The True Cost of a Cyberattack for Businesses — and the Price of Protection
Discover the real costs of a cyberattack for SMEs: downtime, recovery, fines, and reputation. See how this compares to the cost of basic security measures.
A cyberattack on a small or medium-sized enterprise (SME) costs far more than just a ransom payment or computer repairs. The largest portion of the cost comes from business downtime, lost employee hours, system recovery, potential fines, and the loss of customer trust. When everything is added up, protection is almost always significantly cheaper.
TL;DR — Key Takeaways
- The highest cost of an attack is usually business downtime, not technical recovery.
- A company with 20 employees can lose tens of thousands of euros in just one week of downtime.
- Basic protection (MFA, EDR, backup, training) costs a fraction of that loss.
- You can calculate the impact on your own business using the formula below.
Components of a Cyberattack Cost
| Item | Description |
|---|---|
| Business Downtime | Employees cannot work, orders are halted |
| System Recovery | IT specialist labor, new equipment, forensics |
| Data Loss | Data re-entry, lost documents |
| Legal Consequences | Breach notification, potential fines under GDPR or NIS2 |
| Reputation | Lost customers and business opportunities |
| Ransom | Payment does not guarantee data recovery and is not recommended |
A Simple Calculation
Cost of Downtime = Number of Employees × Average Hourly Cost × Hours of Downtime + Lost Revenue. Example: 20 employees × 25 EUR × 40 hours = 20,000 EUR just for unproductive hours, excluding lost orders and recovery. Real downtime following ransomware often lasts several days to several weeks.
How Much Does Protection Cost?
| Measure | What it Prevents |
|---|---|
| MFA for all accounts | Prevents most breaches from stolen passwords |
| EDR on all devices | Stops the spread of malicious code |
| Immutable backup | Protects against encryption extortion |
| Employee training | Defends against successful phishing |
| Regular updates | Fixes known vulnerability exploits |
Most of these measures are included in Microsoft 365 Business Premium licenses and monthly IT support — the cost is predictable and usually represents only a fraction of a single day of downtime.
Ransomware Attack Response10 steps in the first 24 hours.Frequently Asked Questions
- Does insurance cover a cyberattack?
- Cyber insurance can cover part of the costs, but insurers increasingly require MFA, backups, and EDR as a condition for coverage.
- Should we pay the ransom?
- We do not recommend it — payment does not guarantee data recovery and funds future attacks.
- Where should I start with a limited budget?
- MFA, tested backups, and updates provide the most value for the least investment.
Related posts
Business Continuity Plan: What a BCP for SMEs Must Include
What do we do if nothing works tomorrow morning? A 10-page BCP is all you need.
IT SupportIT Infrastructure Documentation: What Needs to be Recorded and Why
If it isn't documented, it doesn't exist. The minimum documentation scope every company needs.
CybersecurityTwo-Factor Authentication: Implementation Without Employee Resistance
MFA stops the vast majority of stolen password attacks. Learn how to deploy it quickly and without complaints.