Ransomware Ransom vs Recovery Cost Calculator

Work out ransomware ransom vs recovery cost instantly with clear inputs, formula shown and shareable results.

About Ransomware Ransom vs Recovery Cost Calculator

Comparing paths requires costing both properly. Backup recovery costs the downtime it takes plus the business impact of whatever data is unrecoverable. Paying the ransom still involves significant downtime — decryption is slow and often partial — which is modelled here at about a third of the recovery period. Payment also buys no guarantee, funds further attacks and may breach sanctions rules.

Formula

Path comparison

recovery path = recovery days x downtime cost per day + unrecoverable data exposure; ransom path = ransom + 0.35 x recovery days x downtime cost per day

Worked example

With the default values below, Ransomware Ransom vs Recovery Cost Calculator returns Cost of recovering from backups of $2,052,000. Change any input above and every figure here is recalculated in your browser.

Inputs used

Ransom demandminimum 0: 750,000
Days to recover from backupsminimum 0.1 days: 9 days
Downtime cost per dayminimum 0: 180,000
Data recoverable from backupsaccepts 0–100 %: 92 %

Results

Cost of recovering from backups: $2,052,000
Cost of the ransom path including partial downtime: $1,317,000
Downtime cost during recovery: $1,620,000
Comparison: Ransom path appears cheaper on cost alone, but payment carries legal, ethical and no-guarantee risks

Step by step

1Values used
2Path comparison
3Cost of recovering from backups= 2,052,000
4Cost of the ransom path including partial downtime= 1,317,000
5Downtime cost during recovery= 1,620,000
6Comparison= Ransom path appears cheaper on cost alone, but payment carries legal, ethical and no-guarantee risks

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax or compounding frequency into account.
Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Does paying actually restore data?

Not reliably. Published incident data consistently shows a substantial share of payers recover only part of their data, and some receive nothing usable at all.

What reduces the recovery-path cost most?

Tested, immutable, offline backups and a rehearsed restore runbook. Recovery time, not backup existence, is what drives the cost, and it is only knowable by practising.