Cost of a DDoS Attack: How to Calculate Your Own

Search for the cost of a DDoS attack and you’ll find big averages from vendor surveys. They make good headlines and poor decisions. An average across banks, gaming platforms and local businesses tells you nothing about what an hour offline costs you. You can work that out yourself in about thirty minutes, and the number is far more useful.

What actually makes up the cost

Downtime drains several budgets at once. Some hits are visible the same day, others weeks later.

The first six rows can be evidenced. The last two are estimates, and that’s how you should label them for insurers or the police.

The formula

cost = (revenue per hour × hours down × loss rate)
     + (staff hours × hourly cost)
     + extra spend (infrastructure, contractors, protection)
     + SLA credits
     + knock-on costs

Two parts need care.

Revenue per hour is rarely annual revenue divided by 8,760. Most shops earn heavily in a few evening hours and at weekends. Look at the hours the attack actually covered, then check what those same hours brought in on comparable days.

Loss rate is the share that never comes back. Loyal customers order tomorrow instead. Someone who arrived from an ad buys from a competitor. A B2B portal with contracted clients loses less than a shop selling on impulse.

Worked example: a small online shop

These figures are invented for illustration. They are not benchmarks.

A shop normally takes about £1,600 between 6 pm and 10 pm on a Tuesday, so £400 an hour. It’s unreachable for exactly that window.

That excludes any long-term protection. Run the same formula for the week before a major holiday and the revenue line alone can be several times higher.

Hidden costs: cloud bills and SLAs

On flat-rate hosting, attack traffic rarely shows up on the invoice. Cloud platforms are different. If outbound traffic is billed per gigabyte or the platform scales automatically, an attack can inflate the monthly bill even if the site stays up. Before anything happens, check:

• Is egress billed by volume?
• Is there a cap on autoscaling, and a budget alert?
• Does your CDN bill per request?
• Does the provider credit attack traffic, and on what conditions?

If you promise customers 99.9 % monthly availability, do the maths: that allows roughly 43 minutes of downtime in a 30-day month. One morning of DDoS breaks it, and the credits in your contract fall due.

DDoS protection cost versus downtime cost

Cloudflare’s free plan includes baseline DDoS mitigation at no charge, unmetered for network and application-layer attacks according to Cloudflare. What it covers and where it stops is explained in Cloudflare DDoS protection. Paid plans, hosting add-ons and specialised scrubbing services are priced very differently, so get current quotes directly from the providers.

The decision gets simple once you have your own number:

worth paying for?  →  cost per hour down × expected hours down per year
                      > annual cost of protection

If an hour offline costs you £500, protection at £20 a month pays for itself after half an hour of avoided downtime per year. A personal blog with no revenue is better served by the free tier and sensible rate limiting on the server.

DNS is the cost people forget. When your nameservers go down, you lose the website, email and every API at once. A second provider for secondary DNS reduces that risk cheaply.

Damages, police reports and insurance

If the attacker is identified, a civil claim may be possible depending on where you are, but most attackers are never found or have nothing to pay with. Your cost calculation still matters, because police, prosecutors and insurers all work from it. How to file and what to preserve is in how to report a DDoS attack.

For insurance, evidence decides: logs, traffic graphs, a timeline with times. Collecting that while the attack runs is easier if you know what to look for; see how to detect a DDoS attack.

A 30-minute template for your own number

1. Export hourly revenue for the last eight matching weekdays.
2. Average the peak hours.
3. Set a realistic loss rate for returning versus new customers.
4. List the hourly cost of everyone who’d be pulled into an incident.
5. Add SLA credits and hourly ad spend.
6. The result is your cost per hour of downtime. Put it in your incident runbook.

With that number, you buy protection on evidence instead of guessing during an outage. Start with the domain itself: betadomain offers .com registration with DNSSEC and your choice of nameservers, fixed prices without first-year teasers, and guides on securing your domain.