Quantifying DDoS Risk in Dollars

The security investment conversation with a CFO requires dollar figures, not threat scores. "We have a high-severity DDoS risk" is not a budget justification. "Our expected annual loss from DDoS is $1.2M and we can reduce it to $150K for an investment of $80K" is. This post provides a practical model for computing expected annual loss from DDoS and translating it into an investment case.

The model uses four inputs: probability of a significant attack in a given year, expected duration of impact before mitigation, hourly cost of downtime, and residual risk after mitigation investment. These inputs can be estimated with enough precision for budget decisions without actuarial accuracy.

Step 1: Estimate Attack Probability

Industry data from Cloudflare and Akamai annual reports provides sector-specific attack frequency rates. Financial services organizations experience significant (greater than 1 hour impact) DDoS attacks at a rate of approximately 0.8-1.5 per year at the enterprise level. SaaS companies with payment processing: 0.5-1.0 per year. Healthcare: 0.3-0.7 per year. These are starting estimates; adjust based on your organization's specific threat profile (prior incidents, sector threat intelligence, whether you have been targeted before).

Step 2: Estimate Hourly Downtime Cost

Hourly downtime cost has two components: direct revenue loss and operational response cost. Direct revenue loss is your daily revenue divided by 24, multiplied by the proportion of revenue dependent on the attacked service. If your payment API generates 60% of daily transactions, and you generate $500K in daily transactions, your hourly revenue exposure is $500K * 0.6 / 24 = $12,500/hour. Operational response cost includes: SOC analyst time (typically $150-300/hour loaded cost), engineering response time ($200-400/hour), executive time for escalation ($500+/hour), and any SLA penalty costs. For most enterprises, total hourly cost is $10,000 to $100,000.

Step 3: Estimate Current Mitigation Duration

With no pre-configured automated mitigation, average time-to-mitigation for an L7 DDoS attack requiring manual response is 2-6 hours. With automated rate limiting and WAF rules covering the target endpoint, TTAM is 30-120 seconds. Use your current TTAM estimate (from log analysis or incident history) as the input for current expected impact duration.

Step 4: Compute Expected Annual Loss

# Expected Annual Loss calculation
P_attack = 1.0          # attacks per year (industry average, financial sector)
T_impact_current = 3.0  # hours before mitigation (current state, manual response)
C_hourly = 25000        # dollars per hour downtime cost

EAL_current = P_attack * T_impact_current * C_hourly
# = 1.0 * 3.0 * 25000 = $75,000 per year

# Post-hardening scenario
T_impact_hardened = 0.05  # hours (3 minutes automated TTAM)
EAL_hardened = P_attack * T_impact_hardened * C_hourly
# = 1.0 * 0.05 * 25000 = $1,250 per year

# Annual risk reduction = $75,000 - $1,250 = $73,750
# Investment in hardening = $15,000 (assessment + implementation)
# Payback period = $15,000 / $73,750 = 0.2 years (2.4 months)

Step 5: Adjust for Non-Financial Costs

The direct downtime cost calculation understates total DDoS risk by omitting: reputational damage (harder to quantify but real for customer-facing services), regulatory risk (DORA and NIS2 impose notification and response obligations that create legal costs and potential fines), and the breach-facilitation risk from DDoS-as-distraction attacks. For regulated industries, multiply your base EAL by 1.5-2.0 to account for regulatory exposure.