{"ok":true,"engine":"aicost.msp-downtime-bcdr","inputs":{"annualRevenueUsd":8000000,"grossMarginPct":35,"employeesAffected":60,"loadedPayrollHourlyUsd":42,"productivityLossPct":70,"operatingHoursPerYear":2500,"serverLossRecoveryHrs":24,"ransomwareRecoveryHrs":72,"recoveryLaborHourlyUsd":185,"restoreTestFactor":1.35},"result":{"costPerOutageHourUsd":2884,"serverLossEventUsd":100634,"ransomwareEventUsd":301903,"scenarios":[{"name":"Internet outage","hrs":4,"impactUsd":16772},{"name":"Server loss","hrs":24,"impactUsd":100634},{"name":"Cloud/SaaS outage","hrs":8,"impactUsd":33545},{"name":"Ransomware","hrs":72,"impactUsd":301903},{"name":"Office loss (regional event)","hrs":120,"impactUsd":503172}],"decision":"FIX BCDR NOW","decisionDetail":"Slow recovery AND untested restores compound: the multiplier applies to your longest window. Modernize BCDR and put a tested 4–8h ransomware RTO in the contract.","insuranceNote":"Cyber insurers increasingly require documented RTO/RPO and restore-test evidence* — this model plus test logs is that evidence pack.","verdict":"EXPOSED","verdictReason":"A 72h ransomware recovery at $2884/hr is a $301903 event*. Modern BCDR targets 4–8h — the delta typically funds the service many times over.","memo":"$/outage-hour = revenue x margin / operating hours + affected employees x payroll x productivity loss. Events add recovery labor (2 techs at 60% of the window) and apply the restore-test factor (1.35x) — untested restores take longer; everyone knows it, few price it.","questions":["When was the last successful full restore test, and was it timed?","Which systems drive the revenue line? Tier them — not everything needs the premium RTO.","Does cyber insurance require specific RTO/RPO evidence? The certificate trail helps there."],"assumptions":["Restore-test factor: 1.0 tested <90d, 1.15 within a year, 1.35 never/unknown (estimated*).","Not a breach-probability model; scenario arithmetic on your inputs only."]}}