Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
Total downtime cost
$1,404,000
Lost revenue
$1,260,000
Idle + overtime labor cost
$144,000
Cost per day of downtime
$117,000
Downtime cost as multiple of ransom demand
5.6
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter normal daily revenue.
- 2Enter share of operations knocked offline.
- 3Enter estimated recovery time.
- 4Enter idle staff labor cost per day.
- 5Enter it/recovery overtime cost per day.
- 6Enter ransom demand (for comparison).
- 7Read your total downtime cost on the right — it updates as you type.
- 8Hit Share to keep the scenario or send it to someone.
About this calculator
The ransom demand is usually the smallest number in a ransomware incident. Downtime cost, which includes lost revenue, idle payroll, overtime for recovery staff, and rebuilding systems from backup, typically runs 5-10x the ransom itself according to Sophos and Coveware incident data. This calculator estimates daily revenue loss based on your normal daily revenue and what fraction of operations are actually knocked offline (a manufacturing plant with paper-based fallback loses less than a pure e-commerce site), adds idle and overtime labor costs, and multiplies by your estimated recovery timeline. Recovery time is the input people underestimate most: restoring from backup sounds fast until you account for rebuilding domain controllers, re-imaging endpoints, validating data integrity, and staged bring-up of interdependent systems, which routinely stretches a 'we have backups' recovery from 2 days to 3 weeks.
Worked example
Using the values the calculator loads with:
Inputs
- Normal daily revenue: 150000
- Share of operations knocked offline: 70
- Estimated recovery time: 12
- Idle staff labor cost per day: 8000
- IT/recovery overtime cost per day: 4000
- Ransom demand (for comparison): 250000
Results
- Total downtime cost: $1,404,000
- Lost revenue: $1,260,000
- Idle + overtime labor cost: $144,000
- Cost per day of downtime: $117,000
- Downtime cost as multiple of ransom demand: 5.6
What each field means
Inputs
- Normal daily revenue
- The normal daily revenue used in the calculation. Starts at 150000 so you have a working example on load.
- Share of operations knocked offline
- The share of operations knocked offline used in the calculation. Starts at 70 so you have a working example on load. Accepted range: 0–100.
- Estimated recovery time
- The estimated recovery time used in the calculation. Starts at 12 so you have a working example on load. Accepted range: 0.5–90.
- Idle staff labor cost per day
- The idle staff labor cost per day used in the calculation. Starts at 8000 so you have a working example on load.
- IT/recovery overtime cost per day
- The it/recovery overtime cost per day used in the calculation. Starts at 4000 so you have a working example on load.
- Ransom demand (for comparison)
- The ransom demand (for comparison) used in the calculation. Starts at 250000 so you have a working example on load.
Results
- Total downtime cost
- Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Lost revenue
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Idle + overtime labor cost
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Cost per day of downtime
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Downtime cost as multiple of ransom demand
- Returned as a decimal number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
Why is downtime so much worse than the ransom itself?
The ransom is a one-time payment demand, but downtime bleeds revenue, payroll, and customer trust every single day systems are down, and recovery is never instant even with good backups. Coveware and Sophos data consistently show total incident cost running 5-10x the ransom demand once you count business interruption.
How do I estimate recovery days more accurately?
Run a tabletop exercise where you actually time a restore of a representative system from backup, including validation, not just the copy job. Most organizations that haven't tested this discover their real recovery time is 3-5x longer than assumed because of dependency chains between systems.
Does paying the ransom reduce downtime?
Sometimes, but not reliably. Coveware's incident response data shows decryptors provided by attackers frequently fail to fully restore data, meaning many victims still rebuild from backup after paying, so budget recovery time as if payment won't happen even if leadership decides to pay.
What's the single best lever to reduce this number?
Tested, immutable, offline backups with a known and rehearsed restore procedure. Every other control (EDR, segmentation, MFA) reduces the chance of the event; backups are what determine how many days the recovery-days input actually is.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
Annualized Loss Expectancy (ALE) Calculator
Turn asset value, exposure, and threat frequency into a yearly risk dollar figure.
Backup RPO/RTO Data Loss Cost Calculator
Translate your recovery point and recovery time objectives into a dollar exposure.
SOC Staffing Coverage Calculator
Figure out how many analysts you need for 24/7 or business-hours coverage.
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). Ransomware Downtime Cost Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/ransomware-downtime-cost
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/ransomware-downtime-cost" target="_blank" rel="noopener">Ransomware Downtime Cost Calculator — RevenueLab</a> (2026).</p>
Source: [Ransomware Downtime Cost Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/ransomware-downtime-cost) (2026).