The True Cost of a Cyberattack for Businesses — and the Price of Protection
Discover the real costs of a cyberattack for SMEs: downtime, recovery, fines, and reputation. See how this compares to the cost of basic security measures.
A cyberattack on a small or medium-sized enterprise (SME) costs far more than just a ransom payment or computer repairs. The largest portion of the cost comes from business downtime, lost employee hours, system recovery, potential fines, and the loss of customer trust. When everything is added up, protection is almost always significantly cheaper.
TL;DR — Key Takeaways
- The highest cost of an attack is usually business downtime, not technical recovery.
- A company with 20 employees can lose tens of thousands of euros in just one week of downtime.
- Basic protection (MFA, EDR, backup, training) costs a fraction of that loss.
- You can calculate the impact on your own business using the formula below.
Components of a Cyberattack Cost
| Item | Description |
|---|---|
| Business Downtime | Employees cannot work, orders are halted |
| System Recovery | IT specialist labor, new equipment, forensics |
| Data Loss | Data re-entry, lost documents |
| Legal Consequences | Breach notification, potential fines under GDPR or NIS2 |
| Reputation | Lost customers and business opportunities |
| Ransom | Payment does not guarantee data recovery and is not recommended |
A Simple Calculation
Cost of Downtime = Number of Employees × Average Hourly Cost × Hours of Downtime + Lost Revenue. Example: 20 employees × 25 EUR × 40 hours = 20,000 EUR just for unproductive hours, excluding lost orders and recovery. Real downtime following ransomware often lasts several days to several weeks.
How Much Does Protection Cost?
| Measure | What it Prevents |
|---|---|
| MFA for all accounts | Prevents most breaches from stolen passwords |
| EDR on all devices | Stops the spread of malicious code |
| Immutable backup | Protects against encryption extortion |
| Employee training | Defends against successful phishing |
| Regular updates | Fixes known vulnerability exploits |
Most of these measures are included in Microsoft 365 Business Premium licenses and monthly IT support — the cost is predictable and usually represents only a fraction of a single day of downtime.
Ransomware Attack Response10 steps in the first 24 hours.Frequently Asked Questions
- Does insurance cover a cyberattack?
- Cyber insurance can cover part of the costs, but insurers increasingly require MFA, backups, and EDR as a condition for coverage.
- Should we pay the ransom?
- We do not recommend it — payment does not guarantee data recovery and funds future attacks.
- Where should I start with a limited budget?
- MFA, tested backups, and updates provide the most value for the least investment.