SOCLYDE logo
Current languageEN
Free local awareness tool

What could a cyberattack cost your small business?

Answer 9 questions to compare three scenarios. Your answers stay in your browser.

  • 09guided questions
  • 03scenarios compared
  • 100%local calculation

An estimate of cyberattack costs for a small business can combine five indicative categories: revenue theoretically exposed during downtime, staff time affected, IT restoration, potential administrative or legal costs, and potential commercial impact. Exposed revenue is not net loss. The result depends on your assumptions; it is neither an observed average nor a prediction.

The values shown are examples. Keep them or replace them with your estimates; rough figures are fine.

Question 1 of 911%

Annual revenue (€)

Calculation runs locally in your browser. Your inputs are not sent to a server and no account is required.

What costs can a cyberattack create for a small business?

What the calculator includes

Revenue exposed during downtime
Estimated from annual revenue, downtime, and dependence on digital tools; this is not net loss.
Staff time affected
Based on the number of people affected, downtime and disrupted recovery time, and the cost per work hour to the business.
IT restoration
Varies with the situation modelled and backup quality; this indicative amount is not a quote.
Potential administrative or legal costs
Adjusted for whether personal data is involved and the situation modelled; the calculator does not estimate a fine.
Potential commercial impact
A modelling assumption adjusted for digital dependence, personal data, and the situation modelled.

Example using the prefilled values

With the assumptions shown when the tool opens, the reference scenario is €12,394; its lower-to-higher variation is €8,181–€16,606. This is an example produced by the model, not a market average, prediction, or net loss.

Assumptions: €300,000 annual revenue, 5 people affected, 8 hours of downtime, medium dependence on digital tools, €35 hourly business cost, backups available but not all tested, 16 hours per person to return to normal work after systems are restored, personal data involved, and ransomware.

Cybermalveillance.gouv.fr describes possible consequences for small businesses (in French). For personal data, the CNIL explains that required steps depend on the risk to people.

In its 2025 survey of 588 French businesses with fewer than 250 employees, Cybermalveillance.gouv.fr reports that 58% could not assess the consequences of a cyberattack. Read the 2025 cybersecurity maturity barometer for small businesses (in French).

How should you read the three levels?

The calculator applies a modelling factor to your assumptions. These levels help compare amounts; they are not probabilities or predictions of a real incident.

  1. 01

    Lower-cost scenario

    Factor 0.55: a modelled cost below the reference level.

  2. 02

    Reference scenario

    Factor 1: the reference level for the assumptions you entered.

  3. 03

    Higher-cost scenario

    Factor 2.1: a modelled cost above the reference level to explore a greater impact.

Cyberattack cost calculator: frequently asked questions

Is this the actual cost of a cyberattack?

No. It compares scenarios using your assumptions and indicative factors. Actual costs depend on the incident, your business and recovery measures.

Does the calculator estimate a fine or compensation?

No. It does not calculate fines, penalties or compensation. Duties after a personal data breach depend on the circumstances; consult the CNIL’s guidance.

Are my answers sent to Soclyde?

No. The calculation runs in your browser and the answers you enter are not sent to a server.

Method and sources

These sources describe possible cyberattack consequences; they do not validate the calculator’s amounts. Its amounts, factors, and variations are indicative assumptions specific to this model.

Soclyde resources