Frequency
A per-industry base breach rate, scaled by your revenue (attack surface) and the data you hold (attacker interest), then reduced by the preventive controls you have deployed.
Tool · Interactive
Quantify cyber risk in dollars.
Most cyber-risk conversations stop at 'high/medium/low'. This tool converts your exposure into an annualized dollar range — frequency × magnitude — calibrated to industry benchmarks. No signup; nothing leaves your browser.
Your profile
Five inputs. The estimate updates live.
250,000
1K10M
Drives per-record cost and regulatory exposure
Toggle what you actually have deployed
Annualized loss exposure
$6.69M/ year expected
Probability-weighted loss across a year. A material breach is expected roughly every 5.0 years.
Bad-year loss (1-in-20)
$42.2M
Typical single incident
$25.1M
Loss exceedance
probability annual loss ≥ XHover the curve to read any threshold
Where the loss sits
Data / records (primary)98%
Response, fines, downtime2%
Biggest levers
- EDR / managed detection−$2.83M/yr
- Network segmentation−$2.17M/yr
- Vulnerability management−$2.07M/yr
Estimate only. A FAIR-lite model calibrated to public benchmarks (IBM Cost of a Data Breach, Verizon DBIR); it is not a substitute for a scoped assessment. No inputs leave your browser.
Methodology
How the estimate is built
A transparent FAIR-lite model — frequency × magnitude — calibrated to public benchmarks. No black box, no signup, nothing leaves your browser.
Magnitude
Primary loss (records × industry cost-per-record × data sensitivity) plus secondary loss (forensics, legal, notification, regulatory fines, downtime and churn), attenuated by your response controls.
Annualized exposure
A Monte Carlo simulation combines frequency and magnitude into a full distribution — surfaced as an expected annual loss, a bad-year tail, and a loss-exceedance curve.
Benchmarks are derived from public sources including the IBM Cost of a Data Breach report and the Verizon Data Breach Investigations Report (DBIR). This is a directional estimate for planning and board conversations — not a scoped assessment.