Why use this calculator
Security budgets are approved or refused on a number, and if you do not bring one someone else will bring a worse one. The value of modelling breach cost is not the headline figure, which will always be wrong, but the structure underneath it: how much of the exposure is driven by things you can change and how much is fixed by the size of your customer database.
Containment speed, automation maturity and whether your incident response plan has ever been exercised all move the total materially, and each of them maps directly to a line in a security roadmap. Insurance is the other half of the picture, because a policy shifts cost rather than removing it and the share it actually covers after retentions and sublimits is usually far below what the board assumes.
Run the model twice, once as you are today and once as you would be after the investment you are proposing, and the difference is your business case.
How to use it
- Enter the number of individual people whose records could be exposed, which you can take from your data inventory or, failing that, the row count of your largest customer table.
- Choose the sector your regulator treats you as rather than the one you describe yourself as, since notification duties and fine exposure follow the regulatory classification.
- Enter a realistic number of days to identify and contain an incident, using your own mean time to detect plus mean time to contain if you measure them and roughly 200 days if you do not.
- Set automation maturity by asking whether alerts are triaged and contained without a human in the loop or whether they wait for someone to open a ticket.
- Answer yes to the incident response plan question only if the plan has been rehearsed in a tabletop exercise within the last twelve months, because an unexercised plan behaves like no plan.
- Finally estimate the share of costs your cyber policy would cover, working from your limit against expected loss after the retention and any sublimits.
What each result means
- Estimated total breach cost
- The modelled all-in cost of the incident across detection, notification, response and lost business, before any insurance recovery.
- Containing 30 days faster saves
- How much lower the modelled breach cost would be if the breach were identified and contained thirty days sooner, all else equal. It puts a dollar figure on investment in detection and response speed.
- Value of an incident response plan
- The difference a tested incident response plan makes to this modelled breach cost, comparing the same breach with and without one. Use it to weigh the cost of writing and rehearsing a plan.
- Out-of-pocket cost after insurance
- What your own balance sheet funds. This is the figure a board cares about and the one to put in a business case.
- Sector benchmark cost per record
- The indicative per-record starting point for your sector, before your own containment and readiness factors are applied.
- Your modelled cost per record
- The benchmark after adjustment. Compare it with the sector figure to see whether your posture helps or hurts.
- Containment multiplier applied
- How much your detection and containment time adds to or removes from the benchmark. Above 1.0 means slow containment is costing you.
- Detection and escalation
- Forensic investigation, threat hunting, crisis management and the internal hours spent establishing what actually happened.
- Notification
- Regulator filings, notices to affected individuals, call centre capacity and any credit monitoring you must offer.
- Post-breach response
- Legal counsel, remediation engineering, regulatory defence, settlements and the identity protection services you have to offer affected people.
- Lost business
- Customer churn, higher acquisition cost afterwards and pipeline that stalls while the incident is in the news.
- Expected insurance recovery
- What the policy is modelled to pay. Check it against your retention, your sublimits and your policy's exclusions before relying on it.
The formula
Total cost = records exposed multiplied by the sector cost per record, multiplied by the containment multiplier, the automation multiplier and the incident response multiplier
The containment multiplier is 0.78 plus 0.0011 per day, bounded between 0.78 and 1.35, so a 200 day cycle is neutral. The automation multiplier is 0.80 for extensive, 1.00 for partial and 1.10 for none. The incident response multiplier is 0.90 with a tested plan and 1.10 without.
Insurance recovery = total multiplied by the cover percentage
Out-of-pocket = total minus recovery
The cost is then split across detection and escalation at 29 per cent, notification at 6 per cent, post-breach response at 27 per cent and lost business at 38 per cent.
How this number is used in practice
Every per-record benchmark you will see traces back to a small number of surveys, and the most widely quoted is the IBM Cost of a Data Breach Report, produced annually with the Ponemon Institute. Its 2025 edition put the global average breach at around 4.4 million US dollars, with the United States materially higher and sectors like healthcare higher again.
