How much would a cyber attack cost your company?

1. Annual gross margin = turnover × margin %. It is what your company earns before overheads, and what it really loses when it cannot operate, because fixed costs (payroll, rent) keep running even when everything has stopped.
2. Share dependent on IT. Not all of a business stops when the computers stop: an online shop comes to a complete halt, a clinic loses its appointments and billing, a workshop can carry on repairing but cannot invoice or order parts. That is why this percentage can be edited: adjust it to your situation.
3. Loss per day of downtime = the above spread over the working days in the year. This is the key figure: what each day with your systems held hostage costs you.
4. Total downtime loss = that daily figure × the days of downtime. The default 4.41 days is the statistical average insurers use for ransomware; some recover in two days and others take weeks.
5. Technical costs: investigating how the attackers got in, cleaning the systems and restoring data is done by specialists and paid for separately from the downtime. The default value (€35,000) is a market benchmark; in real insurers' reports we have seen higher figures for large companies.

The preloaded values are statistical averages from specialist insurers' risk reports: they help size the risk, not assess a loss. Change them freely — the result updates instantly — and compare the total with the real average cost per incident in Spain: €16,300 for SMEs with up to 49 employees and €22,950 for those with 50 to 249.