How much does a cyber attack cost a small business on average?

The average cyber attack costs a small business $108,000–$200,000 according to 2024 data from Hiscox and IBM. This includes direct costs like remediation and recovery, plus indirect costs like lost business, downtime, and reputation damage. For ransomware attacks specifically, the average recovery cost is $1.85 million (Sophos 2024).

How much should a small business spend on cybersecurity?

Industry benchmarks recommend 10-15% of your total IT budget for security, which translates to roughly $50-$150 per user per month for managed cybersecurity services. For a 20-person company, that is $1,000-$3,000/month — far less than the cost of a single breach.

What is the most expensive type of cyber attack for small businesses?

Ransomware is the most expensive attack type for small businesses. The average recovery cost is $1.85 million (Sophos 2024), which includes downtime, lost business, remediation, and sometimes the ransom payment itself. Business Email Compromise (BEC) is second, with median losses of $50,000 per incident (FBI IC3).

Does cyber insurance cover the full cost of a breach?

Rarely. Most cyber insurance policies cover 60-80% of direct costs (incident response, notification, legal fees). They typically exclude reputational damage, long-term customer loss, increased insurance premiums, and regulatory fines from pre-existing non-compliance. The average out-of-pocket cost even WITH insurance is still $50,000-$100,000 for a small business.

Is cybersecurity worth the cost for a small business?

Absolutely. A managed cybersecurity service costing $100-$150/user/month ($24,000-$36,000/year for 20 users) prevents attacks that average $108,000-$200,000 in damages. That is a 3-8x return on investment from prevention alone, not counting avoided downtime, preserved customer trust, and insurance premium reductions.

How Much Does a Cyber Attack Actually Cost a Small Business? (2026 Data)

The Problem with Most Cybersecurity Cost Data

Every cybersecurity article quotes the same stat: "The average data breach costs $4.88 million" (IBM 2024). And it's technically true — for global enterprises with thousands of employees and millions of records.

But if you run a 15-person accounting firm in Raleigh or a 30-person manufacturing company in Durham, that number is meaningless. Your breach won't cost $4.88 million. It'll cost a different amount that's still devastating, and the data specific to small businesses tells a much more useful story.

This article focuses on **real numbers for businesses with 5-200 employees** — the companies we work with every day in North Carolina's Triangle region.

> **Want the source data?** We maintain a curated page of 28+ cybersecurity statistics from IBM, Verizon, FBI, Sophos, and other primary sources. All sourced and free to cite.

The Direct Costs: What You'll Actually Pay

Incident Response and Forensics

When a breach is discovered, the first expense is figuring out what happened. This requires forensic investigation — specialized work that most IT providers and in-house teams aren't equipped to handle.

| Service | Typical SMB Cost |

|---------|-----------------|

| Digital forensics investigation | $10,000–$75,000 |

| Malware removal and system restoration | $5,000–$25,000 |

| Security assessment and remediation | $5,000–$15,000 |

| Emergency IT support (first 72 hours) | $3,000–$10,000 |

**Total direct IT costs: $23,000–$125,000**

For context, most small businesses have never budgeted for this. The money comes out of operating cash, credit lines, or emergency reserves — if they exist.

Legal and Compliance Costs

North Carolina's data breach notification law (N.C. Gen. Stat. § 75-65) requires businesses to notify affected individuals "without unreasonable delay." If you handle health data (HIPAA), financial data (PCI-DSS, SOX), or data from EU citizens (GDPR), additional regulations apply.

| Service | Typical SMB Cost |

|---------|-----------------|

| Legal counsel (breach response) | $5,000–$30,000 |

| Breach notification (mail + monitoring) | $3–$5 per record |

| Regulatory fines (HIPAA, PCI-DSS) | $10,000–$250,000+ |

| Credit monitoring for affected customers | $10–$30/person/year |

For a business with 2,000 customer records, notification and monitoring alone costs $25,000–$70,000.

