Estimate data breach risk exposure using operational inputs you can adjust for your organization. The calculator separates the main estimate from its key cost, frequency, or timing components so security and finance teams can review assumptions, compare scenarios, and document a planning baseline. Results are estimates and should be supplemented with incident history, vendor terms, and current control evidence.
The main result expresses the modeled scenario in the unit shown. Secondary results expose the components that drive it, making assumptions easier to review and revise.
Security incident estimates are uncertain. This tool is for planning and comparison and is not legal, insurance, audit, or financial advice.
With 50,000 records, $165 per record, $250,000 fixed costs, 20% recovery, and 12% probability: gross loss is $8,500,000, net loss is $6,800,000, and annual risk exposure is $816,000.
The largest monetary, probability, frequency, or duration input usually has the greatest effect. Change one value at a time to test sensitivity.
Yes, where zero reflects the scenario. Inputs used as divisors must remain above zero, and the calculator will show an error when required.
No. It is a scenario-based planning estimate, not a forecast of exactly when or how an incident will occur.
Use the realistically collectible share after exclusions, deductibles, waiting periods, and coverage limits rather than the headline policy limit.
Keep baseline assumptions consistent, change only the control-related inputs, and compare the resulting exposure, cost, time, or ROI.
| Input | Unit | Role |
|---|---|---|
| Annual breach probability | % | Estimated chance during the next 12 months. |
| Records potentially exposed | records | In-scope personal or business records. |
| Cost per compromised record | USD | Blended response, notification, and impact cost. |
| Fixed incident costs | USD | Legal, forensic, communications, and restoration costs. |
| Insurance recovery | % | Share of total loss expected to be reimbursed. |