PENTESTY · EDITORIAL ANALYSIS · · 4 min read
What does an attack cost? The decision depends on the calculation
National figures attract attention, but a budget decision needs its own units, period and evidence. Build a calculation that another team can review.
By Pentesty
The headline figure is an estimate
The Putin Tax, released in October 2026, estimates an annual UK cost of ÂŁ2 billion to ÂŁ2.5 billion related to hostile activity linked to Russia. The report acknowledges data and attribution limitations. The figure combines evidence and estimates; it is not a fully measured national total or a cost automatically applicable to Brazilian businesses.
Start with the question the calculation must answer
A business might want to understand recovery spending, the impact of an interruption or its exposure to a scenario that has not occurred. Each needs different data. Before adding values, define the decision: approving a change, reviewing a dependency or checking whether a recovery alternative meets business requirements.
Record the service, period, currency and assessment owner. State whether the figure is gross or accounts for reimbursements and recoveries. Without those conditions, one number can appear comparable to another built on different criteria. A spreadsheetâs visual precision does not resolve incompatibility between its inputs.
Keep three connected records
The spending register should reference documents and actual commitments. The impact estimate should expose its reasoning and the variables that remain uncertain. A future scenario should identify the imagined condition and explain how the analysis would change if that condition did not hold. These records can support one decision without an indiscriminate total.
Consider a hypothetical example: customer service was interrupted, and the team worked additional hours to recover. Record documented expenses separately from the estimated commercial opportunity affected. If some requests were fulfilled later, that information needs to update the loss assumption, with a history of revisions.
- Observed: a value supported by documentation, a period and a verifiable connection to the event.
- Estimated: a calculation with explicit assumptions, a range and an owner responsible for reviewing inputs.
- Scenario: a possible consequence of a defined condition, without presenting it as spending already incurred.
Look for overlap before looking for a total
Map how each value was constructed. The same interruption can appear as unproductive time, delivery delays and unrealized revenue. These categories may overlap. Ask operations and finance to examine their relationship before consolidating the calculation. Where overlap cannot be resolved, present the components separately.
Also distinguish the spending required to restore the previous condition from an investment that expands future capability. Both matter to cash flow, but they answer different questions about the incident. Preserve information origins and dates so another team can review the reasoning.
Present uncertainty alongside priority
A recommendation should identify the assumption that most influences the decision and the evidence needed to reduce its uncertainty. Sometimes confirming a shared dependency helps more than refining a decimal place. Define the next action, its owner and the condition that would change the investmentâs priority.
A business does not need to determine who directed an attack before organizing its records and testing recovery. Attribution and financial impact require their own evidence. Use reporting as a reason to review the process, while grounding the budget in your environmentâs characteristics and limitations.
Frequently asked questions
Can I apply a national estimate to my budget?
It can prompt questions, but it does not measure your businessâs exposure. A budget needs to consider services, dependencies, data and scenarios defined for the organization.
Should an estimated loss be discarded?
No. It can support a decision when assumptions, ranges and uncertainty are explicit. The important distinction is not to present it as a documented expense already incurred.
Is adding lost revenue and unproductive time valid?
That depends on how each component was calculated. Check whether they represent the same effect before adding them, and document any overlap that remains.
Does the test demonstrate a value for avoided losses?
A test produces observations within the agreed scenario. Converting them into an economic estimate requires further assumptions; the exercise alone does not prove savings or financial returns.
Sources and references
- The Putin Tax: full report, October 2026
- Graeme Downie: report publication
- RUSI: author commentary, October 7, 2026
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.