toolbox
Home / AI, Data & Technology / Phishing Expected Loss Estimator

Phishing Expected Loss Estimator

The Phishing Expected Loss Estimator calculates annualized financial exposure from phishing incidents using attack frequency, success probability, loss per successful incident, and control effectiveness. It helps security, risk, and finance teams translate operational assumptions into a comparable expected-loss figure for planning and control evaluation.

The model is probabilistic: it multiplies the expected number of phishing attempts by the chance of a material success and the estimated loss severity, then reduces that exposure by the selected control effectiveness. Actual losses can be highly skewed, and a single severe event may exceed the annual estimate. Use ranges and scenario analysis, especially when incident history is limited or when loss estimates include uncertain legal, fraud, recovery, and downtime components.

Calculator inputs

attempts
%
USD
%
Result
—
Estimated annual phishing loss
Gross expected loss—
Expected loss avoided—
Expected successful incidents—

1. Estimate annual attempt volume
Count or forecast phishing attempts serious enough to enter the risk model.

2. Set success probability
Use the chance that one attempt produces a material incident under current conditions.

3. Estimate loss severity
Include the financial consequences represented by your risk scope, such as fraud, response, downtime, and recovery.

4. Apply control effectiveness
Enter the modeled percentage reduction from training, filtering, authentication, monitoring, and response controls.

5. Review net and gross exposure
Compare the controlled estimate with gross expected loss to understand modeled risk reduction.

Annual expected loss = Attempts × Success probability × Loss per success × (1 − Control effectiveness)

Variables: Use the values and units entered above. Percentages are converted to decimals in the calculation.

What the result means

The result is the probability-weighted average annual loss under the selected assumptions.

Expected loss is not a maximum-loss estimate and should be considered alongside severe but less frequent scenarios.

Given:
• 200 material attempts per year
• 1.5% success probability
• $90,000 loss per successful incident
• 40% control effectiveness

Calculation:
Expected incidents = 200 × 1.5% = 3
Gross expected loss = 3 × $90,000 = $270,000
Net expected loss = $270,000 × 60% = $162,000

Result:
Estimated annual phishing loss is $162,000, with $108,000 of expected loss avoided by the modeled controls.

What counts as a material phishing attempt?

Define a threshold relevant to your organization, such as attempts reaching employees, bypassing filters, or targeting financial processes.

How can I estimate success probability?

Use internal simulations, incident history, control testing, or a documented scenario assumption.

Should loss include downtime?

Include it if downtime falls within your chosen loss scope, but avoid counting the same cost again in another input or model.

Can expected incidents be a fraction?

Yes. A fractional result represents a long-run probability-weighted frequency, not a claim that part of an incident will occur.

Is control effectiveness the same as control coverage?

No. Coverage measures deployment reach; effectiveness measures modeled risk reduction. Coverage may be one factor in estimating effectiveness.