DDoS Mitigation Cost vs. Downtime Calculator — Rex's Toolbox

Rex says

Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.

Try a scenario

Click to load — tweak from there.

Inputs

Expected damaging attacks per year

Average outage minutes per unmitigated attack

Revenue at risk per minute of downtime

Paid mitigation effectiveness (% of downtime prevented)

Annual mitigation service cost

Avg SLA/reputation penalty per incident

Result

Net annual benefit of mitigation

$161,400

Expected annual loss without mitigation

$246,000

Total cost with mitigation (loss + fee)

$84,600

Residual loss with mitigation

$24,600

Attacks/year to break even on cost

1.6

Psst — share this and help Rex grow

One click, a permanent link with your numbers baked in.

More financial

How to use this

1Enter expected damaging attacks per year.
2Enter average outage minutes per unmitigated attack.
3Enter revenue at risk per minute of downtime.
4Enter paid mitigation effectiveness (% of downtime prevented).
5Enter annual mitigation service cost.
6Enter avg sla/reputation penalty per incident.
7Read your net annual benefit of mitigation on the right — it updates as you type.
8Hit Share to keep the scenario or send it to someone.

About this calculator

DDoS mitigation is one of the easier security ROI cases to build because both sides of the ledger are concrete: a scrubbing service or CDN-based mitigation plan has a known annual fee, and an unmitigated attack has a measurable revenue-per-minute cost. This calculator takes your expected attack frequency per year, the average outage duration you'd suffer without mitigation, and your revenue-per-minute rate, then compares expected annual loss to the cost of a mitigation contract. Most volumetric attacks today exceed 1 Tbps at the high end and even mid-size e-commerce or SaaS sites see multiple attempted attacks per month, though only a fraction cause real downtime without protection. The model also accounts for partial mitigation effectiveness, since even paid services rarely stop 100% of sophisticated multi-vector attacks, and for the reputational/SLA-penalty cost that's easy to omit but real for B2B SaaS with uptime guarantees in customer contracts.

FormulaUnmitigated annual loss = attacks/year × avg outage minutes × revenue per minute × (1 − baseline mitigation %). Net benefit = unmitigated loss − (loss with paid mitigation + mitigation cost).

Worked example

Using the values the calculator loads with:

Inputs

Expected damaging attacks per year: 6
Average outage minutes per unmitigated attack: 90
Revenue at risk per minute of downtime: 400
Paid mitigation effectiveness (% of downtime prevented): 90
Annual mitigation service cost: 60000
Avg SLA/reputation penalty per incident: 5000

Results

Net annual benefit of mitigation: $161,400
Expected annual loss without mitigation: $246,000
Total cost with mitigation (loss + fee): $84,600
Residual loss with mitigation: $24,600
Attacks/year to break even on cost: 1.6

What each field means

Inputs

Expected damaging attacks per year: The expected damaging attacks per year used in the calculation. Starts at 6 so you have a working example on load. Accepted range: 0–200.
Average outage minutes per unmitigated attack: The average outage minutes per unmitigated attack used in the calculation. Starts at 90 so you have a working example on load. Accepted range: 1–2000.
Revenue at risk per minute of downtime: The revenue at risk per minute of downtime used in the calculation. Starts at 400 so you have a working example on load.
Paid mitigation effectiveness (% of downtime prevented): The paid mitigation effectiveness (% of downtime prevented) used in the calculation. Starts at 90 so you have a working example on load. Accepted range: 0–100.
Annual mitigation service cost: The annual mitigation service cost used in the calculation. Starts at 60000 so you have a working example on load.
Avg SLA/reputation penalty per incident: The avg sla/reputation penalty per incident used in the calculation. Starts at 5000 so you have a working example on load.

Results

Net annual benefit of mitigation: Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
Expected annual loss without mitigation: Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
Total cost with mitigation (loss + fee): Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
Residual loss with mitigation: Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
Attacks/year to break even on cost: Returned as a decimal number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.

FAQ

How many DDoS attacks should I assume per year?

Internet-facing services with any public profile see attempted attacks constantly, but damaging ones (that actually cause outage without protection) are more useful to estimate from your own logs or your ISP/host's abuse reports. Six to twelve per year is a reasonable starting assumption for a mid-size site with no existing mitigation; adjust up for gaming, crypto, or politically exposed targets.

Is 90% mitigation effectiveness realistic?

For well-configured commercial scrubbing services against common volumetric and protocol attacks, yes, 90%+ is typical. Effectiveness drops for sophisticated application-layer (Layer 7) attacks that mimic real user traffic, which is why layered defense including rate limiting and WAF rules still matters even with a paid mitigation contract.

What's missing from this model?

Customer churn from a bad outage, which compounds beyond the immediate revenue loss, and the cost of your own engineering time spent responding versus building product. Add a churn estimate manually if a past outage caused measurable customer loss.

Does a CDN alone count as DDoS mitigation?

Partially. A CDN absorbs a meaningful share of volumetric traffic simply by distributing load across edge nodes, but dedicated DDoS mitigation adds traffic scrubbing, anomaly detection, and always-on or on-demand routing specifically tuned for attack patterns, which a general-purpose CDN doesn't guarantee.

Accuracy and limitations

Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.

Related tools

Ransomware Downtime Cost Calculator

Model lost revenue, labor, and recovery cost for each day systems are down.

MTTD/MTTR Cost Impact Calculator

See how faster detection and response times translate into dollars saved.

Third-Party SaaS Sprawl Risk Cost Calculator

Estimate exposure and cleanup cost from unmanaged, unreviewed SaaS applications.

Cite this calculator

Writing about this topic? Grab a citation — every link helps keep these tools free.

APA

RevenueLab. (2026). DDoS Mitigation Cost Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/ddos-mitigation-cost

HTML

<p>Source: <a href="https://www.revenuelab.fyi/toolbox/ddos-mitigation-cost" target="_blank" rel="noopener">DDoS Mitigation Cost Calculator — RevenueLab</a> (2026).</p>

Markdown

Source: [DDoS Mitigation Cost Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/ddos-mitigation-cost) (2026).