Cybersecurity ROI Calculator
Estimate expected financial ROI from a cybersecurity investment.
Last updated: October 15, 2026
Estimated first-year cybersecurity ROI
—
- Expected annual loss before controls: —
- Expected loss avoided: —
- First-year program cost: —
- Expected net benefit: —
On this page
Quick summary: Estimate expected financial ROI from a cybersecurity investment.
Read the complete guide
Updated reference sections in this guide are in English.
What this calculator estimates
Estimate expected financial ROI from a cybersecurity investment.
How to use it
Enter Annual probability of a significant incident (%); Estimated financial loss per incident ($); Expected risk reduction from investment (%); Annual cybersecurity program cost ($); One-time implementation cost ($). Select Calculate to update the results.
How the calculation works
Expected annual loss is incident probability times loss severity; the selected risk reduction produces expected avoided loss, compared with program cost.
Worked example: starting scenario
| Annual probability of a significant incident (%) | 20 |
|---|---|
| Estimated financial loss per incident ($) | 500000 |
| Expected risk reduction from investment (%) | 60 |
| Annual cybersecurity program cost ($) | 75000 |
| One-time implementation cost ($) | 25000 |
| Estimated first-year cybersecurity ROI | -40% |
|---|---|
| Expected annual loss before controls | $100,000.00 |
| Expected loss avoided | $60,000.00 |
| First-year program cost | $100,000.00 |
| Expected net benefit | -$40,000.00 |
Important limitations
Cyber risk is uncertain and correlated. Regulatory, reputational, operational and catastrophic losses may exceed entered values.
ROI is undefined when the total modeled cost is zero. The associated cash-flow amounts can still be calculated; an undefined return percentage is not a zero-percent return.