Cybersecurity Risk Calculator

Your score is a directional risk index, not a percentage.

A score of 45 does not mean you have a 45% chance of being breached. It means your answers place your organization at 45 points on Fidalia’s cyber-risk index after considering both your inherent exposure and your current risk-reducing controls.

The calculator starts with your baseline risk, then adjusts for:

• Your industry
• Your employee count
• Your number of internet-facing systems
• Your remote workforce
• Your third-party integrations

It then subtracts credit for safeguards such as MFA, managed endpoint protection, email security, firewall maturity, DDoS protection, SOC/SIEM monitoring, backup immutability, DR testing, secure remote access, security awareness training, patch cadence, and incident-response planning.

A high score usually means one of three things.

First, your organization may have a larger attack surface than it realizes. This can include exposed remote-access systems, internet-facing applications, third-party integrations, remote users, cloud platforms, or systems that are difficult to monitor consistently.

Second, the organization may have important security tools in place, but not enough operational maturity around them. Alerts without response, backups without restore testing, policies without ownership, and incident plans that have never been rehearsed all create risk.

Third, the organization may be more difficult to recover than expected. In a real incident, the technical question is not only “were we attacked?” It is also “how quickly can we isolate the issue, restore clean systems, maintain access, and keep the business operating?”

This is where cybersecurity and disaster recovery overlap. A high score does not mean failure is inevitable, but it does mean the organization should prioritize controls that reduce blast radius, improve detection, and make recovery more predictable.

A low score is a positive signal, but it is not a finish line.

It suggests that your organization has stronger controls, better recovery readiness, and fewer obvious gaps based on the answers provided. You may have good coverage across MFA, endpoint protection, email security, backups, monitoring, patching, and incident-response planning.

But cybersecurity is not static. New users, new applications, new vendors, new cloud services, and new attacker techniques can change your risk profile quickly.

For organizations with lower scores, the focus should shift from “closing obvious gaps” to validation and cadence:

• Test restores quarterly.
• Review access regularly.
• Run tabletop exercises.
• Validate alerts and escalation paths.
• Reassess third-party and remote-access exposure.
• Keep security documentation current.

In cybersecurity, boring is good. If your restore tests, incident-response exercises, and monitoring reviews feel routine, you are moving in the right direction.

One of the most common cybersecurity mistakes is assuming that mentioning a control means the control is actually mature.

For example, an organization may say it has an incident-response plan, but if the plan does not define ownership, escalation steps, communication roles, testing frequency, or post-incident review, the plan is only partially useful.

Cybersecurity policy research makes this distinction clearly. In control-level assessments, policies are often categorized as fully covered, partially covered, or not covered. A control is only fully covered when the evidence clearly addresses the objective and includes details such as responsibility, scope, process, review, or enforcement. If a policy mentions the topic but leaves out ownership, review frequency, procedure, enforcement, or exception handling, it is considered partially covered.

That concept applies direction to operational cybersecurity:

Not every business can fix everything at once. That is normal.

Cybersecurity is a prioritization problem. The right question is not, “Are we perfectly secure?” The better question is, “Which few improvements would reduce the most risk for the least operational disruption?”

Recent cybersecurity governance research frames this as a resource-constrained planning problem. Defenders must allocate limited people, time, and budget against adversaries who change tactics quickly. The paper notes that defenders “cannot protect everything at all times,” making cybersecurity a problem of prioritization and optimization.

That is why this calculator focuses on practical controls that apply to small and large organizations alike:

• MFA
• Managed EDR/XDR
• Email security
• DDoS protection
• SOC/SIEM monitoring
• Immutable backups
• Disaster recovery testing
• Secure remote access
• Security awareness training
• Patch management
• Incident-response planning

A 20-person organization and a 2,000-person organization may implement these differently, but the underlying priorities are similar: reduce entry points, limit attacker movement, detect sooner, and recover faster.

Fidalia views cybersecurity as a resilience problem, not just a tools problem.

Prevention matters. But over a long enough timeline, organizations should assume that something will eventually get through: a compromised credential, a phishing email, an exposed service, a vendor issue, a misconfiguration, or a ransomware attempt.

The goal is to make incidents less likely, less damaging, and easier to recover from.

That requires layered controls, but it also requires a network and recovery strategy that works under pressure. As an ISP and managed technology provider, Fidalia brings together cybersecurity, connectivity, monitoring, backup readiness, DDoS protection, and disaster recovery planning.

That combination matters because many incidents become business disasters when teams cannot isolate systems, preserve access, restore clean data, or maintain service continuity.

Breaches are inevitable over long horizons; resilience is choice. Fidalia treats cybersecurity as continuous risk management – layered controls, rapid detection, immutable recovery, and network-first continuity to protect public-facing services.