Cybersecurity ROI & Payback Calculator for Small Businesses

How Reliable Is This Estimate?

The arithmetic is exact. The inputs are not. How likely an attack is to hurt your business, what it would cost and how much a safeguard would help are all estimates, and small changes to them can change the answer a lot. Treat the results as a way to test your thinking, not as a forecast.

• It is a planning tool, not a prediction. It shows what your assumptions imply; it cannot tell you whether or when an attack will happen.
• It is a simplified model. It uses a single annual probability of a financially damaging incident and a single loss if one occurs. It is not a comprehensive model of every kind of cyber event, of several incidents in one year or of the full range of possible losses.
• Every business is different. Exposure depends on your industry, the technology you rely on, how you operate and the safeguards you already have.
• Research measures different things. Studies report attempted attacks, detected incidents, account compromises, “material” events, insurance claims or financial losses. These are not interchangeable, and none of them is directly your annual probability of a damaging incident.
• Correlation is not causation. Many published findings show that organizations with a control have fewer incidents or claims, not that the control caused the difference.
• Insurance data has gaps. Claims data leaves out uninsured losses and may not represent smaller businesses.
• The reductions are your assumptions. They are not proven benefits of any particular product or service, including CSFSafe's.
• The result is sensitive. ROI moves with the baseline probability, the estimated loss and the assumed effectiveness. Use the scenario comparison to see how much.

This calculator estimates the potential financial value of cybersecurity investments using assumptions you provide. Research demonstrates that many cybersecurity precautions are associated with reduced security incidents or losses, but the effectiveness of a particular investment varies by business. The results are illustrative, not guaranteed savings or predictions.

What is annual expected loss?

Annual expected loss (also called annualized loss expectancy) is the average yearly cost of a risk: the chance it happens in a year multiplied by what it would cost. A 10% annual chance of an $80,000 incident is an expected loss of $8,000 a year. In most years you would lose nothing; in a bad year you would lose much more. The expected figure lets you compare that risk with what it costs to reduce it.

How the calculator works

All figures are expected values from your inputs, with the same estimates every year and no discounting. The model is a simplified scenario: one annual probability of a financially damaging incident and one loss if it occurs, before and after the improvements.

Expected annual loss today       = probability × loss
Expected annual loss after        = probability after × loss after
  simple mode:  probability after = probability × (1 − probability reduction)
                loss after        = loss × (1 − severity reduction)
Expected annual losses avoided    = loss today − loss after
First-year cost                   = one-time cost + annual cost
First-year net expected benefit   = losses avoided − first-year cost
First-year ROI                    = first-year net benefit ÷ first-year cost × 100
Net expected benefit (N years)    = losses avoided × N − one-time cost − annual cost × N
ROI (N years)                     = net expected benefit ÷ total cost over N years × 100
Expected payback period (months)  = 12 × one-time cost ÷ (losses avoided − annual cost)

• The two reductions multiply rather than add, so the same avoided loss is never counted twice.
• In advanced mode you enter the probability and loss after the improvements directly. If either is higher than before, the expected losses avoided are negative and are shown that way, not rounded up to zero. Simple mode can only describe reductions, so a scenario with a higher estimate stays in advanced mode.
• Expected payback counts recurring costs: it is the point where cumulative expected losses avoided equal the one-time cost plus the recurring costs to date. If expected losses avoided do not exceed the annual cost, the investment does not pay back under your assumptions. A payback that is reachable but comes after your analysis period is marked as such.
• ROI is shown as “Not applicable” when there is no cost to divide by. Avoided losses are not cash you receive; they are losses you expect not to incur on average.

Why there is no single cybersecurity ROI figure

Research shows that specific precautions can reduce specific risks. Multifactor authentication sharply reduces account takeovers, for example, and organizations that adopt more basic controls report fewer incidents. But those studies measure different outcomes in different populations, so none of them tells you your own probability of a damaging incident or how much a particular investment would change it. That is why this calculator asks for your assumptions instead of filling in a research average.

For what the research does and does not show, read Does Cybersecurity Preparedness Pay Off? What the Research Actually Shows.

Where your estimates come from

• Probability and loss: start with what your business depends on and what an outage would cost per day. See Risk Identification and Analysis and Critical Business Functions.
• Loss severity: recovery speed depends on backups and response planning. See Business Continuity and Disaster Recovery Basics and Incident Response Plans.
• Where to start: the free CSFSafe Cybersecurity Checkup shows which basic safeguards are missing. If you want a structured way to plan and track the work, see the Cybersecurity Playbook.