Breach value calculator

What could a breach cost your business, and which gaps matter most? Frequency times magnitude, with low, likely and high estimates.

Estimates for planning and insurance conversations. Not insurance, legal or financial advice.

Nothing you enter leaves this page. No network calls, cookies, storage or analytics. Results update as you type.

Download for offline use: Excel workbook (formulas visible, settings editable) and single HTML file (open it in any browser).

About your business

Annual revenue (USD)Used to pick the published loss range for firms your size.

Sector

Revenue per day that depends on IT (USD)What you would lose each day if your systems were down.

Days to restore after an attack

Your best estimate of the quickest, the likely and the slowest recovery.

Low (days)

Likely (days)

High (days)

Records and costs

Personal records heldCustomer, employee and patient records you would have to notify people about.

Cost per record (USD)No current public per-record figure; enter your own estimate.

Incident response cost (forensics, legal, communications)

Low (USD)

Likely (USD)

High (USD)

Regulatory fines

Low (USD)

Likely (USD)

High (USD)

For fine caps by law and region, see privacy law.

Your top 5 critical assets

Systems or data sets you could not run without. Leave a row empty to skip it; a row with no name is ignored. Cost per record comes from the section above.

Public: Meant for anyone to see, such as marketing pages.
Internal: For staff only; low harm if it leaks, such as internal notices.
Confidential: Harm to customers or the business if it leaks, such as customer records or contracts.
Restricted: Severe harm or legal duty if it leaks, such as health, payment or credential data.

Asset 1

Name

Value (USD)

Records held

Downtime cost per day (USD)

Days to restore

Data class

Internet-facing

RTO (hours, optional)

RPO (hours, optional)

Backup interval (hours, optional)

Asset 2

Name

Value (USD)

Records held

Downtime cost per day (USD)

Days to restore

Data class

Internet-facing

RTO (hours, optional)

RPO (hours, optional)

Backup interval (hours, optional)

Asset 3

Name

Value (USD)

Records held

Downtime cost per day (USD)

Days to restore

Data class

Internet-facing

RTO (hours, optional)

RPO (hours, optional)

Backup interval (hours, optional)

Asset 4

Name

Value (USD)

Records held

Downtime cost per day (USD)

Days to restore

Data class

Internet-facing

RTO (hours, optional)

RPO (hours, optional)

Backup interval (hours, optional)

Asset 5

Name

Value (USD)

Records held

Downtime cost per day (USD)

Days to restore

Data class

Internet-facing

RTO (hours, optional)

RPO (hours, optional)

Backup interval (hours, optional)

Readiness

Answer Yes only if it is true everywhere. Unanswered counts as No.

Do all remote access routes (VPN, remote desktop, cloud logins) need multi-factor authentication?

Yes No

Why insurers ask: Stolen passwords are the most common way in; MFA on remote access stops most of them. See the tools

Do all administrator and privileged accounts need multi-factor authentication?

Yes No

Why insurers ask: An attacker with an admin account can switch off defences and reach every system. See the tools

Does every email account need multi-factor authentication?

Yes No

Why insurers ask: Email takeover leads to payment fraud and password resets for other services. See the tools

Is endpoint detection and response (EDR) running on every workstation and server?

Yes No

Why insurers ask: EDR catches ransomware behaviour that ordinary antivirus misses; insurers ask for 100% coverage. See the tools

Do you filter email for phishing, malicious links and attachments with a dedicated email security tool?

Yes No

Why insurers ask: Phishing is a leading way ransomware starts. See the tools

Are critical security patches installed within 14 days of release?

Yes No

Why insurers ask: Attackers exploit known flaws within days; unpatched systems are a common entry point. See the tools

Do you control and record administrator access with a privileged access management (PAM) tool?

Yes No

Why insurers ask: It limits what a stolen admin login can do and leaves an audit trail. See the tools

Do you use zero trust network access (ZTNA) or network access control (NAC) so unknown devices cannot reach internal systems?

Yes No

Why insurers ask: It keeps an intruder on one device from roaming across the network. See the tools

Do staff take phishing awareness training at least once a year?

Yes No

Why insurers ask: People are the target of most attacks; trained staff report more and click less. See the tools

Are backups of all critical systems immutable or kept offline, separate from the main network?

