← Back to Calculator

How the IR Cost Estimator Works

A transparent walkthrough of every calculation — from incident base costs through regulatory fines to capability discounts. No black box. All numbers are explainable.

8 Incident Types16 Jurisdictions2025–2026 BenchmarksClient-Side Only

Data Sources

All cost benchmarks are conservative, directional estimates based on:

IBM Cost of a Data Breach Report 2025

US average $10.22M (record); global $4.44M; AI/automation saves $1.9M and 80 days; shadow AI adds $670K

Verizon DBIR 2025

Ransomware in 44% of breaches (+37%); third-party breaches doubled to 30%; vulnerability exploitation up 34%

Ponemon Institute 2025/2026

2026 Cost of Insider Risks: $19.5M avg annually; containment cost $211K per incident; AI adoption cutting containment time

All figures are estimates for planning purposes only and are not legal, financial, or insurance advice. Actual costs vary significantly by organization and incident specifics.

The 6-Step Calculation

01

Select Your Incident Type

Choose from 8 incident categories, each with its own base cost, staffing profile, and typical response duration derived from 2025–2026 industry research.

Each incident type sets a base cost (e.g. ransomware $85K, supply chain $95K), the specialist roles needed (analysts, forensic engineers, legal, recovery), and the expected hours to contain and remediate. These reflect current market rates — IR analysts at $165/hr, forensic specialists at $325/hr, legal at $400/hr.
02

Apply Org Size, Industry & Data Multipliers

Three independent multipliers scale the base cost to your organization's reality.

Organization size runs from 0.7× (small, <100 employees) to 2.2× (enterprise, 10K+). Industry multipliers reflect sector risk — finance at 1.5×, healthcare at 1.4×, technology at 1.3×. Data classification adds a sensitivity layer from 0.6× (public) to 1.5× (regulated). These compound: a large healthcare org with regulated data sees 1.5 × 1.4 × 1.5 = 3.15× the base cost.
03

Add Compliance & Regulatory Exposure

Each active compliance framework adds a fixed cost for documentation, reporting, and regulatory response. Data-exfiltration incidents also carry regulatory fine exposure.

Compliance additions reflect the incremental IR cost of meeting framework requirements (PCI-DSS $8K, HIPAA $10K, GDPR $12K, CMMC $9K, etc.). For data breaches, ransomware, insider threats, and supply chain attacks, the calculator also estimates regulatory fine exposure — combining a jurisdiction base fine with per-record fines (capped by org size) across 16 jurisdictions from GDPR to Texas TDPSA to Montana MCDPA.
04

Compare In-House vs. Outsourced Staffing

The in-house discount is applied to staffing costs only — base costs, compliance, and regulatory fines are the same regardless of team model.

A full in-house team reduces staffing costs by 60%; a partial team by 30%. This isolates the actual leverage: internal IR capability pays off on staffing, but it doesn't reduce fines or notification costs. The calculator shows both totals side-by-side so you can see exactly where the in-house investment pays back.
05

Apply Capability Discounts

Existing security investments reduce the discountable portion of your costs — but never touch regulatory fines or notification costs.

Seven capabilities provide discounts: Security Monitoring (10%), Playbooks (15%), Automation (20%), Threat Intelligence (10%), Regular Training (12%), AI-Powered Detection (18%), Tabletop Exercises (10%). Discounts are summed and capped at 65% to maintain a realistic cost floor. Critically, these discounts only apply to base costs, compliance costs, and staffing — not to regulatory fines or breach notification costs, which are externally imposed.
06

Read Your Results

The output gives you per-incident costs, annualized totals, a cost breakdown chart, regulatory details, and your highest-ROI capability investments.

The per-incident cost is the discounted total for one event. Annual cost multiplies by your expected incident frequency. The chart shows each cost component visually. The "Highest ROI Improvements" panel ranks your missing capabilities by discount percentage — the one at the top is where your next security dollar works hardest. Export to PDF for board or budget presentations.

The Formula in Plain English

Base cost (before discounts)

baseCost = incidentBase × orgSize × industry × dataClass

Staffing (outsourced)

staffing = Σ(role × count × roleCost × durationHours)

Regulatory exposure (data-exfil incidents)

regulatory = baseFine + min(perRecordFine × records, orgCap)

Final per-incident cost (outsourced)

(baseCost + compliance + staffing) × (1 − capDiscount) + regulatory + notification

In-house equivalent

Replace staffing with: staffing × (1 − inHouseDiscount)

capDiscount = sum of selected capability discounts, capped at 65%. Regulatory costs are never discounted — they are externally imposed.

Incident Type Reference

TypeBase CostDurationKey RolesRegulatory Exposure
Data Breach$50,00080hAnalyst ×2, Manager, ForensicYes
Ransomware$85,000120hAnalyst ×3, Forensic ×2, Recovery ×2, ManagerYes
DDoS Attack$25,00048hAnalyst, Network ×2No
Insider Threat$60,000100hAnalyst ×2, Manager, Forensic, LegalYes
Phishing Campaign$20,00040hAnalyst, ManagerNo
Supply Chain Attack$95,000180hAnalyst ×3, Manager ×2, Forensic ×2, Recovery ×2, LegalYes
Cloud Misconfiguration$35,00060hAnalyst ×2, Manager, NetworkNo
AI/ML System Attack$55,00096hAnalyst ×2, Manager, ForensicNo

Base costs before org size, industry, and data classification multipliers. Staffing costs are additional. Hourly rates: analyst $165, manager $265, forensic $325, recovery $225, network $195, legal $400.

Related Tools in the Breached.company Network

© 2026 ircost.breached.company — Part of the CyberAdX Network