda x: x["efficiency"], reverse=True)
 
    # 貪心配置：先投資最高效率之防禦
    remaining_budget = total_budget
    selected = []
 
    for defense in analyzed:
        if defense["annual_cost"] <= remaining_budget:
            selected.append(defense)
            remaining_budget -= defense["annual_cost"]
 
    return {
        "selected_defenses": selected,
        "total_risk_reduction": sum(d["risk_reduction"] for d in selected),
        "total_cost": total_budget - remaining_budget,
        "remaining_budget": remaining_budget,
        "ranked_options": analyzed
    }

def red_team_roi(engagement_cost, findings):
    """
    計算紅隊委任之 ROI。
 
    findings：具估計影響之漏洞清單
    """
    total_risk_identified = sum(
        finding["estimated_annual_impact"] *
        finding["exploitation_probability"]
        for finding in findings
    )
 
    # 假設 70% 之發現被補救
    remediation_rate = 0.7
    risk_mitigated = total_risk_identified * remediation_rate
 
    roi = (risk_mitigated - engagement_cost) / engagement_cost
 
    return {
        "engagement_cost": engagement_cost,
        "vulnerabilities_found": len(findings),
        "total_risk_identified": total_risk_identified,
        "risk_mitigated": risk_mitigated,
        "roi": roi,
        "roi_percent": roi * 100,
        "cost_per_vulnerability": engagement_cost / max(len(findings), 1)
    }