Compare baseline incident recovery time with a zero trust recovery scenario. Enter detection, containment, restoration, and validation times, then model faster detection and a smaller blast radius separately to estimate adjusted recovery time, hours saved, and downtime cost avoided.
Adjusted recovery time separates detection improvement from reduced containment and restoration work.
Validation time is unchanged in this model. Change its baseline input only when the recovery design genuinely changes validation effort.
For 12 detection, 16 containment, 28 restoration, and 8 validation hours, with 50% faster detection and 35% less containment/restoration time: baseline is 64 hours and adjusted recovery is 42.6 hours.
Zero trust can improve visibility and limit spread through different mechanisms, so separating them avoids hiding those effects.
Not in this model. Validation remains unchanged unless you modify its baseline input.
Use it to test feasibility, but set the formal objective through business-impact and resilience planning.
Yes, include relevant restore work when the modeled incident requires recovery from backups or clean images.
It is recovery hours saved multiplied by the entered downtime cost per hour.
| Variable | Meaning | Unit |
|---|---|---|
| Detection reduction | Faster telemetry, identity, and policy signals | % |
| Blast-radius reduction | Less containment and restoration work | % |
| Validation | Verification after service restoration | hours |
| Hourly cost | Business interruption cost | USD/hour |