Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
Residual annual exposure (after controls)
$667,875
Gross exposure (no controls)
$1,027,500
Malicious insider share
$487,500
Negligent insider share
$540,000
Loss avoided by existing controls
$359,625
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter total employees + contractors with system access.
- 2Enter malicious incidents per 1,000 employees/year.
- 3Enter avg cost per malicious incident.
- 4Enter negligent incidents per 1,000 employees/year.
- 5Enter avg cost per negligent incident.
- 6Enter existing control effectiveness (dlp, pam, offboarding).
- 7Read your residual annual exposure (after controls) on the right — it updates as you type.
- 8Hit Share to keep the scenario or send it to someone.
About this calculator
Insider threats split into two very different categories with different economics: malicious insiders (data theft, sabotage, fraud) are rarer but more expensive per incident, while negligent insiders (misconfigured sharing, lost devices, falling for social engineering) are far more common but usually cheaper to remediate. Ponemon Institute research on insider threat cost puts average per-incident cost around $150,000-$700,000 depending on whether it's negligent, malicious, or credential-theft-based, with total annual cost scaling by headcount since larger organizations simply have more people who can create an incident. This calculator applies separate incident rates and average costs to malicious and negligent categories based on your headcount, then layers in a reduction factor for controls you already have (DLP, privileged access management, offboarding automation, background checks) to estimate your residual annual exposure versus the unmitigated baseline.
Worked example
Using the values the calculator loads with:
Inputs
- Total employees + contractors with system access: 300
- Malicious incidents per 1,000 employees/year: 2.5
- Avg cost per malicious incident: 650000
- Negligent incidents per 1,000 employees/year: 12
- Avg cost per negligent incident: 150000
- Existing control effectiveness (DLP, PAM, offboarding): 35
Results
- Residual annual exposure (after controls): $667,875
- Gross exposure (no controls): $1,027,500
- Malicious insider share: $487,500
- Negligent insider share: $540,000
- Loss avoided by existing controls: $359,625
What each field means
Inputs
- Total employees + contractors with system access
- The total employees + contractors with system access used in the calculation. Starts at 300 so you have a working example on load.
- Malicious incidents per 1,000 employees/year
- The malicious incidents per 1,000 employees/year used in the calculation. Starts at 2.5 so you have a working example on load. Accepted range: 0–50.
- Avg cost per malicious incident
- The avg cost per malicious incident used in the calculation. Starts at 650000 so you have a working example on load.
- Negligent incidents per 1,000 employees/year
- The negligent incidents per 1,000 employees/year used in the calculation. Starts at 12 so you have a working example on load. Accepted range: 0–200.
- Avg cost per negligent incident
- The avg cost per negligent incident used in the calculation. Starts at 150000 so you have a working example on load.
- Existing control effectiveness (DLP, PAM, offboarding)
- The existing control effectiveness (dlp, pam, offboarding) used in the calculation. Starts at 35 so you have a working example on load. Accepted range: 0–100.
Results
- Residual annual exposure (after controls)
- Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Gross exposure (no controls)
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Malicious insider share
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Negligent insider share
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Loss avoided by existing controls
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
Why is malicious insider cost so much higher per incident than negligent?
Malicious insiders often have legitimate access and know exactly what's valuable and how to exfiltrate it while avoiding detection, leading to larger data volumes stolen, longer dwell time, and more complex forensic investigation and legal response. Negligent incidents (a misdirected email, an unencrypted lost laptop) are usually contained faster and involve less deliberate evasion.
What controls actually move the effectiveness number?
Privileged access management with just-in-time access requests, data loss prevention tooling on egress points (email, USB, cloud storage), automated and audited offboarding that revokes access same-day, and user behavior analytics that flags anomalous data access patterns are the highest-impact controls, each contributing roughly 10-20 percentage points of effectiveness when implemented well.
Does background checking reduce malicious insider risk?
It helps for candidates with a documented history of theft or fraud, but most malicious insider incidents involve people who had no prior red flags and became a risk after a triggering event like financial distress, a bad performance review, or a resignation, so behavioral monitoring during employment matters more than pre-hire screening alone.
How does offboarding speed affect exposure?
Access that isn't revoked within hours of termination is one of the most common root causes in insider incident case studies, since a departing employee (or someone using their still-active credentials) has a clear window to exfiltrate data or cause damage with intent to harm the company or benefit a new employer.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
Annualized Loss Expectancy (ALE) Calculator
Turn asset value, exposure, and threat frequency into a yearly risk dollar figure.
Vendor Risk Exposure Calculator
Score and dollar-weight vendor risk from data access, criticality, and control maturity.
Key Rotation Downtime Cost Calculator
Estimate the cost of scheduled key/certificate rotation across your service fleet.
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). Insider Threat Exposure Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/insider-threat-exposure
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/insider-threat-exposure" target="_blank" rel="noopener">Insider Threat Exposure Calculator — RevenueLab</a> (2026).</p>
Source: [Insider Threat Exposure Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/insider-threat-exposure) (2026).