Ransomware-Specific Costs

Ransomware deserves its own section because the costs are fundamentally different — and higher.

| Cost Component | Average (Sophos 2024) |

|---------------|----------------------|

| Average recovery cost (excluding ransom) | $1.85 million |

| Median ransom demand | $2.73 million |

| Companies that paid and got data back | 46% |

| Recovery time exceeding one month | 34% |

Here's the brutal math: **46% of businesses that pay the ransom still lose their data.** You've now paid the ransom AND the recovery costs.

Small businesses typically face ransom demands of $10,000–$500,000 — lower than the enterprise median but still catastrophic for a company with $2M in revenue.

The Hidden Costs: What Nobody Budgets For

The direct costs above are the obvious ones. The hidden costs are often larger.

Downtime and Lost Productivity

According to Gartner, the average cost of IT downtime is $5,600 per minute for mid-size companies. For a small business, the number is lower but still significant:

•**Average SMB downtime after a cyber attack: 21 days** (Hiscox 2024)

•**Average daily cost of downtime for a 20-person company: $3,000–$8,000/day**

•**Total productivity loss over 21 days: $63,000–$168,000**

This isn't theoretical. When your email is down, your files are encrypted, or your systems are offline for three weeks, your employees are either sitting idle or working at 20% capacity. You're still paying their salaries.

Customer Loss and Reputation Damage

This is the cost that doesn't show up on any invoice but often exceeds everything else combined.

•**29% of businesses that suffer a breach lose customers** (IBM 2024)

•**Average customer churn cost due to a breach: $1.5M for large companies, $50K–$200K for SMBs**

•**Lost future business is 2-3x the value of lost current customers**

For a local service business that depends on trust — law firms, medical practices, accounting firms, financial advisors — a public breach can be existential. When the Raleigh News & Observer runs a story about your data breach, prospective clients Google you and find it. For years.

Insurance Premium Increases

If you have cyber insurance (and you should), expect premiums to increase 50-200% after a claim. If you don't have cyber insurance, expect difficulty obtaining it at any price after a breach.

•**Average cyber insurance premium before breach: $1,500–$3,000/year for SMBs**

•**Average premium after a claim: $4,000–$9,000/year**

•**Some carriers drop SMBs entirely after a claim**

Opportunity Cost

Every hour your leadership team spends dealing with a breach is an hour not spent on revenue-generating activities. For a small business owner, this can consume 100+ hours over 2-3 months:

•Incident response coordination

•Customer notification and damage control

•Insurance claims and legal proceedings

•Vendor negotiations for new security tools

•Employee retraining

•Rebuilding systems and processes

Need help with your IT?

Get a free consultation — no obligation, just honest advice for your business.

Get Free Assessment

Total Cost: The Real Number

Let's add it up for a hypothetical 25-person business in the Triangle that gets hit with ransomware:

| Category | Conservative | Severe |

|----------|-------------|--------|

| Forensics & remediation | $25,000 | $75,000 |

| Legal & notification | $15,000 | $50,000 |

| Ransom payment (if paid) | $0 | $100,000 |

| Downtime (21 days) | $63,000 | $168,000 |

| Lost customers | $30,000 | $150,000 |

| Insurance increase (3 years) | $7,500 | $18,000 |

| Employee overtime & retraining | $10,000 | $25,000 |

| **Total** | **$150,500** | **$586,000** |

For a business doing $2-5M in annual revenue, even the conservative estimate is between 3% and 7.5% of a year's revenue — wiped out in a single incident.

**The Hiscox Cyber Readiness Report 2024 puts the average at $108,000 per incident for small businesses.** That aligns with our conservative estimate, which doesn't include ransom payments.

