Incident Cost Calculator
Total the cost of one security incident: response labour, downtime, third-party support, remediation and overtime.
Inputs
A user-supplied assumption covering analysts, IT, legal and management time.
A user-supplied assumption.
Total Incident Cost
$617,960
Internal Labour Cost
$34,960
Business Disruption Cost
$378,000
Third-Party and Remediation Cost
$205,000
Cost per Hour of Downtime
$44,140
Largest Cost Driver
Business disruption — 61.2% of the total, so faster containment is the highest-value investment
Step by step
Values used
Internal response hours = 320 hours; Blended internal hourly rate = 95 $/hour; Response hours at overtime rates = 30 %; Overtime multiplier = 1.50 ×; Hours of service disruption = 14 hours; Revenue or productivity per hour of full service = 45,000 $/hour; Average service degradation during the outage = 60 %; External forensics, legal and PR = 120,000 $; Remediation, rebuild and hardening = 85,000 $
Incident Cost
Total = response hours × blended rate × overtime uplift + downtime hours × revenue per hour × degradation + external and remediation costs.
Cost per downtime hour
Cost per hour of downtime = total cost ÷ downtime hours — the number that prices faster containment.
Total Incident Cost
= 617,960
Internal Labour Cost
= 34,960
Business Disruption Cost
= 378,000
Third-Party and Remediation Cost
= 205,000
Cost per Hour of Downtime
= 44,140
Largest Cost Driver
= Business disruption — 61.2% of the total, so faster containment is the highest-value investment
How it works
Degradation is applied as a multiplier because outages are rarely total: a payment path at 40% capacity for fourteen hours is not fourteen hours of zero revenue. Overtime is modelled explicitly, because incident response is mostly out-of-hours work and the uplift is a real, visible line in the cost. Every dollar figure here is your assumption, not an industry constant — but the resulting cost per hour of downtime is what turns a request for automation or 24×7 coverage into a business case a CFO can compare against the spend.
Formulas
Incident Cost
Total = response hours × blended rate × overtime uplift + downtime hours × revenue per hour × degradation + external and remediation costs.
- blended rate
- Average fully loaded hourly cost across everyone pulled into the incident
- overtime uplift
- (1 − OT share) + OT share × multiplier
- degradation
- How much of full service capacity was lost
Cost per downtime hour
Cost per hour of downtime = total cost ÷ downtime hours — the number that prices faster containment.
- downtime hours
- Wall-clock hours of degraded or lost service
Frequently Asked Questions
How is Incident Cost calculated?
Total = response hours × blended rate × overtime uplift + downtime hours × revenue per hour × degradation + external and remediation costs. Degradation is applied as a multiplier because outages are rarely total: a payment path at 40% capacity for fourteen hours is not fourteen hours of zero revenue. Overtime is modelled explicitly, because incident response is mostly out-of-hours work and the uplift is a real, visible line in the cost.
Why does Incident Cost matter?
Every dollar figure here is your assumption, not an industry constant — but the resulting cost per hour of downtime is what turns a request for automation or 24×7 coverage into a business case a CFO can compare against the spend.
What values do I need to enter?
This calculator takes 9 inputs: Internal response hours, Blended internal hourly rate, Response hours at overtime rates, Overtime multiplier, Hours of service disruption, Revenue or productivity per hour of full service, Average service degradation during the outage, External forensics, legal and PR, Remediation, rebuild and hardening. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Are these figures industry benchmarks?
No. They are your inputs, and the calculator only does the arithmetic. Published breach studies give useful ranges for context, but the revenue per hour, blended rate and degradation for your own services are the only inputs that make this number defensible.
What is usually underestimated?
Internal labour. Three hundred hours sounds like a lot until you count the platform engineers, service desk, legal, communications and executive time consumed by a serious incident — the true figure is often several times the security team's own hours.