← SCP Cost Explorer Read on SCP Wiki ↗
SCP-5722 Keter ~ medium confidence
SCP-5722
Expected annual
$12.9M
One-time setup
$18.3M
Annual recurring
$11.7M
Personnel
42
Initial one-time containment, remediation and infrastructure buildout is estimated at about $18.25M, driven by contingency reserves, large-scale restores and tooling; ongoing annual costs are ~ $13.78M/year driven by SOC operations, research staffing, monitoring, and grants.
🏗️ One-Time Capital Costs Total: $18.3M
Contingency Fund $10.0M
[#31] Reserve fund for large-scale remediation, mass restores or emergency responses.
Restore Rollback From Backups $2.5M
[#3] Labor and compute to restore/verify millions of documents; size-dependent, chosen mid-range for large dataset remediation.
Replace Renew Contaminated Servers $1.1M
[#17] Purchase/provisioning of new hardware and secure destruction/disposal of compromised storage.
Footnote Stripping Tools Development $600K
[#22] Engineering to build safe automated 'footnote stripping' tools integrated into editors/databases.
Legacy Content Migration $550K
[#30] Labor and tooling to migrate legacy formats (OCR, format conversions) into signed/immutable repos.
Cryptographic Signing Infrastructure $425K
[#15] PKI, integration and HSM purchase/integration costs for document attestation and signing.
Facilities $410K
[#18, #37] Secure facility upgrades (physical access control/CCTV) and initial archive/evidence storage buildout.
Emergency Incident Response $400K
[#1] Rapid-response digital forensics/IR team engagement for a 4–6 week emergency contract.
Automated Detection Development $300K
[#5] Development, labeling and validation for rule-based + ML detectors for SCP-5722 markers.
Immutable Storage Worm $300K
[#9] One-time hardware and configuration for WORM appliances per critical repository (representative single-repo cost).
Manual Remediation Cleanup $291K
[#4] Human editors/curators removing/correcting footnotes where automatic restoration fails (example workload used in estimate).
Deep Forensic Analysis $250K
[#2] Full forensic triage, log recovery and provenance reconstruction requiring senior analysts and tooling.
Reputation And Academic Remediation $200K
[#34] Payments/grants/reimbursements to affected researchers (retractions, republications).
Offsite Air Gapped Backups Initial $175K
[#10] Initial setup costs for offline tape/cold storage vaulting and secure media seeding.
Quality Assurance Passes $175K
[#23] Human QA/verification on sanitized documents to ensure no significant data loss.
Air Gapped Sandbox Hardware $175K
[#26] Isolated hardware and expendables for analyzing captured edits in a sandbox.
Training And Sop Development Initial $125K
[#20] Initial development and delivery of training and SOPs for editors, sysadmins and legal teams.
Honeypot Initial $125K
[#25] Design and deployment of bait-document/honeypot program initial costs.
Database Integrity And Reindexing $125K
[#29] Compute and developer time to compute/store checksums and reindex pipelines for integrity.
Secure Communications Infrastructure $28K
[#35] Encrypted phones, audited channels and initial secure comms hardware procurement.
Equipment $0
[]
Initial Research And Lab Setup $0
[]
🔄 Annual Recurring Costs Total: $11.7M/yr
Staff Wages $3.9M/yr
[#7, #16, #19, #25, #27, #28, #38, #39] Aggregate estimated annual wages for SOC analysts, research team, security staff, moderators and policy/compliance staff (portion of recurring staffing costs included here).
Siem And Soc Operations $2.0M/yr
[#7] Centralized logging, alerting, SIEM licenses and 24x7 SOC operations (licenses + staffing + playbooks).
Research And Monitoring $1.2M/yr
[#27, #28, #40] Recurring costs for dedicated containment research team, global crawling/indexing and long-term research grants.
Cover Story And Legal $660K/yr
[#12, #13, #14, #33] Public takedown operations, legal counsel/containment legal ops, PR retainers and international coordination fees (annualized).
