Net return is the final amount left after all losses, recoveries, fees, and tax effects are applied to a gross result. In finance, it shows what an investment really earned after defaults or other deductions. In cyber security, the same idea is used to judge the economics of an attack or a defense: what remains after infrastructure costs, failed attempts, refunds, downtime, investigation, or remediation.
This matters because attackers rarely care about headline volume; they care about profit. A phishing or fraud campaign may look successful at the gross level, but filters, account lockouts, chargebacks, and takedowns can sharply reduce the net return. Defenders use the same logic in reverse. Controls such as MFA, transaction monitoring, and fraud rules may not stop every attempt, but they can lower the attacker’s net return until the operation is no longer worthwhile.