Data Breach Cost Estimator

Model the impact of a breach from records held, response costs and disruption, then see the expected annual loss and the value of better controls.

Why estimate breach cost at all

Security spending is easier to justify — and to size — when you put a number on the risk. This estimator uses a standard expected-loss approach: the cost of an incident multiplied by how likely it is in a year. The result gives you a sensible ceiling for annual security spend on the risks you model.

Choosing your inputs

• Records: count customers, employees and leads whose personal data you hold, including old records you could delete.
• Cost per record: published industry studies give per-record estimates that change every year and vary by sector and country. Use a figure you trust.
• Response costs: forensic investigation, legal advice, notification letters and credit monitoring.
• Disruption: days you could not trade normally while systems are restored.

What drives breach costs

• Downtime and lost sales while systems are restored
• Incident response, forensics and legal advice
• Customer notification and credit monitoring where required
• Regulatory fines in some jurisdictions and industries
• Lost customers and reputational damage

Small businesses often feel the downtime and recovery costs most. Strong backups and a tested recovery plan shorten downtime more than any other control.

Reducing the risk

The controls with the biggest impact are multi-factor authentication, a password manager, automatic updates, endpoint protection, tested backups and staff awareness of phishing and payment fraud. Our security checklist turns these into a step-by-step plan.