Ransomware Impact Calculator

No -- this output is a raw dollar comparison between the ransom demand and the estimated cost of full recovery, not advice to pay. The FBI and CISA both recommend against paying ransoms: there is no guarantee the attacker actually restores your data or deletes stolen copies, payment can run afoul of U.S. sanctions law depending on who receives it, and paying funds and incentivizes further attacks against you and others. Treat this figure as one input to an incident-response decision made with legal counsel and law enforcement, never as a standalone answer.

Backup Status applies a recovery-time multiplier to the entire cost total, not a flat add-on, because the absence of a clean restore point extends every other cost bucket at once: productivity loss and revenue loss both grow because downtime stretches out while systems are rebuilt from scratch instead of restored, and IT recovery work itself takes longer. The calculator models this as a 3.0x multiplier with no backups versus 1.0x with full tested backups, reflecting how backup posture compounds rather than simply adds to total exposure.

Reputation Impact is modeled here as a flat 5% of Annual Revenue, a simplified stand-in for customer churn and brand-damage costs that in reality depend heavily on industry, how publicly the breach becomes known, and how the response is handled. It is not a measured or industry-certified percentage -- use it as a rough planning placeholder and replace it with your own estimate if you have better data on customer sensitivity in your sector.

Yes. Employee Count feeds three separate outputs: it scales Productivity Loss directly (more idle staff during downtime), it scales Legal/Notification cost (a per-employee notification-cost estimate), and it can push IT Recovery Cost into a higher tier, since the calculator assumes larger organizations face proportionally bigger forensics and remediation bills. A larger headcount therefore raises Total Impact through multiple channels at once, not just one.