Methodology
How we cost the data risk avoided
Putting a price on security sounds impossible. In practice, finance departments and insurers do it every day, with a simple and widely recognised method: expected annual loss. Here, in full transparency, is the reasoning behind the “Annual probability / sovereign reduction” field of our simulator.
Method
Calculation methodology
The budget subtracts operations from actual eliminated spending, then includes initial investment in NPV and payback.
Capacity and risk are assessed separately.
Net capacity = users × adoption × (hours saved − review) × 12.
Its hourly valuation does not eliminate payroll spending.
Expected loss reduction = incident cost × annual probability × assumed reduction.
Calibrate all three with the security team; vary probability for sensitivity. Neither 5% nor 80% is a universal measurement or inherently conservative scenario.
The IBM France 2025 report covers 34 organisations that suffered a breach, with a €3.59 million average. This is neither a probability nor an average specific to municipalities or shadow AI.
The calculator adds no flat compliance saving or regulatory multiplier. Documented external spending that actually ceases may be included in the budget without double counting.