The figure is useful and it is also frequently misused, because it is a mean drawn from a sample of surveyed organisations, it is dominated by large incidents, and it does not include the mega-breaches that skew public perception. Name the edition whenever you quote it.
A board that knows a number comes from a 2025 survey of a few hundred organisations can weigh it; a board told only that breaches cost 4.4 million has been handed a fact it cannot interrogate. The same applies to the containment figures: recent editions of the same series put mean time to identify and contain in the region of 240 days, which is why 200 days sits near the middle of the model above rather than being a target.
Regulatory cost is the part organisations most often underestimate, and it varies enormously by jurisdiction. In the European Union and the United Kingdom, the General Data Protection Regulation and UK GDPR allow fines up to 4 per cent of global annual turnover for the most serious failures, and the notification clock runs at 72 hours from awareness.
Australia's Notifiable Data Breaches scheme, run by the Office of the Australian Information Commissioner, requires notification of eligible breaches and has been accompanied by substantially increased civil penalty provisions. In the United States there is no single federal standard for most sectors, so a breach affecting people in many states triggers a patchwork of state notification laws with different deadlines and content requirements, plus sector rules such as HIPAA for health data. Legal cost scales with the number of jurisdictions, not with the number of records.
The practical lesson from incident responders is that the two things that reliably change the outcome are detection speed and rehearsal. Organisations that find an intrusion in weeks rather than months limit the data taken, limit the lateral movement, and hand their lawyers a much narrower notification population.
Organisations that have run a tabletop exercise make decisions in hours that untested organisations spend days arguing about, including the ones that must be made under pressure such as whether to take systems offline, when to notify, and who speaks publicly. Neither of those is a product purchase.
Both show up in this model as multipliers rather than as line items, because that is genuinely how they behave.
Worked examples
10,000 technology sector records, 200 day containment, partial automation, tested plan, 40 per cent cover
Total cost $1,485,000.00 with $891,000.00 funded out of pocket
50,000 healthcare records, 300 day containment, no automation, no tested plan, uninsured
Total cost $16,117,200.00 with the entire amount funded out of pocket
The same 10,000 technology records but contained in 45 days with extensive automation
Total cost falls to $985,446.00 and out-of-pocket to $591,267.60
When people use it
- Building a security budget case that shows what a specific investment removes from expected loss
- Testing how much cyber insurance cover you actually need against modelled out-of-pocket exposure
- Quantifying the return on detection engineering and faster containment for an executive audience
- Preparing a board risk paper that puts a defensible range on cyber exposure
- Comparing exposure across business units or acquisitions holding different volumes of personal data
Tips
- Always cite the edition and source of any benchmark you quote. A figure without a vintage cannot be challenged, which makes it worthless in a risk discussion.
- Model your current state and your proposed state and present the difference. The delta is the business case; the absolute number never is.
- Measure your real mean time to detect and contain before using 200 days. Most organisations discover theirs is worse than they assumed.
- Read your cyber policy's retention and sublimits before assuming a cover percentage. Regulatory defence and ransom are commonly sublimited well below the headline limit.
- Reduce the record count itself. Data you have deleted cannot be breached, and retention schedules are the cheapest control on this list.
- Run a tabletop exercise annually with legal, communications and an executive decision maker in the room, not just the security team.
- Encrypt at rest and keep key management separate. In several jurisdictions properly encrypted data materially narrows notification obligations.
What it assumes, and where it stops being accurate
- Per-record cost bands are indicative sector figures in the range reported by the IBM Cost of a Data Breach series and similar surveys. They are averages of self-reported costs, not predictions for your organisation.
- Cost does not scale perfectly linearly with records in reality. Very small breaches carry high fixed costs per record, and very large ones benefit from economies of scale in notification, so extremes in either direction will be misestimated.
- Regulatory fines are not modelled separately. GDPR, UK GDPR and Australian civil penalties are turnover-linked and can dwarf the operational cost of an incident entirely.
