This phishing risk exposure calculator helps security, finance, and operations teams estimate annual residual financial exposure using transparent assumptions they can adjust. Enter the organization’s own incident frequency, probability, impact, timing, or cost data to see a main estimate and supporting measures. The result is designed for scenario planning, budgeting, and control discussions—not as a prediction or a substitute for a documented risk assessment. Recalculate with conservative and severe assumptions to understand how sensitive the outcome is.
Annual residual exposure = Events × Loss probability × Average impact × (1 − Control reduction)
Percentages are converted to decimals before multiplication. Exposure before controls omits the final reduction factor.
This is a probability-weighted annual planning estimate, not a prediction of the exact loss in a particular year.
Use documented incident data when available. Correlated events, reputation damage, and regulatory consequences may require separate scenario analysis.
For 12 annual events, an 8% loss probability, $25,000 average impact, and 35% control reduction: 12 × 0.08 × $25,000 × 0.65 = $15,600. Gross exposure is $24,000, residual probability is 5.2%, and expected residual events are 0.624.
Use attempts only if the probability and cost inputs are defined per attempt. Otherwise, filter the count to events matching the scope of the other assumptions.
Use a clearly documented range based on internal observations and expert review, then compare low, central, and high scenarios rather than presenting one value as certain.
Include them only when they can be estimated without duplicating another input. Otherwise, report them separately as unmodeled considerations.
No. A zero result only reflects one or more zero assumptions in this model and may indicate missing data rather than absence of risk.
No. It is a scenario estimate. Actual frequency, loss severity, recovery, and operational effects can differ materially from the inputs.
| Variable | Unit | How it is used |
|---|---|---|
| Events | Count/year | Material opportunities for loss |
| Loss probability | Percent/event | Chance an event produces financial harm |
| Average impact | USD/event | Mean loss if harm occurs |
| Control reduction | Percent | Modeled reduction from existing safeguards |