What Prevention Actually Costs

Here's where the math gets encouraging. Preventing 95%+ of these attacks is dramatically cheaper than recovering from one.

| Prevention Measure | Monthly Cost (20 users) |

|-------------------|------------------------|

| Managed endpoint detection (EDR) | $200–$400 |

| Email security & phishing filtering | $100–$200 |

| Multi-factor authentication | $0–$100 (often included in M365) |

| Security awareness training | $100–$200 |

| Backup & disaster recovery monitoring | $150–$300 |

| 24/7 network monitoring | $200–$400 |

| Quarterly vulnerability scanning | $100–$200 |

| **Total prevention cost** | **$850–$1,800/month** |

| **Annual prevention cost** | **$10,200–$21,600/year** |

Compare that to the **$108,000–$586,000** cost of a single incident.

That's a **5-57x return on investment** from prevention. There aren't many business expenditures with that kind of payoff.

> **Want to compare IT support costs for your specific situation?** Use our free IT Cost Calculator to see what managed IT (including security

The Managed IT Approach

Most managed IT providers bundle cybersecurity into their per-user pricing. At Triangle Tech, our plans range from $99–$175/user/month and include endpoint protection, email security, MFA management, backup monitoring, and security awareness training.

For a 20-person company, that's $1,980–$3,500/month for comprehensive IT management AND cybersecurity protection — well under the $108K average breach cost.

What to Do Right Now

If you've read this far and your business doesn't have at least basic cybersecurity protections in place, here are the three highest-impact actions ranked by cost-effectiveness:

1. Enable MFA Everywhere (Cost: $0-$2/user/month)

Multi-factor authentication blocks 99.9% of automated credential attacks (Microsoft). If your team uses Microsoft 365 or Google Workspace, MFA is included — you just need to turn it on and enforce it for all users.

2. Test Your Team with a Phishing Simulation (Cost: $3-$5/user/month)

Before spending money on tools, find out how vulnerable your team actually is. If more than 15% of your employees click a simulated phishing email, security awareness training is your highest-ROI investment.

3. Verify Your Backups Work (Cost: $0)

Most businesses have backups configured but have never tested a restore. Run a test restore this week. If it fails or takes longer than your business can tolerate, fix it before you need it.

> **Check your password security** with our free Password Strength Checker — no data is sent to any server.

The Bottom Line

Cybersecurity isn't an IT problem. It's a business risk management problem.

The data is clear: the cost of prevention ($10K–$22K/year for a 20-person company) is a fraction of the cost of a breach ($108K–$586K). Businesses that invest in basic protections — MFA, email security, endpoint protection, backup, and employee training — prevent the vast majority of attacks.

The businesses that end up as statistics aren't the ones that couldn't afford security. They're the ones that assumed it wouldn't happen to them.

If you want to see all the underlying data, visit our Cybersecurity Statistics page — 28+ sourced stats from IBM, Verizon, FBI, and Sophos, updated quarterly.

---

*Marshall Durden is the founder of Triangle Tech LLC, a managed IT and cybersecurity company serving small businesses in Raleigh-Durham, NC. For a free security assessment, contact us or call (919

The Problem with Most Cybersecurity Cost Data

This article focuses on **real numbers for businesses with 5-200 employees** — the companies we work with every day in North Carolina's Triangle region.

> **Want the source data?** We maintain a curated page of 28+ cybersecurity statistics from IBM, Verizon, FBI, Sophos, and other primary sources. All sourced and free to cite.

The Direct Costs: What You'll Actually Pay

Incident Response and Forensics

| Service | Typical SMB Cost |

|---------|-----------------|

| Digital forensics investigation | $10,000–$75,000 |

| Malware removal and system restoration | $5,000–$25,000 |

| Security assessment and remediation | $5,000–$15,000 |

| Emergency IT support (first 72 hours) | $3,000–$10,000 |

**Total direct IT costs: $23,000–$125,000**

For context, most small businesses have never budgeted for this. The money comes out of operating cash, credit lines, or emergency reserves — if they exist.

Legal and Compliance Costs

| Service | Typical SMB Cost |

|---------|-----------------|

| Legal counsel (breach response) | $5,000–$30,000 |

| Breach notification (mail + monitoring) | $3–$5 per record |

| Regulatory fines (HIPAA, PCI-DSS) | $10,000–$250,000+ |

| Credit monitoring for affected customers | $10–$30/person/year |

For a business with 2,000 customer records, notification and monitoring alone costs $25,000–$70,000.

