WithSecure Breach Cost Calculator
A plain, cited estimate of what a data breach could cost a business of 20 to 500 people, built from the latest published research and your own numbers.
Calculator
Breach cost vs cost to secure
| Year | Cost to secure, cumulative | One breach (estimate) |
|---|
Amounts in USD, with PHP equivalents at USD 1 = PHP 63.81 (open.er-api.com mid-market rate, 30 Oct 2026). Planning estimate only, not a quote or a guarantee.
What lowered breach costs in IBM's 2026 study
IBM tested 30 factors against the USD 4.99 million global average. A few that a business without a full-time security team can act on:
- Endpoint detection and response: about USD 177,710 lower on average. WithSecure Elements Endpoint Security includes EDR.
- A managed security service: about USD 152,929 lower, with faster identification and containment than the average. WithSecure Co-Monitoring and MDR, delivered with ARA Industries, cover this.
- Employee training: about USD 196,259 lower.
- Extensive security AI and automation: USD 1.93 million lower and 65 days faster, though only 36% of breached organisations used it extensively.
Speed matters too: breaches that took more than 200 days to identify and contain averaged USD 5.65 million, against USD 4.32 million for those under 200 days.
39% of breached organisations in the study reported a ransomware incident. Want to see how one unfolds? Walk through a ransomware attack, stage by stage.
How the estimate works
- Records. Customer records are priced at IBM's 2026 average of USD 192 per customer PII record, and employees at USD 188 per employee PII record. IBM publishes these per-record costs across all industries, but not per industry, so ARA Industries adjusts them by your industry's IBM 2026 average breach cost divided by the USD 4.99 million global average (for example, healthcare 6.64 ÷ 4.99 = 1.33×, retail 3.80 ÷ 4.99 = 0.76×). This adjustment is our assumption, not an IBM figure. IBM warns against applying per-record costs outside the 2,590 to 115,380 record range it studied, so the calculator tells you when your inputs fall outside it.
- Downtime. Days of disruption times the daily revenue you enter. No industry assumption is added.
- Cost to secure. Devices times the yearly per-device price of the components you pick: WithSecure Elements EPP Premium USD 80, EDR USD 60, ARA Industries managed support USD 60. Estimated annual cost, per device. Final pricing on quote.
- Fines. If you enter last year's gross income, the NPC range is 0.5% to 3% where more than 1,000 people are affected (grave) or 0.25% to 2% otherwise (major), capped at PHP 5 million per act. A fine is not automatic. It depends on the NPC's findings.
The calculator does not guess how likely a breach is. Published likelihood figures vary too widely to apply to one business honestly.
Sources
- IBM and Ponemon Institute, Cost of a Data Breach Report 2026 (PDF), July 2026: global, ASEAN and industry averages, per-record costs, cost factors, lifecycle and ransomware figures.
- National Privacy Commission, NPC Circular No. 2022-01, Guidelines on Administrative Fines, August 2022.
- Exchange rate: open.er-api.com mid-market USD/PHP, 30 Oct 2026.
Breach cost calculator: frequently asked questions
How much does a data breach cost a small or mid-sized business?
There is no single number. IBM's 2026 Cost of a Data Breach Report puts the global average at USD 4.99 million and the ASEAN average at USD 4.12 million, but those averages come from breaches of 2,590 to 115,380 records. This calculator scales the estimate to the records you actually hold and the downtime you could face.
What are the data privacy fines in the Philippines?
Under NPC Circular 2022-01, the National Privacy Commission can impose administrative fines of 0.5% to 3% of the previous year's annual gross income for grave infractions (generally more than 1,000 affected people) and 0.25% to 2% for major infractions, capped at PHP 5 million for a single act. Criminal penalties under the Data Privacy Act (RA 10173) are separate.
Does endpoint detection and response lower breach costs?
In IBM's 2026 analysis, use of endpoint detection and response tools was associated with breach costs about USD 177,710 lower than average, and a managed security service with about USD 152,929 lower. WithSecure Elements includes EDR, and WithSecure Co-Monitoring and MDR add managed detection.
Is this a quote?
No. It is a planning estimate built from published research and your own inputs. The cost-to-secure figures are estimated annual costs per device (WithSecure Elements EPP Premium USD 80, EDR USD 60, ARA Industries managed support USD 60). Final pricing on quote.
Turn this estimate into a real plan. Usap tayo.
Book a free 30-minute call with ARA Industries, a registered WithSecure partner. Most teams start with a cyber health check so the numbers reflect your actual environment.
Calendar not loading? Open the Usap Tayo booking page.