MFA Rollout Risk Reduction Calculator
MFA is one of the highest-value controls, but budgets still ask for numbers. This calculator shows the expected takeovers prevented by raising coverage and compares the avoided loss with the added licence and support cost.
Your numbers
Share of accounts with stolen or guessed credentials in a year.
Phishing-resistant methods block more than SMS codes or push approvals.
Licence, tokens and helpdesk support combined.
Your results
Expected-value model with illustrative defaults. Replace compromise rates and costs with your own incident data.
Net annual benefit vs MFA coverage after rollout
Sweeps MFA coverage after rollout from 10 to 100, holding your other inputs fixed.
ERP access review
Optional review of privileged ERP access alongside your MFA plan.
Optional. The tool and every export work without this. No spam.
How to use it
Enter total accounts and current and planned MFA coverage. Estimate the annual compromise rate for unprotected accounts from past incidents, password reset spikes and breach exposure reports. Set how much of that risk MFA removes, using a lower value for SMS or push methods and a higher one for hardware keys or passkeys. Enter an average takeover cost and the monthly cost per newly covered user.
- Cover remote access, email and admin accounts first.
- Include service accounts separately because they often cannot use MFA.
- Count helpdesk time in the per-user cost.
The model
Unprotected accounts are compromised at the base rate. Protected accounts are compromised at the base rate multiplied by one minus MFA effectiveness. Expected takeovers are the user count times the base rate times the weighted blend at a given coverage. The difference between current and planned coverage gives takeovers avoided, which is multiplied by the average cost.
Reading the result
Benefit usually flattens near the top because the last few percent of users cost the same but add little reduction. The sweep shows that curve. If net benefit is negative at defaults, check the takeover cost: one ERP or email compromise leading to fraud, invoice redirection or a ransomware foothold can cost far more than a typical help desk reset.
Common mistakes
Counting coverage as enrolled users rather than enforced policy overstates protection. Legacy protocols such as IMAP and basic authentication bypass MFA entirely, so block them. Approving every push request without thinking defeats the control, so prefer number matching or phishing-resistant methods, and add conditional access for risky sign-ins.
Frequently Asked Questions
Is MFA worth it if the rollout is only partial?
Yes, if you cover the highest-risk accounts first. Admins, remote access, finance and email deliver far more risk reduction per user than low-privilege accounts, so prioritize by impact, not alphabetically.
How effective is MFA really?
It blocks most automated credential attacks, but effectiveness depends on the method. Phishing-resistant methods such as hardware keys and passkeys do better than SMS codes or simple push approvals.
What about shop floor shared logins?
Shared kiosks and terminals need alternative controls such as badge-based login, network restrictions and short sessions, since per-user MFA is often impractical. Document the exceptions and compensating controls.
Does this include the cost of the incident response?
Only if you include it in the average cost per takeover. Add investigation, reset, fraud and downtime to the figure for a fair comparison.
If you want ERP logins and privileged access reviewed alongside MFA coverage, Netray can help map who can do what inside your ERP.
Related Tools
Annualized Loss Expectancy Cyber Risk Calculator
Compute SLE, ALE and the net return of a security control so you can justify spend to finance in plain numbers.
Compliance & ContractsCyber Insurance Retention Tradeoff Calculator
See whether taking a higher retention for a lower premium saves money at your expected incident frequency and size.
ERP OperationsCyber Incident Dwell Time Cost Calculator
Price the days between intrusion and detection, and between detection and containment, then test what faster detection is worth.
Compliance & ContractsCyber Risk Register with ALE Worksheet
Log cyber risks for a plant or company, compute expected annual loss before and after controls, and export a ranked register to Excel.
More Compliance & Contracts tools
See all- ISO 14001 Internal Audit Checklist
- Environmental Compliance Obligations Register Worksheet
- AI Governance Policy Template for Manufacturers
- AI Acceptable Use Policy Template for ERP Users
- IEC 62443 Security Levels and Parts Reference
- NIST CSF 2.0 Categories Reference for Manufacturers
- OT Vendor Remote Access Hardening Checklist
- OT Network Segmentation Maturity Assessment
- SAP SoD Residual Risk Score Calculator