This phishing recovery time calculator helps security, finance, and operations teams estimate elapsed response and restoration time using transparent assumptions they can adjust. Enter the organization’s own incident frequency, probability, impact, timing, or cost data to see a main estimate and supporting measures. The result is designed for scenario planning, budgeting, and control discussions—not as a prediction or a substitute for a documented risk assessment. Recalculate with conservative and severe assumptions to understand how sensitive the outcome is.
Recovery time = Detection + (Containment + Eradication + Restoration) × (1 − Parallel overlap)
The overlap factor applies only after detection; it approximates coordinated work and should not be interpreted as staffing efficiency.
The result estimates elapsed incident-handling time under the entered phase assumptions, helping compare playbooks or staffing scenarios.
Dependencies may prevent phases from overlapping. Use actual post-incident timestamps to calibrate each input.
Detection of 2 hours, containment of 4, eradication of 8, restoration of 6, and 25% overlap gives 2 + (4 + 8 + 6) × 0.75 = 15.5 hours. Sequential time is 20 hours and modeled time saved is 4.5 hours.
Use attempts only if the probability and cost inputs are defined per attempt. Otherwise, filter the count to events matching the scope of the other assumptions.
Use a clearly documented range based on internal observations and expert review, then compare low, central, and high scenarios rather than presenting one value as certain.
Include them only when they can be estimated without duplicating another input. Otherwise, report them separately as unmodeled considerations.
No. A zero result only reflects one or more zero assumptions in this model and may indicate missing data rather than absence of risk.
No. It is a scenario estimate. Actual frequency, loss severity, recovery, and operational effects can differ materially from the inputs.
| Variable | Unit | How it is used |
|---|---|---|
| Detection | Hours | Time to identify and triage the incident |
| Containment | Hours | Time to stop continued misuse |
| Eradication | Hours | Investigation and removal work |
| Restoration | Hours | Return and validate affected services |
| Overlap | Percent | Modeled concurrency after detection |