Incident Cost Calculator
Total the cost of one security incident: response labour, downtime, third-party support, remediation and overtime.
About Incident Cost Calculator
Degradation is applied as a multiplier because outages are rarely total: a payment path at 40% capacity for fourteen hours is not fourteen hours of zero revenue. Overtime is modelled explicitly, because incident response is mostly out-of-hours work and the uplift is a real, visible line in the cost. Every dollar figure here is your assumption, not an industry constant — but the resulting cost per hour of downtime is what turns a request for automation or 24×7 coverage into a business case a CFO can compare against the spend.
Formulas
Incident Cost
Total = response hours × blended rate × overtime uplift + downtime hours × revenue per hour × degradation + external and remediation costs.
- blended rate
- Average fully loaded hourly cost across everyone pulled into the incident
- overtime uplift
- (1 − OT share) + OT share × multiplier
- degradation
- How much of full service capacity was lost
Cost per downtime hour
Cost per hour of downtime = total cost ÷ downtime hours — the number that prices faster containment.
- downtime hours
- Wall-clock hours of degraded or lost service
Worked example
With the default values below, Incident Cost Calculator returns Total Incident Cost of $617,960. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Internal response hoursaccepts 0–500,000 hours
- 320 hours
- Blended internal hourly rateaccepts 0–2,000 $/hour
- 95 $/hour
- Response hours at overtime ratesaccepts 0–100 %
- 30 %
- Overtime multiplieraccepts 1–3 ×
- 1.5 ×
- Hours of service disruptionaccepts 0–100,000 hours
- 14 hours
- Revenue or productivity per hour of full serviceaccepts 0–100,000,000 $/hour
- 45,000 $/hour
- Average service degradation during the outageaccepts 0–100 %
- 60 %
- External forensics, legal and PRaccepts 0–100,000,000 $
- 120,000 $
- Remediation, rebuild and hardeningaccepts 0–100,000,000 $
- 85,000 $
Results
- Total Incident Cost
- $617,960
- Internal Labour Cost
- $34,960
- Business Disruption Cost
- $378,000
- Third-Party and Remediation Cost
- $205,000
- Cost per Hour of Downtime
- $44,140
- Largest Cost Driver
- Business disruption — 61.2% of the total, so faster containment is the highest-value investment
Step by step
- 1Values used
- 2Incident Cost
- 3Cost per downtime hour
- 4Total Incident Cost= 617,960
- 5Internal Labour Cost= 34,960
- 6Business Disruption Cost= 378,000
- 7Third-Party and Remediation Cost= 205,000
- 8Cost per Hour of Downtime= 44,140
- 9Largest Cost Driver= Business disruption — 61.2% of the total, so faster containment is the highest-value investment
Assumptions and limits
- The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Incident Cost calculated?
Total = response hours × blended rate × overtime uplift + downtime hours × revenue per hour × degradation + external and remediation costs. Degradation is applied as a multiplier because outages are rarely total: a payment path at 40% capacity for fourteen hours is not fourteen hours of zero revenue. Overtime is modelled explicitly, because incident response is mostly out-of-hours work and the uplift is a real, visible line in the cost.
Why does Incident Cost matter?
Every dollar figure here is your assumption, not an industry constant — but the resulting cost per hour of downtime is what turns a request for automation or 24×7 coverage into a business case a CFO can compare against the spend.
What values do I need to enter?
This calculator takes 9 inputs: Internal response hours, Blended internal hourly rate, Response hours at overtime rates, Overtime multiplier, Hours of service disruption, Revenue or productivity per hour of full service, Average service degradation during the outage, External forensics, legal and PR, Remediation, rebuild and hardening. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Are these figures industry benchmarks?
No. They are your inputs, and the calculator only does the arithmetic. Published breach studies give useful ranges for context, but the revenue per hour, blended rate and degradation for your own services are the only inputs that make this number defensible.
What is usually underestimated?
Internal labour. Three hundred hours sounds like a lot until you count the platform engineers, service desk, legal, communications and executive time consumed by a serious incident — the true figure is often several times the security team's own hours.