Incident Cost Calculator
Estimate the full cost of a security incident including containment, recovery, regulatory fines, and reputational impact — and model the saving from faster response.
- Covers ransomware, data breach, credential compromise, and supply chain incidents
- Line-item breakdown: containment, recovery, legal, notification, reputational
- Models the cost delta between current MTTR and ManySignal response time
- Benchmarked from IBM Cost of a Data Breach and Verizon DBIR
Calculate incident cost
Total estimated incident cost
$1,560,600
Ransomware · 85,000 records · 18-day dwell
How this tool works
Select your incident type and severity
Choose from ransomware, data breach, credential compromise, insider threat, or supply chain incident. Each type has different cost distribution assumptions.
Enter scope and detection lag
Input the number of affected users and systems, and how long the attacker was present before detection (dwell time in days).
Review the full incident cost breakdown
The calculator outputs a line-item breakdown: containment, investigation, recovery, notification, regulatory, and reputational costs — with and without agentic response.
What to do with the result
Justify your security investment
Present the average incident cost to your board as the risk exposure your security programme is designed to reduce.
Model cyber insurance coverage gaps
Compare the total incident cost against your cyber policy limits to identify coverage gaps before they become claims.
Quantify the detection lag penalty
Show leadership how each additional day of dwell time compounds the total incident cost using the dwell time slider.
Incident cost calculator: frequently asked questions
What data sources does the calculator use for cost benchmarks?
The calculator uses IBM's 2024 Cost of a Data Breach Report, Verizon DBIR, and Ponemon Institute research as primary benchmarks. Regulatory fine estimates use published fine schedules from GDPR, HIPAA OCR, and PCI DSS council guidance.
Does the calculator include regulatory fines?
Yes. Toggle 'Include regulatory exposure' to add estimated GDPR (up to 4% global revenue), HIPAA OCR (up to $1.9M per violation category), and PCI DSS (custom assessments starting at $5,000/month) fine exposure to the total cost.
How is 'reputational cost' calculated?
Reputational cost is estimated as a percentage of annual revenue based on customer churn models from public breach post-mortems. For B2C companies the default is 2% of annual revenue; B2B defaults are lower (0.5%) due to longer contract cycles.
Why does dwell time increase cost so dramatically?
Each day of attacker presence typically expands the blast radius — more accounts compromised, more data accessed, more persistence mechanisms established. Verizon DBIR data shows that incidents with dwell times over 30 days cost 3-5x more than those contained within 24 hours.
Can I model the cost saving from agentic response specifically?
Yes. Toggle 'Compare with ManySignal response' to add a parallel calculation assuming 23-minute average MTTR. The delta shows the financial benefit of faster detection and automated containment for the same incident type.
Is ransomware calculated differently from a data breach?
Yes. Ransomware includes a ransom payment consideration line item (defaulting to $500K, adjustable), ransomware recovery cost premium (typically 3-5x standard recovery due to full rebuild requirements), and extended business disruption (median 21 days vs. 7 days for data breaches).
How accurate are these estimates for a real incident?
The calculator provides order-of-magnitude estimates for planning and board communication purposes. Real incident costs vary enormously by sector, geography, attacker sophistication, and response quality. Actual costs should be assessed by a qualified breach coach or forensic firm.
Can I use this for tabletop exercise planning?
Yes. This is one of the most common use cases. Run the calculator for your most likely incident scenario (ransomware, credential compromise) and use the cost breakdown to frame your tabletop exercise objectives around cost containment decisions.
Compress dwell time before the cost compounds
ManySignal's agentic response cuts attacker dwell time from 18 days to under 2 hours in most environments. Book a demo.