Total the cost of a ransomware event: downtime, lost work in the RPO window, response, notification and insurance retention.
Ransomware cost has four independent parts and the ransom is not one of them: the outage itself, the work destroyed between the last clean backup and the encryption event, the cost of responding, and the per-record cost of notifying people whose data was taken. Insurance applies to the total after the retention, so the figure that matters to the balance sheet is the retained loss, not the headline. The hourly burn is the number that justifies recovery investment: if every hour down costs the business more than a hot standby costs per month, the argument is over.
Ransomware Impact
totalImpact = downtimeHours × hourlyLoss + rpoHours × hourlyWorkValue + responseCost + records × costPerRecord.
After insurance
retainedLoss = totalImpact − min(totalImpact, max(0, totalImpact − retention) × coverageShare)
totalImpact = downtimeHours × hourlyLoss + rpoHours × hourlyWorkValue + responseCost + records × costPerRecord. Ransomware cost has four independent parts and the ransom is not one of them: the outage itself, the work destroyed between the last clean backup and the encryption event, the cost of responding, and the per-record cost of notifying people whose data was taken. Insurance applies to the total after the retention, so the figure that matters to the balance sheet is the retained loss, not the headline.
The hourly burn is the number that justifies recovery investment: if every hour down costs the business more than a hot standby costs per month, the argument is over.
This calculator takes 10 inputs: Business downtime, Revenue and productivity lost per hour, Data-loss window — work since the last good backup, Value of one hour of lost work, Incident response, forensics and legal, Personal records exposed, Notification and remediation per record, Ransom demanded, Share of the loss the policy pays, Policy retention or deductible. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
No — it is a separate decision, and paying does not remove the downtime, the response cost or the notification obligation. The model shows the demand as a ratio of the loss so you can see the commercial pressure without treating payment as a recovery plan.
Because backups restore to a point in time. Every transaction, document and email created after the last clean backup is gone, and someone has to recreate or reconcile it — that is real labour and sometimes irrecoverable revenue.