Yes No

Why insurers ask: Ransomware deletes or encrypts reachable backups first; separate copies make recovery possible. See the tools

Does access to the backup system need multi-factor authentication?

Yes No

Why insurers ask: Attackers who can log in to backups can wipe them. See the tools

Have you tested restoring from backups in the last 12 months?

Yes No

Why insurers ask: An untested backup often fails; the test shows how many days of downtime to expect. See the tools

Do you have an incident response plan that you have rehearsed in the last 12 months?

Yes No

Why insurers ask: Rehearsed teams contain incidents sooner, and sooner means cheaper. See the tools

Is someone watching your security alerts around the clock (an in-house SIEM team or a managed detection and response service)?

Yes No

Why insurers ask: Many attacks run overnight and at weekends; round-the-clock monitoring shortens the time to spot them. See the tools

Is sensitive data encrypted, or protected by data loss prevention (DLP)?

Yes No

Why insurers ask: Encrypted or controlled data is less costly to lose and easier to defend to regulators. See the tools

Recovery and continuity

Optional. Leave everything blank to skip this section. Per-asset targets are in the asset rows above.

RTO (recovery time objective): The longest outage the business can accept before the harm becomes unacceptable. Compare it with how long a restore really takes.
RPO (recovery point objective): The most data, measured in time, you can afford to lose. Backups taken less often than this break it.
Cold, warm and hot disaster recovery: Cold: space and hardware, set up after a disaster. Warm: a scaled-down copy kept fairly current. Hot: a full copy that takes over within minutes.
3-2-1 backups: Three copies of the data, on two different media, with one copy off-site (ideally immutable).
BCP (business continuity plan): A written plan for keeping critical processes running, or restoring them, during and after a disruption.
Tabletop exercise: A talk-through of an incident, such as ransomware, where leaders say what they would decide and do.

Recovery time objective, overall (hours)The longest outage you can accept.

Recovery point objective, overall (hours)The most data, in hours of work, you can afford to lose.

Backup interval (hours between backups)How often your backups run.

Cost to recreate one hour of lost data (USD)Your estimate; no public default.

Disaster recovery level

None: No standby environment: you rebuild from backups after a disaster.
Cold: Space and hardware are available but must be set up and loaded with data; recovery takes days.
Warm: A scaled-down copy is running and kept fairly current; recovery takes hours.
Hot: A full copy runs in parallel and takes over within minutes.

Do you have a written business continuity plan (BCP)?

Yes No

Do backups follow the 3-2-1 rule?

Yes No

Months since the last BCP testEnter 0 or leave blank if never tested.

Months since the last disaster recovery testEnter 0 or leave blank if never tested.

Months since the last incident tabletop exerciseEnter 0 or leave blank if never held.

Ransomware

Would you consider paying a ransom?

Yes No

Ransom amount (USD)Default: median ransom paid in 2025, from the Verizon Data Breach Investigations Report (DBIR) 2026.

Your results

Enter your annual revenue to see your results.

Model settings: our assumptions, not insurer pricing

Read-only. The base rates are published figures; the multipliers and the low-case share are our assumptions. The Excel workbook lets you change every one of them.

Sources

Cyentia Institute, IRIS 2025: Chance of an incident (Figures 6 and 8) and loss per incident by revenue (Table 1); CISA-sponsored, 2008 to 2024 loss data.
Verizon, Data Breach Investigations Report 2026: Ransomware in 48% of breaches (up from 44%); median ransom paid $139,875 (prior year revised to $150,000); 69% of victims did not pay.
NIST IR 8286r1, Integrating Cybersecurity and Enterprise Risk Management: Exposure as likelihood times impact, with low, most likely and high estimates.
NIST IR 8286A (draft), Identifying and Estimating Cybersecurity Risk: Three-point estimates; the PERT mean (low + 4 x likely + high) / 6.
Open FAIR, The Open Group: Risk as loss event frequency times loss magnitude.
Tokio Marine HCC cyber application (2026): The control questions mirror what a cyber insurer asks.

Multipliers for each No answer, and the low case at 25% of the published median, are our assumptions. They are not insurer pricing. Base rates are averages from US-heavy data; override them with your own figures.

Estimates for planning and insurance conversations. Not insurance, legal or financial advice.