Ransomware-Specific Costs

Ransomware deserves its own section because the costs are fundamentally different — and higher.

| Cost Component | Average (Sophos 2024) |

|---------------|----------------------|

| Average recovery cost (excluding ransom) | $1.85 million |

| Median ransom demand | $2.73 million |

| Companies that paid and got data back | 46% |

| Recovery time exceeding one month | 34% |

Here's the brutal math: **46% of businesses that pay the ransom still lose their data.** You've now paid the ransom AND the recovery costs.

Small businesses typically face ransom demands of $10,000–$500,000 — lower than the enterprise median but still catastrophic for a company with $2M in revenue.

The Hidden Costs: What Nobody Budgets For

The direct costs above are the obvious ones. The hidden costs are often larger.

Downtime and Lost Productivity

According to Gartner, the average cost of IT downtime is $5,600 per minute for mid-size companies. For a small business, the number is lower but still significant:

•**Average SMB downtime after a cyber attack: 21 days** (Hiscox 2024)

•**Average daily cost of downtime for a 20-person company: $3,000–$8,000/day**

•**Total productivity loss over 21 days: $63,000–$168,000**

Customer Loss and Reputation Damage

This is the cost that doesn't show up on any invoice but often exceeds everything else combined.

•**29% of businesses that suffer a breach lose customers** (IBM 2024)

•**Average customer churn cost due to a breach: $1.5M for large companies, $50K–$200K for SMBs**

•**Lost future business is 2-3x the value of lost current customers**

Insurance Premium Increases

If you have cyber insurance (and you should), expect premiums to increase 50-200% after a claim. If you don't have cyber insurance, expect difficulty obtaining it at any price after a breach.

•**Average cyber insurance premium before breach: $1,500–$3,000/year for SMBs**

•**Average premium after a claim: $4,000–$9,000/year**

•**Some carriers drop SMBs entirely after a claim**

Opportunity Cost

Every hour your leadership team spends dealing with a breach is an hour not spent on revenue-generating activities. For a small business owner, this can consume 100+ hours over 2-3 months:

•Incident response coordination

•Customer notification and damage control

•Insurance claims and legal proceedings

•Vendor negotiations for new security tools

•Employee retraining

•Rebuilding systems and processes

Need help with your IT?

Get a free consultation — no obligation, just honest advice for your business.

Get Free Assessment

Total Cost: The Real Number

Let's add it up for a hypothetical 25-person business in the Triangle that gets hit with ransomware:

| Category | Conservative | Severe |

|----------|-------------|--------|

| Forensics & remediation | $25,000 | $75,000 |

| Legal & notification | $15,000 | $50,000 |

| Ransom payment (if paid) | $0 | $100,000 |

| Downtime (21 days) | $63,000 | $168,000 |

| Lost customers | $30,000 | $150,000 |

| Insurance increase (3 years) | $7,500 | $18,000 |

| Employee overtime & retraining | $10,000 | $25,000 |

| **Total** | **$150,500** | **$586,000** |

For a business doing $2-5M in annual revenue, even the conservative estimate is between 3% and 7.5% of a year's revenue — wiped out in a single incident.

**The Hiscox Cyber Readiness Report 2024 puts the average at $108,000 per incident for small businesses.** That aligns with our conservative estimate, which doesn't include ransom payments.

What Prevention Actually Costs

Here's where the math gets encouraging. Preventing 95%+ of these attacks is dramatically cheaper than recovering from one.

| Prevention Measure | Monthly Cost (20 users) |

|-------------------|------------------------|

| Managed endpoint detection (EDR) | $200–$400 |

| Email security & phishing filtering | $100–$200 |

| Multi-factor authentication | $0–$100 (often included in M365) |

| Security awareness training | $100–$200 |

| Backup & disaster recovery monitoring | $150–$300 |

| 24/7 network monitoring | $200–$400 |

| Quarterly vulnerability scanning | $100–$200 |

| **Total prevention cost** | **$850–$1,800/month** |

| **Annual prevention cost** | **$10,200–$21,600/year** |

Compare that to the **$108,000–$586,000** cost of a single incident.

