How do you calculate OT downtime cyber loss?

Multiply OT downtime hours by the production loss per hour, then by the affected production scope as a fraction, and add the fixed recovery cost. With 16 hours, $18,500/hr, 60% scope and $35,000 fixed, the variable loss is $177,600 and the total is $212,600.

Why multiply by affected OT production scope?

A cyber event seldom halts the whole plant — segmentation, redundancy, or partial automation often means only part of capacity stops. The 60% scope here scales the $18,500/hr full-rate loss down to an effective $11,100/hr, so the calculator avoids overstating the hit.

What counts as fixed cyber recovery and response cost?

One-time costs independent of outage length: incident response retainer, forensic investigation, controller reimaging, credential resets, and verification before restart. In the example that fixed component is $35,000 of the $212,600 total.

Is this the same as a ransomware exposure estimate?

No. This focuses on production loss from downtime hours; a ransomware exposure model centers on per-system recovery cost across affected assets. Use both — downtime loss for the operational hit, ransomware exposure for the recovery effort.

What is a good way to estimate production loss per hour?

Use lost contribution margin (price minus variable cost) per hour at full rate, not revenue, so you do not double-count materials you never consumed. Pull it from a normal-shift output rate times unit margin.

How can I reduce the modeled loss?

Lowering affected scope through OT network segmentation, faster restart via tested backups, and a pre-negotiated IR retainer all move the number down. Cutting scope from 60% to 30% would roughly halve the $177,600 variable loss.

Industrial Cybersecurity & OT Risk calculator

OT Downtime Cyber Loss Calculator

OT Downtime Cyber Loss quantifies the dollar impact when a cyber incident stops or degrades operational technology on the plant floor — PLCs, SCADA, DCS, or line controllers that drive physical production. Plant managers, OT security leads, and risk/insurance teams use it to translate an outage scenario into a defensible loss figure for budgeting controls, sizing cyber insurance, and prioritizing segmentation projects. It matters because OT downtime rarely affects 100% of capacity at once, so a credible estimate must blend hourly lost margin, the affected production scope, and the fixed cost of forensics, rebuild, and recovery. The result is a single number you can put in a risk register or a board slide.

What this calculator does

Estimate financial loss from an OT cyber downtime scenario using downtime hours, cost per hour, affected scope, and fixed recovery costs.
Use it when a plant needs a defensible downtime exposure number for OT security planning, risk reviews, or resilience investment.
It computes the total financial loss of a cyber-induced OT outage by combining scoped variable production loss with fixed recovery and response cost.

Formula used

Variable OT downtime cyber loss = OT downtime hours × production loss per downtime hour × affected OT production scope
Total OT downtime cyber loss = variable OT downtime cyber loss + fixed cyber recovery and response cost

Inputs explained

OT downtime hours from the cyber event:
Production margin lost per hour of OT downtime:
Share of OT production scope affected:
Fixed cyber recovery and incident response cost:

How to use the result

Use it when scoping a ransomware or OT compromise scenario, justifying segmentation/backup spend, or sizing cyber insurance limits and retentions.
It models one outage scenario at a fixed hourly rate and scope; it does not capture ramp-up losses after restart, spoiled work-in-process, contractual penalties, or brand and safety consequences.

Common questions

How do you calculate OT downtime cyber loss? Multiply OT downtime hours by the production loss per hour, then by the affected production scope as a fraction, and add the fixed recovery cost. With 16 hours, $18,500/hr, 60% scope and $35,000 fixed, the variable loss is $177,600 and the total is $212,600.
Why multiply by affected OT production scope? A cyber event seldom halts the whole plant — segmentation, redundancy, or partial automation often means only part of capacity stops. The 60% scope here scales the $18,500/hr full-rate loss down to an effective $11,100/hr, so the calculator avoids overstating the hit.
What counts as fixed cyber recovery and response cost? One-time costs independent of outage length: incident response retainer, forensic investigation, controller reimaging, credential resets, and verification before restart. In the example that fixed component is $35,000 of the $212,600 total.
Is this the same as a ransomware exposure estimate? No. This focuses on production loss from downtime hours; a ransomware exposure model centers on per-system recovery cost across affected assets. Use both — downtime loss for the operational hit, ransomware exposure for the recovery effort.
What is a good way to estimate production loss per hour? Use lost contribution margin (price minus variable cost) per hour at full rate, not revenue, so you do not double-count materials you never consumed. Pull it from a normal-shift output rate times unit margin.

Last reviewed 2026-05-12.