- Ransom payments, business interruption from encrypted systems and the cost of rebuilding destroyed infrastructure are excluded. A destructive ransomware event behaves quite differently from a data theft.
- Insurance recovery is modelled as a flat share of total cost. Real policies apply a retention, sublimits on categories such as regulatory defence and ransom, coinsurance, and exclusions that can void a claim.
- Not accurate for breaches of intellectual property, trade secrets or non-personal data, where there are no records to count and the loss is competitive rather than regulatory.
- The multipliers for containment, automation and response planning are calibrated to published survey gaps and are directional. They should not be read as guaranteed savings from a specific product.
Terms used on this page
- Mean time to contain
- The average elapsed time from an intrusion beginning to it being stopped, combining detection and eradication.
- Retention
- The deductible on a cyber insurance policy: the amount the insured pays before cover responds.
- Sublimit
- A cap inside a policy on a specific category of loss, such as regulatory defence or ransom, lower than the overall limit.
- Notifiable breach
- An incident that regulation requires you to report to a regulator and often to the affected individuals within a set deadline.
- Tabletop exercise
- A rehearsed walkthrough of an incident with the real decision makers present, used to test a response plan before it is needed.
Questions people ask
- Where do the per-record figures come from?
- They are indicative sector bands consistent with the IBM Cost of a Data Breach series, which has run annually with the Ponemon Institute for two decades, and with comparable industry surveys. They are averages of self-reported costs from surveyed organisations, so treat them as a starting point to adjust rather than an authoritative price.
- Why does healthcare cost the most per record?
- Health data cannot be reissued the way a card number can, it attracts strict sector regulation such as HIPAA in the United States, and breach handling carries heavy notification and monitoring duties. Patient attrition after an incident is also higher than customer churn in most other sectors, which lifts the lost business component.
- Does faster containment really change the cost that much?
- Yes, and it is the most reliable lever in the model. Containing an intrusion in weeks rather than months limits how much data is taken and how far an attacker moves laterally, which narrows the notification population and shortens the forensic investigation. Published surveys consistently show a double-digit percentage gap either side of roughly 200 days.
- What does cyber insurance actually cover?
- Typically first-party costs such as forensics, notification, credit monitoring and business interruption, and third-party costs such as legal defence and settlements. Cover varies enormously, and retentions, sublimits on regulatory defence or ransom, and exclusions for unpatched systems or missing multi-factor authentication frequently reduce the real recovery well below the headline limit.
- Are regulatory fines included in this estimate?
- No. Fines under GDPR, UK GDPR and Australian privacy law are calculated against global turnover rather than record count, so they do not fit a per-record model and can exceed the entire operational cost of an incident. Model them separately against your turnover and the seriousness of the failure.
- How should I present this to a board?
- As a range with its assumptions visible, not a single number. Show the current-state and proposed-state figures side by side, name the source and edition of every benchmark used, and state plainly which inputs are measured in your organisation and which are assumed. Boards discount numbers they cannot interrogate.
Use this with
Data Breach Cost Estimator answers one part of the question. These pick up where it stops: GDPR Fine Risk Calculator, IT Downtime Cost Calculator, Business Insurance Estimator, Cloud Cost Comparison Calculator and Password Generator.
Where these figures come from
This calculation is jurisdiction-neutral arithmetic. No country-specific rules are applied.
- IBM Cost of a Data Breach Report. Annual per-record and per-breach cost benchmarks with Ponemon Institute
- NIST Cybersecurity Framework. Identify, protect, detect, respond and recover functions used to structure readiness
- CISA. US incident reporting guidance and advisories
- UK National Cyber Security Centre. Incident management and breach response guidance
- Office of the Australian Information Commissioner. Notifiable Data Breaches scheme and statistics
Data Breach Cost Estimator produces an estimate for general information. It is not financial, tax, medical, legal or engineering advice. read the full disclaimer. Spotted a wrong number? Report it and it gets fixed. The form picks up this calculator and the inputs you used.