loading_
Ransomware isn't just about the ransom. It's about downtime, reputation, and recovery. Use our calculator to see the potential ROI of investing in proactive resilience.
*Average downtime from ransomware attacks is often 21+ days.
Investing in a threat simulation allows you to identify gaps and reduce downtime *before* an incident occurs.
*Disclaimer: This calculator provides estimates based on industry averages for ransomware demands (approx. 3% of revenue) and operational downtime impact. Actual costs vary significantly by sector, attack type, and existing controls. This tool is for educational purposes only.
Taking this to a board? Send us your details and a facilitator will sense-check the assumptions and tell you which numbers will get challenged, before someone else challenges them.
We receive your email address, your organisation if you give one, and which tool you used. The document you generated stays in your browser and is never sent to us. See our privacy policy.
It puts a number on what a ransomware incident would cost your organisation in downtime and recovery, and compares that against what prevention and preparation cost, so the conversation with a board has figures in it rather than adjectives.
The output is a comparison you can take into a budget discussion, built from your own inputs rather than industry averages that a finance director can dismiss.
Sanity-check the downtime figure with operations
The number that matters most is how long you would be unable to trade. Ask the people who run the operation, not the people who run IT, and expect the honest answer to be longer than the planned one.
Make the tail risk explicit
Median incident costs in UK data are very low, which is why average-cost arguments fail with finance directors. The case rests on the rare severe event, so frame it as insurance rather than as expected value.
Separate prevention from preparation
They are different purchases answering different questions. Prevention reduces the chance of an incident. Preparation reduces how bad it gets once prevention has failed, which it eventually will.
Take one specific unanswered question to the board
A concrete gap, such as nobody being able to say who authorises taking the core system offline, persuades better than any calculation.
It is a model, not a forecast. It cannot know your recovery time objectives, whether your backups actually restore, what your insurance covers, or the reputational cost of an outage in your sector. The figures are only as good as your inputs, and the honest answer for the rare catastrophic case is that it is difficult to estimate at all.
Far less than headline figures suggest for most organisations, and occasionally far more. The Cyber Security Breaches Survey 2025/2026 puts the median perceived cost of the most disruptive breach at £0, with most falling between £0 and £200, while the top 5% of cases reach £4,000 for businesses overall and £10,000 for medium and large businesses. The survey also notes that rare catastrophic incidents are not fully captured, so treat this as a tail risk rather than an average.
Because they are usually wrong for a UK organisation of your size, and a finance director can check. Leading with a frightening average invites an argument about the number instead of the risk. The argument that holds is whether you could absorb the rare severe case, which is how boards already think about insurance.
Both, and they are different purchases. Prevention reduces the likelihood of an incident; response and preparation reduce its severity once prevention has failed. Organisations tend to over-invest in the first and under-invest in the second, which is why the gap between a contained incident and a crisis is usually measured in hours of hesitation rather than in missing technology.
That is a decision for your board, your legal advisers and your insurer, not a calculator, and it carries legal considerations including sanctions exposure. What matters here is that it is a decision far better rehearsed in advance than made for the first time at 2am under pressure.