Research conducted by Kaspersky Lab and B2B International showed that the most costly types of security breaches for businesses are employee fraud, digital espionage, intrusion into corporate networks, and external vendor failures.
The survey surveyed more than 5,500 companies in 26 countries. On average, the cost of recovering from a security incident is $551,000 for large enterprises and $38,000 for small and medium-sized businesses.
A serious breach of information systems security leads to multiple operational problems. With damages varying greatly, it is sometimes difficult for the victims themselves to estimate the total cost of an incident.
The methods used for this research were based on data from previous years to highlight the areas in which businesses have to spend money after a breach or lose money as a result of a breach.
Typically, businesses are required to spend more money on professional services (e.g. external partners, IT specialists, lawyers, consultants, etc.), while also losing revenue due to lost business opportunities and downtime of systems and services.
The likelihood of each consequence also varies, which must be factored in with the size of each company. In this context, a similar method was used to calculate indirect costs, i.e. the funds that businesses have after remediation but are still associated with a security breach.
Thus, in addition to the aforementioned amounts, businesses typically pay from $8,000 (small and medium-sized) to $69,000 (large) for staffing, training, and infrastructure upgrades.
How much do breached businesses pay on average:
- Professional services (IT, risk management, legal): up to $84,000, with an 88% probability
- Lost career opportunities: up to $203,000, with a 29% probability
- Systems and services downtime: up to $1.4 million, with a 30% probability
- Overall average: $551,000
- Indirect costs: up to $69,000
- Including damage to the company's reputation: up to $204,750
Small and medium-sized enterprises and large enterprises: The differences
Nine out of ten businesses surveyed reported at least one security incident. However, not all incidents are serious or necessarily result in the loss of sensitive data. A serious security breach is most commonly the result of malware attacks, phishing attacks, employee data leaks, and the exploitation of software vulnerabilities.
Costing provides a new look at the severity of security incidents, and estimates for small and medium-sized businesses and large businesses are slightly different.
Large companies pay out significantly more when a security breach occurs due to the failures of a trusted external partner or provider. Costly types of incidents include employee fraud, digital espionage, and network intrusion. Small and medium-sized businesses tend to lose a significant amount of money for almost all types of breaches, paying high amounts to recover damages from espionage, DDoS attacks, and phishing.
“To date, there have not been many reports on the consequences of a security incident that quantify the actual monetary loss. Developing a reliable method for calculating an average is difficult, but we realized that we had to do it in order to bridge the theory of the threat landscape for companies with business practice. So now we have a list of the corporate threats that caused the most significant losses. These are the ones we believe businesses should focus on as much as possible,” commented Brian Burke, Head of Marketing Intelligence Team at Kaspersky Lab.
The full report on the cost of security incidents is available on the Kaspersky Lab website
