This business email compromise downtime cost calculator helps security, finance, and operations teams estimate annual operational disruption cost using transparent assumptions they can adjust. Enter the organization’s own incident frequency, probability, impact, timing, or cost data to see a main estimate and supporting measures. The result is designed for scenario planning, budgeting, and control discussions—not as a prediction or a substitute for a documented risk assessment. Recalculate with conservative and severe assumptions to understand how sensitive the outcome is.
Annual downtime cost = Incidents × Downtime hours × Hourly business cost × Affected capacity + Incidents × Fixed recovery cost
Affected capacity scales the hourly disruption component; fixed recovery expense is added for every incident.
The result estimates operational disruption and fixed recovery spending; it excludes direct theft unless included in the hourly or fixed cost assumptions.
Avoid double counting payroll, revenue, and contractual penalties if they are already included in the hourly business cost.
Six incidents at 5 hours each, $8,000 per hour, 60% affected capacity, and $3,000 fixed recovery cost produce $144,000 disruption cost plus $18,000 recovery cost, or $162,000 annually.
Use attempts only if the probability and cost inputs are defined per attempt. Otherwise, filter the count to events matching the scope of the other assumptions.
Use a clearly documented range based on internal observations and expert review, then compare low, central, and high scenarios rather than presenting one value as certain.
Include them only when they can be estimated without duplicating another input. Otherwise, report them separately as unmodeled considerations.
No. A zero result only reflects one or more zero assumptions in this model and may indicate missing data rather than absence of risk.
No. It is a scenario estimate. Actual frequency, loss severity, recovery, and operational effects can differ materially from the inputs.
| Variable | Unit | How it is used |
|---|---|---|
| Incidents | Count/year | Events that interrupt business operations |
| Downtime | Hours/incident | Average disruption duration |
| Hourly cost | USD/hour | Business impact at full affected capacity |
| Affected capacity | Percent | Share of operations impaired |
| Fixed recovery | USD/incident | Forensics, restoration, or vendor expense |