This business email compromise expected loss calculator helps security, finance, and operations teams estimate probability-weighted annual financial loss using transparent assumptions they can adjust. Enter the organization’s own incident frequency, probability, impact, timing, or cost data to see a main estimate and supporting measures. The result is designed for scenario planning, budgeting, and control discussions—not as a prediction or a substitute for a documented risk assessment. Recalculate with conservative and severe assumptions to understand how sensitive the outcome is.
Expected annual loss = Incidents × Probability × Direct loss × (1 − Recoverable share) + Incidents × Response cost
Response cost applies to every material incident; direct loss applies on a probability-weighted basis.
This combines frequency, probability, loss severity, recoverability, and response expense into one annual planning estimate.
Rare extreme losses may be hidden by an average. Pair this estimate with severe but plausible scenario analysis.
For 10 incidents, 12% loss probability, $40,000 direct loss, $2,500 response cost, and 20% recoverable share: net direct loss = $38,400 and response cost = $25,000, producing $63,400 expected annual loss.
Use attempts only if the probability and cost inputs are defined per attempt. Otherwise, filter the count to events matching the scope of the other assumptions.
Use a clearly documented range based on internal observations and expert review, then compare low, central, and high scenarios rather than presenting one value as certain.
Include them only when they can be estimated without duplicating another input. Otherwise, report them separately as unmodeled considerations.
No. A zero result only reflects one or more zero assumptions in this model and may indicate missing data rather than absence of risk.
No. It is a scenario estimate. Actual frequency, loss severity, recovery, and operational effects can differ materially from the inputs.
| Variable | Unit | How it is used |
|---|---|---|
| Incidents | Count/year | Material incidents requiring response |
| Probability | Percent/incident | Chance of a direct loss event |
| Direct loss | USD/event | Gross loss when successful |
| Response cost | USD/incident | Investigation and handling cost |
| Recoverable share | Percent | Expected recovery of direct loss |