Skip to content
VITI Security
Contact

Ransomware response

Ransomware Incident Cost Calculator

Model the full cost of a ransomware incident - downtime, recovery effort, forensics, and the ransom question.

Where the cost actually is

The ransom is the headline, but it is rarely the whole bill. A ransomware incident costs you in four places:

  1. Downtime: the revenue you lose while systems are down, usually the largest line.
  2. Recovery effort: reimaging machines, resetting credentials and checking everything before it goes back online.
  3. Incident response and forensics: finding how they got in, what they took, and making sure they are out.
  4. The ransom, if you are considering paying.

For scale, Sophos' State of Ransomware 2026 reports a median ransom payment of US$769,000 and an average recovery cost of US$1.7 million, excluding any ransom. These are survey figures, not predictions for your business.

Should you pay?

The FBI does not support paying a ransom: payment does not guarantee you get your data back, and it funds further attacks. Paying can also carry sanctions risk; the US Treasury's OFAC warns that facilitating payments to sanctioned parties can breach US sanctions. Whatever you decide, involve counsel and your insurer early.

The control that changes the numbers most

Tested, isolated backups. If attackers cannot reach or encrypt them, and you know you can restore from them, downtime shrinks and paying stops being the only way back. The calculator above shows the difference: it assumes tested, isolated backups halve your downtime, and shows both cases.

  • Keep at least one backup copy offline or immutable.
  • Test a full restore, not just a file, on a schedule.
  • Protect backup credentials separately from your main admin accounts.
  • Know your restore order: which systems the business needs back first.

See incident response, the first 24 hours of ransomware recovery and the cyber insurance estimator.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

  1. Downtime loss = revenue per day x downtime days. If you have tested, isolated backups, the tool halves the downtime days first; a second line shows the other case for comparison.
  2. Recovery effort = employees x 8 hours x US$50 an hour (reimaging, credential resets, checks).
  3. Incident response and forensics = the midpoint of a US$50,000-300,000 band, which is US$175,000.
  4. If paying is being considered, the Sophos 2026 median ransom payment (US$769,000) is added.
  5. Total = downtime + recovery effort + IR midpoint (+ ransom). Exfiltration only adds a note: notification costs and fines are not included.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Effect of tested, isolated backups
Downtime days x 0.5
Recovery effort per employee
8 hours at US$50 an hour
Incident response and forensics
US$50,000-300,000 (midpoint used in the total)

Worked example

The calculator run on its default inputs:

Revenue per day
US$50,000
Expected downtime (days)
7 days
Employees
100
Is paying the ransom being considered?
No
Do you have tested, isolated backups?
No
Was data exfiltrated (double extortion)?
No

Estimated ransomware incident cost

US$565k

Downtime loss (7.0 effective days × US$50,000)
US$350,000
With tested backups, downtime alone could drop to
US$175,000
Recovery effort (~8 hrs × 100 employees)
US$40,000
Incident response & forensics
US$50,000-US$300k (midpoint US$175,000)
Estimated total
US$565,000

With the defaults (US$50,000 revenue a day, 7 days down, 100 employees, no tested backups, ransom not considered): downtime is 7 x US$50,000 = US$350,000, recovery effort 100 x 8 x US$50 = US$40,000, and IR the US$175,000 midpoint, for a total of US$565,000. The comparison line shows tested backups would cut the downtime loss to US$175,000.

Sources

Industry estimates (not law)

Sources last checked September 2026.

Limitations

The model leaves out breach notification, regulatory fines, lost customers, insurance recoveries and the chance that restoring takes longer than the downtime you enter. The IR band and recovery hours are planning figures; your incident-response retainer or insurer panel sets the real rates. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.