Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
Net expected value of engagement
-$10,000
Expected loss avoided
$70,000
Total program cost (engagement + remediation)
$80,000
Expected ROI
-13%
Red team engagement cost
$65,000
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter red team engagement cost.
- 2Enter probability of finding ≥1 exploitable critical gap (%).
- 3Enter probability that gap gets exploited before next assessment (%).
- 4Enter avg cost of resulting incident if exploited.
- 5Enter estimated remediation cost for findings.
- 6Read your net expected value of engagement on the right — it updates as you type.
- 7Hit Share to keep the scenario or send it to someone.
About this calculator
Red team exercises cost more than a standard penetration test because they simulate a real adversary's full attack chain (initial access, persistence, lateral movement, objective completion) over days or weeks rather than checking a scoped list of vulnerabilities, and that broader scope is exactly what surfaces the gaps a pen test misses, like detection and response failures, not just exploitable bugs. This calculator estimates ROI by assuming a red team engagement has a meaningful chance of finding at least one critical, previously-unknown gap (a detection blind spot, a privilege escalation path, an unmonitored admin account) whose remediation prevents an incident of a given estimated cost, weighted by the probability that gap would otherwise have been exploited before your next assessment cycle. It's a probabilistic estimate meant to frame budget conversations, not a guarantee, since the actual value of any single engagement depends heavily on scope, adversary emulation quality, and whether findings are actually remediated afterward.
Worked example
Using the values the calculator loads with:
Inputs
- Red team engagement cost: 65000
- Probability of finding ≥1 exploitable critical gap (%): 70
- Probability that gap gets exploited before next assessment (%): 20
- Avg cost of resulting incident if exploited: 500000
- Estimated remediation cost for findings: 15000
Results
- Net expected value of engagement: -$10,000
- Expected loss avoided: $70,000
- Total program cost (engagement + remediation): $80,000
- Expected ROI: -13%
- Red team engagement cost: $65,000
What each field means
Inputs
- Red team engagement cost
- The red team engagement cost used in the calculation. Starts at 65000 so you have a working example on load.
- Probability of finding ≥1 exploitable critical gap (%)
- The probability of finding ≥1 exploitable critical gap (%) used in the calculation. Starts at 70 so you have a working example on load. Accepted range: 0–100.
- Probability that gap gets exploited before next assessment (%)
- The probability that gap gets exploited before next assessment (%) used in the calculation. Starts at 20 so you have a working example on load. Accepted range: 0–100.
- Avg cost of resulting incident if exploited
- The avg cost of resulting incident if exploited used in the calculation. Starts at 500000 so you have a working example on load.
- Estimated remediation cost for findings
- The estimated remediation cost for findings used in the calculation. Starts at 15000 so you have a working example on load.
Results
- Net expected value of engagement
- Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Expected loss avoided
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Total program cost (engagement + remediation)
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Expected ROI
- Returned as a percentage. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Red team engagement cost
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
How is a red team different from a penetration test for ROI purposes?
A pen test checks a defined scope against known vulnerability classes and reports findings in days, which is cheaper and good for compliance checkboxes, while a red team emulates a specific adversary's full kill chain over a longer window specifically to test whether your detection and response team actually catches and stops a realistic attack, which is where the higher cost and higher potential value both come from.
What probability of finding a critical gap is realistic?
For most organizations that haven't had a red team exercise in the past 1-2 years, 60-80% is a defensible range, since red teams specifically hunt for the gaps automated scanning and standard pen tests miss; mature organizations with frequent purple-team exercises and strong detection engineering should expect a lower rate simply because they've already closed the easy gaps.
Why does this model discount for 'probability it would've been exploited'?
Not every exploitable gap a red team finds would actually get found and used by a real attacker before your next assessment cycle catches and fixes it independently, so multiplying by this probability avoids overstating the exercise's value as if every finding represented a certain future breach.
Does the ROI number account for compliance value?
No, this only models direct incident-cost avoidance. Many organizations also need red team or adversary emulation exercises for cyber insurance requirements, PCI DSS penetration testing requirements, or customer security questionnaires, which carries independent value not captured in this financial ROI figure.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
Pen Test vs. Bug Bounty Cost Calculator
Compare annual cost and expected coverage of scheduled pen tests vs. an ongoing bounty program.
MTTD/MTTR Cost Impact Calculator
See how faster detection and response times translate into dollars saved.
Incident Response Retainer Value Calculator
Compare a pre-paid IR retainer against emergency hourly rates during a real breach.
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). Red Team Exercise ROI Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/red-team-exercise-roi
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/red-team-exercise-roi" target="_blank" rel="noopener">Red Team Exercise ROI Calculator — RevenueLab</a> (2026).</p>
Source: [Red Team Exercise ROI Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/red-team-exercise-roi) (2026).