M&A Cyber Deal Impact Calculator
Convert cyber due-diligence findings into estimated money: expected breach loss before integration, remediation cost, net exposure after insurance, share of deal value and a starting range for escrow or holdback.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- Enter deal value, records held, cost per record, breach probability, years to integration, remediation capex/opex, fine exposure and insurance cover.
- Get expected breach loss over the period, total remediation cost, net exposure after insurance and exposure as a % of deal value, toned low / material / significant.
- A suggested escrow/holdback range (50–100% of net exposure) gives the deal team a negotiation starting point — explicitly not advice.
- An assumptions checklist and narrative section keep the estimate honest and ready to brief counsel and deal advisers.
Frequently asked questions
How do you put a money figure on cyber risk in an acquisition?
Estimate the cost of one material breach (records × cost per record, plus regulatory fines), multiply by the chance of at least one breach before the target is integrated, add remediation capex and opex, and subtract what insurance would realistically pay. This calculator does exactly that from your own assumptions and shows each step.
Is the escrow range a recommendation?
No. It is a starting point for discussion, set at 50–100% of the estimated net exposure. How findings are reflected in price, escrow, holdback or indemnities is for the deal team, counsel and your deal advisers to decide.
Why does the calculator treat fines as uninsurable?
Many jurisdictions and policies do not allow regulatory fines to be insured, so excluding them from the insured recovery is the conservative default. Adjust the narrative if your broker and counsel confirm otherwise.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.