Calculator inputs
Example data table
Use this sample structure to plan role-based depth and evidence coverage. Adjust hours to match your risk profile and audit expectations.
| Role group | Suggested annual hours | Typical content focus | Coverage target |
|---|---|---|---|
| All staff | 2–4 | Phishing, password hygiene, reporting, data handling | 90–100% |
| Privileged admins | 6–10 | IAM, hardening, logging, change control | 100% |
| Developers | 6–12 | OWASP Top risks, secure SDLC, code review | 80–100% |
| Executives | 2–3 | Decision playbooks, crisis comms, tabletop participation | 100% |
| SOC and incident responders | 12–24 | Detection tuning, triage, forensics, exercises | 100% |
Formula used
This tool estimates an optimized annual training spend and allocates it across capability areas. It uses a baseline per-employee spend, then applies scaling factors and change caps.
Spend model
Impact model
These equations are intentionally conservative and should be calibrated using your incident data, threat model, and control effectiveness measurements.
How to use this calculator
- Enter organization size, exposure (remote/cloud/dev), and your risk and compliance levels.
- Fill in your current annual training budget, plus platform and admin costs if separate.
- Set coverage and a practical change cap to avoid budget shocks.
- Add any custom initiatives with unit cost and quantity.
- Press Submit to view optimized spend, allocation, and impact estimates.
- Use Download CSV or Download PDF to share the output.
Spend baseline by risk level
The calculator starts with a per‑employee benchmark that scales with risk: Low 120, Medium 220, High 350, and Critical 520 currency units annually. This anchors planning when current spend is unknown or inconsistent across departments. When platform or admin costs are outside training spend, include them for a truer annual baseline.
Exposure and workforce mix
Remote work, cloud footprint, and developer share raise the recommended spend because training must cover identity hygiene, configuration drift, and secure delivery practices. In the model, exposure adds up to 6% uplift each for remote and cloud, plus up to 5% for developer density. Use average seat cost as a check: optimized spend ÷ seat cost estimates specialist seats after awareness coverage.
Compliance intensity and evidence
Compliance increases governance, documentation, and repeatability. The calculator applies a compliance multiplier from 0.92 to 1.30, then shifts allocation toward measurement and governance when requirements are strict. This supports audit‑ready reports, completion evidence, and role‑based attestations, without over‑relying on certifications alone.
Maturity and incident signals
Lower security maturity typically delivers higher marginal gains, so the optimizer adds roughly 7% spend uplift per maturity step below level 3, and reduces spend above it. Incident history adds up to 30% uplift, and increases incident‑response tabletop allocation to strengthen coordination. Custom initiatives are priced as unit cost × quantity, letting you model labs, facilitation, or targeted workshops cleanly.
Budget stability and impact reading
To avoid shock changes, the final recommendation is capped by your increase and decrease limits relative to current spend. A threat reserve (commonly 5–10%) is added to handle urgent retraining. The priority setting nudges spend between compliance evidence and risk reduction; values near 100 favor hands‑on practice, while 0 favors audit coverage and tracking each cycle. Allocation begins with defaults—awareness, role skills, secure development, tabletop exercises, cloud configuration, certifications, and governance—then shifts weights based on your inputs. Impact is estimated through annualized loss exposure (ALE = incident cost × expected incidents) and a conservative risk‑reduction curve driven by coverage and training hours. Use ROI and payback to compare initiatives, while change caps keep the plan adoptable.
FAQs
What does “current annual spend” include?
It starts with your stated training budget. If you mark platform or admin costs as not included, the calculator adds them to estimate a more complete annual training spend.
How are the allocation percentages determined?
The tool begins with default weights across awareness, role skills, secure development, tabletop, cloud configuration, certifications, and governance. It then shifts weights based on cloud share, developer share, incident history, and strict compliance.
Why do change caps affect the recommendation?
Organizations rarely approve abrupt budget swings. Increase and decrease caps keep the optimized result within a manageable range, so the plan can be adopted without disrupting ongoing programs or contracts.
How should I set incident cost and expected incidents?
Use your best internal estimate including response time, downtime, recovery, legal, and customer impact. If uncertain, start conservative, run scenarios, and compare outputs to your loss history or industry benchmarks.
What is the role of coverage and training hours?
They drive the risk‑reduction estimate. Higher coverage and more hours improve expected reduction, but returns taper. Many programs see meaningful uplift around 6–12 hours per person when content is role‑relevant.
Can I model special workshops or labs?
Yes. Add custom initiatives with a name, unit cost, and quantity. The tool adds unit × quantity to the recommendation, keeping one‑off projects visible instead of hiding them inside baseline spend.