Endpoint Protection Licensing $650K/yr
[#8] EDR/endpoint licensing across hosts (example mid-range cost for large endpoint counts).
Insurance And Risk Transfer $525K/yr
[#32] Cyber liability and reputational insurance premiums to cover remediation and fallout.
Policy And Compliance Staffing $400K/yr
[#39] Salaries for internal policy officers managing content-removal rules and oversight coordination.
Logistics And Transport $360K/yr
[#11] Regular offsite backup storage fees and associated logistics (example 1PB sizing).
Supplies And Consumables $330K/yr
[#6] Ongoing scanning/compute/storage costs for continuous text media monitoring (monthly compute/storage).
Facilities Maintenance $300K/yr
[#18] Guards/CCTV maintenance and facility upkeep for secure server rooms.
Diplomatic And International Coordination $300K/yr
[#33] Costs for foreign counsel, local takedowns and international coordination.
Background Checks And Clearances $250K/yr
[#21] Recurring vetting/clearance fees for expanded staff populations.
Honeypot Monitoring $180K/yr
[#25] Ongoing monitoring costs for honeypots/bait-documents (monthly monitoring services and staffing).
Red Team And Pen Testing $175K/yr
[#24] Regular adversarial testing and penetration tests to find vectors of spread or persistence.
Public Interface Moderation $175K/yr
[#38] Moderation and engineering to scrub affected public forums, wikis and community sites.
Energy And Hosting Uplift $100K/yr
[#36] Additional electricity and hosting costs for scanning, backups and indexing infrastructure.
Secure Communications Services $66K/yr
[#35] Recurring service fees for secure communication platforms (encrypted chat/voice).
Pki Hsm Operations $60K/yr
[#16] Certificate lifecycle management, key rotation and HSM audits.
Archive Maintenance $28K/yr
[#37] Ongoing evidence preservation storage and chain-of-custody maintenance fees.
Training And Sop Refresher $20K/yr
[#20] Annual refresher training costs.
⚡ Cost Scenarios
📊 Baseline (baseline) $11.7M/yr
75.0% probability / year
Normal operational year with no major incidents; ongoing monitoring, SOC operations, research, backups and maintenance continue.
no_major_spread contained_to_internal_repos
🚨 Minor Incident $15.3M/yr
20.0% probability / year +$3.6M vs baseline
Localized leakage or moderate spread requiring emergency forensics, limited restores, takedowns and legal/PR activity.
external_mirrors_affected targeted_restores_needed
🚨 Major Breach $21.8M/yr
5.0% probability / year +$10.1M vs baseline
Widespread public exposure or adaptive changes by SCP-5722 requiring mass restores, hardware replacement and large legal/PR operations.
widespread_public_exposure adaptive_signature_change
👥 Personnel 42 total
Role Count Notes
Research Scientist 6 [#27] Containment research team members focused on anomalous-digital containment research and analysis.
Security Officer / MTF Agent 10 [#19] Physical security staffing for critical sites and server rooms.
SOC Analyst / Incident Responder 12 [#7, #1] 24x7 SOC analysts and rapid incident response personnel supporting SIEM and IR operations.
Engineer / DevOps 6 [#5, #22, #28] Developers and operators for detection systems, footnote-stripping tools and global crawling/indexing.
Legal / Policy Officer 4 [#13, #33, #39] Legal counsel and policy/compliance staff coordinating takedowns, international coordination and content-removal procedures.
Community Moderator / Content Reviewer 4 [#4, #38] Moderators and content reviewers handling public forums, QA passes and remediation coordination.
📋 Confidence Notes
Analyst notes provide detailed line items and ranges allowing mid-range estimates, but large ranges and scale dependence (document counts, exposure) introduce uncertainty; probabilities are expert judgment.
← SCP-5721 ↑ All SCPs SCP-5723 →