Calculator inputs
Formula used
- Labor cost = employees × hours per employee × average hourly cost
- Total cost = direct + platform + travel + admin + labor cost
- Baseline annual loss = incidents per year × average cost per incident
- Retention factor ≈ 1.02 − 0.015 × refresh interval months (bounded)
- Effective reduction = expected reduction × confidence × retention
- Post-training loss = baseline loss × (1 − effective reduction)
- Annual savings = baseline loss − post-training loss
- Payback months = (total cost ÷ annual savings) × 12
- NPV = Σ (savings × (1−decay)^(t−1) ÷ (1+discount)^t) − total cost
How to use this calculator
- Enter direct costs and internal time costs.
- Estimate baseline incidents and cost per incident.
- Set expected reduction and confidence realistically.
- Choose a refresh interval and time horizon.
- Press calculate and review payback and NPV.
- Phishing simulation click rate trends.
- Ticket data on recurring security mistakes.
- Audit findings before and after training.
- Helpdesk volume tied to security behaviors.
Training economics in security programs
Security training produces value only when it changes daily decisions. This calculator converts that change into expected loss reduction, then compares it with the full cost of delivery. Include direct spend (vendor, platform, travel) and internal effort (administration and learner time) to avoid underestimating total investment. For blended programs, add facilitator time, room costs, and any overtime needed to keep operations covered.
Baseline loss sizing with incident data
Start with incidents the training can realistically influence, such as phishing-driven credential compromise, accidental data exposure, weak password reuse, or policy bypass. Use the last 12 months of ticketing and investigation records to estimate incidents per year and average cost per incident. If you track near-misses, include them as “avoided incidents” only when you can map them to measurable response effort. If you have ranges, test low, expected, and high cases to see payback sensitivity.
Expected reduction and confidence discipline
Reduction is not the same as completion rate. Set an expected reduction that matches a measurable control outcome: fewer clicks in simulations, fewer repeat findings, faster reporting, or fewer preventable misconfigurations. Confidence acts as a realism factor; it discounts savings when evidence is thin. Programs supported by trend data, manager reinforcement, and role-based modules typically justify higher confidence than one-off awareness sessions.
Retention, refresh cadence, and decay
Behavior decays when training is not reinforced. The calculator models retention using refresh interval and optionally applies savings decay across the analysis horizon. Shorter refresh cycles, micro-learning, and timely nudges can reduce decay. Pair training with job aids and “just-in-time” prompts in tools where mistakes occur. If your environment has frequent staff turnover or rapidly changing threats, use a higher decay assumption to avoid over-crediting long-term benefits.
Decision outputs for stakeholders
Payback months answers when the program “breaks even,” while NPV summarizes multi-year value after discounting. A positive NPV means expected savings exceed costs over the horizon. Use the results to prioritize audiences with the highest loss exposure, compare delivery options, and justify refresh budgets. Track outcomes alongside the model: click rate reduction, reporting speed, repeat finding rate, and incident containment time. Export CSV or PDF to attach to governance packs, risk committee notes, or training business cases.
FAQs
What costs should I include?
Include vendor fees, content, travel, and platform charges, plus internal administration time and learner time valued at the average hourly cost. This prevents optimistic payback estimates caused by hidden labor costs.
How do I estimate cost per incident?
Use your incident postmortems and finance inputs. Include response labor, downtime, external forensics, legal, customer support, and any contractual penalties. If unsure, use a conservative average and run scenarios.
Which incidents fit training impact best?
Incidents tied to human decisions fit best: phishing clicks, credential handling, data sharing mistakes, weak authentication practices, and policy violations. Purely technical failures are usually better addressed with engineering controls.
Why does confidence matter?
Confidence discounts savings to reflect uncertainty. Strong evidence like sustained simulation improvements or reduced repeat findings supports higher confidence, while new programs without metrics should start lower.
What does savings decay represent?
Decay represents fading behavior change over time. Use higher decay when refresh training is infrequent, turnover is high, or threats evolve quickly. Use lower decay when reinforcement and reminders are consistent.
How should I interpret negative NPV?
A negative NPV means expected savings do not cover costs within the chosen horizon and assumptions. Reduce costs, target higher-risk groups, increase reinforcement, or revisit baseline incident and reduction inputs.
Example data table
| Scenario | Employees | Hours | Direct cost | Incidents/year | Cost/incident | Reduction | Confidence | Annual savings | Payback |
|---|---|---|---|---|---|---|---|---|---|
| Starter program | 25 | 1.5 | $1,600 | 8 | $900 | 18% | 60% | $777 | ~31.0 months |
| Balanced program | 35 | 2.0 | $2,500 | 12 | $1,200 | 25% | 70% | $2,610 | ~17.6 months |
| High-impact program | 60 | 2.5 | $4,200 | 18 | $1,800 | 35% | 80% | $9,072 | ~10.1 months |