How is my cyber exposure estimated?

We model three cost components — data breach and notification costs per exposed record, lost productivity across your headcount during an average recovery period, and typical extortion and recovery spend — then reduce that worst case by the weighted value of the controls you already have in place. Figures are authored in US dollars from published breach-cost averages and converted to your selected currency.

Is the estimate a formal risk assessment?

No. It is an indicative model designed to show where your largest gaps sit and roughly what they are worth. A formal assessment reviews your actual identity, endpoint, backup and network configuration, and produces evidence you can give to insurers, auditors and boards.

Which controls make the biggest difference?

Tested offsite immutable backups, multi-factor authentication on email and remote access, and monitored endpoint detection and response carry the greatest weighting. Together they blunt the overwhelming majority of incidents we are called into.

Do you store what I enter?

No. The calculation runs entirely in your browser and nothing is transmitted until you choose to request a written exposure report from our team.

Free tool

What would one serious cyber incident actually cost you?

Most Australian businesses underestimate an incident by an order of magnitude, because they count the ransom and forget the fortnight of lost productivity, the forensic bill and the notification obligations. Score eight controls and see the number in your own currency.

Free assessment

Cyber exposure estimator

Answer eight questions about the controls you have in place and we will model your indicative financial exposure to a serious incident — data breach costs, downtime and extortion — in AUD. Nothing is sent anywhere until you ask for the report.

Staff / users

Customer records held

Industry

Which controls are fully in place today?Multi-factor authentication on email and remote accessOperating systems and applications patched within 14 daysOffsite, immutable backups tested in the last 3 monthsMonitored endpoint detection and response (not just antivirus)Administrator privileges restricted and reviewedStaff phishing training and simulations in the last 12 monthsWritten, tested incident response planSPF, DKIM and DMARC enforced on your domain

Estimated exposure to one serious incident

$680,850

AUD, converted from a USD model. Unmitigated worst case $680,850.

Control maturity: 0% · High risk
Risk already avoided: $0
Downtime component: $91,350
Data & notification: $504,750

8 gaps driving your exposure

· Multi-factor authentication on email and remote access
· Operating systems and applications patched within 14 days
· Offsite, immutable backups tested in the last 3 months
· Monitored endpoint detection and response (not just antivirus)

Get my exposure report Score Essential Eight

Indicative only. Modelled on published breach-cost averages (approx. USD 165 per exposed record, 55 per user hour of downtime) and is not a substitute for a formal risk assessment or insurance advice.

About this estimator

How is my cyber exposure estimated?: We model three cost components — data breach and notification costs per exposed record, lost productivity across your headcount during an average recovery period, and typical extortion and recovery spend — then reduce that worst case by the weighted value of the controls you already have in place. Figures are authored in US dollars from published breach-cost averages and converted to your selected currency.
Is the estimate a formal risk assessment?: No. It is an indicative model designed to show where your largest gaps sit and roughly what they are worth. A formal assessment reviews your actual identity, endpoint, backup and network configuration, and produces evidence you can give to insurers, auditors and boards.
Which controls make the biggest difference?: Tested offsite immutable backups, multi-factor authentication on email and remote access, and monitored endpoint detection and response carry the greatest weighting. Together they blunt the overwhelming majority of incidents we are called into.
Do you store what I enter?: No. The calculation runs entirely in your browser and nothing is transmitted until you choose to request a written exposure report from our team.

Score your Essential Eight maturity Cyber security services Downtime cost calculator

Let's scope your next project

Tell us what you are trying to fix or grow. You will speak with an engineer, not a salesperson, and leave the call with a clear view of scope, timeline and cost.