Data Breach Cost Estimator
Estimate what a data breach would cost your business, your expected annual loss, and the gap your cyber insurance leaves.
Example scenario—not a forecast or verified benchmark. Enable JavaScript to edit inputs, view charts, save locally and export your analysis.
Example inputs
- Sensitive records you hold
- 10,000
- Most sensitive data type
- customer_pii
- Share of records likely exposed in a serious incident
- 30
- Cost per exposed record
- 100
- Fixed incident response (forensics, breach counsel, PR)
- 50,000
- Annual revenue
- 5,000,000
- Days of disrupted operations
- 5
- Revenue lost on a disrupted day
- 50
- Current security controls
- basic
- Annual chance of a material breach (basic controls)
- 10
- Cyber insurance limit (0 if none)
- 250,000
- Insurance deductible / retention
- 10,000
Example results
A data breach would likely cost $239K–$637K (midpoint $398K), an expected $40K/yr, and your insurance leaves $148K uncovered at the midpoint.
- Estimated breach cost (midpoint)
- $398,077
- Uninsured gap (midpoint)
- $148,077
- Expected annual loss
- $39,808
- Cost range
- $239K–$637K
- Uninsured gap (severe case)
- $386,923
- Annual breach likelihood (control-adjusted)
- 10%
- Records exposed
- 3,000
- Annual loss avoided with strong controls
- $25,875
What stands out
Uninsured exposure: $148K in a typical breach
Your $250K limit covers 63% of the midpoint loss; a severe case leaves $387K on your balance sheet.
A breach would cost about 8% of annual revenue
Per-record costs drive 75% of the total; 3,000 records exposed at $100 each.
Stronger controls cut expected annual loss by $26K
Moving to MFA everywhere, EDR, tested offline backups, and an incident plan lowers both the odds and the cost of a breach.
Next actions
- Ask your broker to quote a limit near $750K and confirm it covers forensics, notification, and business interruption.
- Delete or archive records you no longer need: every 10% fewer records held cuts roughly $30K from the breach estimate.
- Close the basics first: MFA on email and remote access, EDR on every device, and an offline backup you have restored.
Model assumptions & limitations
- Cost per record ($100) is your input; verify it against the current edition of a published breach-cost study. Figures from large-enterprise studies may not scale linearly to small breaches.
- Record-type multiplier of 1x and control multipliers (0.7x / 1.0x / 1.3x cost; 0.5x / 1.0x / 1.8x likelihood) are judgment-based, not measured.
- Low and severe cases are 0.6x and 1.6x the midpoint. Revenue per day assumes 260 operating days.
- Insurance pays the loss above the retention up to the limit; sublimits and exclusions are ignored.