What methodology does the Cyber Risk Calculator use?

The calculator is based on the IBM Cost of a Data Breach Report, the most widely cited annual study on breach costs. It models your exposure as a function of security domain coverage scores and your industry vertical multiplier.

What are the 7 security domains scored?

Identity and access management, endpoint security, network security, data protection, application security, cloud security, and incident response readiness. Each is scored 1 to 5 and weighted in the composite risk score.

How is breach cost estimated?

The calculator multiplies your composite risk score by an industry-specific average breach cost derived from IBM research. A perfect score of 100 minimizes exposure. A score near 0 represents full average industry breach cost with no mitigating controls.

How do I use the results to prioritize security spending?

Focus first on domains with the lowest coverage scores. Improving a domain from 1 to 3 reduces exposure more than going from 4 to 5. The gap analysis shows exactly where investment has the highest impact.

How accurate are the breach cost estimates?

Estimates reflect statistical averages from IBM research across thousands of real breaches. Actual costs vary based on detection time, containment speed, and regulatory environment. Use the output as an order-of-magnitude estimate for prioritization, not an exact figure.

Cyber Risk Calculator

Score 7 security domains and estimate your breach cost using IBM Cost of a Data Breach methodology. Free, no account required.

More free tools

Professional-grade tools for SaaS decision makers.

LLM API Pricing Calculator

Compare API costs across 100+ models from OpenAI, Anthropic, Google and more.

Tech Stack Builder

Build your SaaS stack from 45 categories and get a full cost and integration analysis.

Vendor Lock-In Checker

Score vendor lock-in risk across 5 dimensions before signing any contract.

How to interpret your scoreSource: IBM Cost of a Data Breach 2025

75-100

Low Risk

Strong coverage. Exposure well below industry average.

40-74

Medium Risk

Gaps in 2-3 domains. Prioritize weakest areas.

0-39

High Risk

Significant exposure. Immediate investment needed.

7 Security Domains

Each domain is scored independently. Your weakest domain has the highest impact on total exposure.

Identity

Endpoint

Network

Data

Application

Cloud

Incident Response

How It Works

IBM Methodology

Based on the IBM Cost of a Data Breach Report. The gold standard for breach cost estimation used by security teams worldwide.

7 Security Domains

Identity, endpoint, network, data, application, cloud, and incident response. Score each domain independently on a 1-5 scale.

Industry Multipliers

Breach costs vary by industry. Healthcare and finance face higher regulatory penalties than retail or manufacturing.

Coverage Gap Analysis

See which domains have the lowest scores and where additional investment reduces your overall exposure most.

Free to Use

No account required. Run unlimited scenarios for any industry and team configuration.

Frequently Asked Questions

Click any question to expand the answer.