That's a **5-57x return on investment** from prevention. There aren't many business expenditures with that kind of payoff.

> **Want to compare IT support costs for your specific situation?** Use our free IT Cost Calculator to see what managed IT (including security

The Managed IT Approach

For a 20-person company, that's $1,980–$3,500/month for comprehensive IT management AND cybersecurity protection — well under the $108K average breach cost.

What to Do Right Now

If you've read this far and your business doesn't have at least basic cybersecurity protections in place, here are the three highest-impact actions ranked by cost-effectiveness:

1. Enable MFA Everywhere (Cost: $0-$2/user/month)

2. Test Your Team with a Phishing Simulation (Cost: $3-$5/user/month)

3. Verify Your Backups Work (Cost: $0)

Most businesses have backups configured but have never tested a restore. Run a test restore this week. If it fails or takes longer than your business can tolerate, fix it before you need it.

> **Check your password security** with our free Password Strength Checker — no data is sent to any server.

The Bottom Line

Cybersecurity isn't an IT problem. It's a business risk management problem.

The businesses that end up as statistics aren't the ones that couldn't afford security. They're the ones that assumed it wouldn't happen to them.

If you want to see all the underlying data, visit our Cybersecurity Statistics page — 28+ sourced stats from IBM, Verizon, FBI, and Sophos, updated quarterly.

---

*Marshall Durden is the founder of Triangle Tech LLC, a managed IT and cybersecurity company serving small businesses in Raleigh-Durham, NC. For a free security assessment, contact us or call (919

How Much Does a Cyber Attack Actually Cost a Small Business? (2026 Data)

The Problem with Most Cybersecurity Cost Data

The Direct Costs: What You'll Actually Pay

Incident Response and Forensics

Legal and Compliance Costs

Ransomware-Specific Costs

The Hidden Costs: What Nobody Budgets For

Downtime and Lost Productivity

Customer Loss and Reputation Damage

Insurance Premium Increases

Opportunity Cost

Total Cost: The Real Number

What Prevention Actually Costs

The Managed IT Approach

What to Do Right Now

1. Enable MFA Everywhere (Cost: $0-$2/user/month)

2. Test Your Team with a Phishing Simulation (Cost: $3-$5/user/month)

3. Verify Your Backups Work (Cost: $0)

The Bottom Line

Frequently Asked Questions

Related Articles

The Small Business Cybersecurity Guide: Protecting Your NC Business in 2026

Hit by Ransomware? Here's What to Do (And How to Prevent It)

Related Services

Need IT Help?

Contact Us

Want to Learn More?

How Much Does a Cyber Attack Actually Cost a Small Business? (2026 Data)

The Problem with Most Cybersecurity Cost Data

The Direct Costs: What You'll Actually Pay

Incident Response and Forensics

Legal and Compliance Costs

Ransomware-Specific Costs

The Hidden Costs: What Nobody Budgets For

Downtime and Lost Productivity

Customer Loss and Reputation Damage

Insurance Premium Increases

Opportunity Cost

Total Cost: The Real Number

What Prevention Actually Costs

The Managed IT Approach

What to Do Right Now

1. Enable MFA Everywhere (Cost: $0-$2/user/month)

2. Test Your Team with a Phishing Simulation (Cost: $3-$5/user/month)

3. Verify Your Backups Work (Cost: $0)

The Bottom Line

Frequently Asked Questions

Related Articles

The Small Business Cybersecurity Guide: Protecting Your NC Business in 2026

Hit by Ransomware? Here's What to Do (And How to Prevent It)

Related Services

Need IT Help?

Contact Us

Want to Learn More?