We all know that cybersecurity should be a priority. Cyberattacks are frequent, and the cost of a breach can be devastating. In fact, 60% of small businesses close within six months of an attack. Yet, a significant number of small businesses skimp on cybersecurity. For example, 43% of small to medium-sized businesses don’t have a recovery plan for cybersecurity incidents.
Cybersecurity for SMBs is particularly challenging. Small businesses are running fast, often strapped for time and money, and they frequently lack internal cybersecurity professionals. What’s a small business to do? And how can they balance the cost of cybersecurity against the risks and potential losses from cybercrime?
Let’s look at the potential costs and explore the steps SMBs can take without breaking the bank.
The Cost of Cybercrime
There’s no doubt about it. The price of cybercrime is high: with an estimated global cost of $10.5 trillion. Small businesses pay their share, too. The average cost per cyberattack for SMBs is around $25,000. The cost doesn’t come in dollars alone, though. A successful cyberattack can result in:
- Downtime for your business—with all the revenue loss that entails.
- Reputational impacts—from downtime or a data breach. This can lead directly to losing customers.
- Data loss—which can be devastating to some businesses. Nearly 40% of small businesses report losing crucial data due to cyberattacks.
- Recovery costs—whether it’s paying the ransomware price, spending time and resources recovering data and shoring up systems, or both.
Cyberattacks take many forms, and cybercriminals are continually evolving their tactics. Here are just some examples of attacks on small businesses, and the impact they had.
- A small hardware store was infiltrated when an employee opened an innocent-looking file attached to an email. The next day, stock orders and cash registers malfunctioned, resulting in $50K of loss revenue, and $128K in incident and recovery costs.
- A small healthcare company, Practice Resources LLC, which provides billing and related services, was hit with a ransomware attack. The attack resulted in 924,138 patient records being exposed. Subsequently, a lawsuit was filed against the company on behalf of patients whose data was compromised.
How much does a cyberattack cost a small business?
Many factors contribute to the cost of a cybercrime, and they can all add up quickly. Every attack is different, but there are a variety of direct and indirect costs, including the following.
1. Downtime and loss of productivity
One of the most immediate and significant costs for small businesses is downtime. Systems may be offline for hours or even days and can halt operations entirely. Downtime alone can cost small businesses anywhere from $8,000 to $20,000 per hour.
2. Remediation and recovery costs
Once a cyberattack occurs, you have to conduct a remediation process to fix the vulnerabilities and restore operations. Most small businesses don’t have in-house expertise: they must hire a cybersecurity professional. On top of that, they may need to restore data from backups or hire consultants to prevent future incidents.
For small businesses, the average cost to remediate a ransomware attack alone is $60,000.
3. Legal fees and regulatory fines
Cybercrime often results in legal fees and regulatory fines, especially if the breach involves customer data or violates industry-specific compliance regulations. Companies may also be liable for customer data breaches. These fees and fines can put a small business out of business.
Legal fees can easily run into the tens of thousands of dollars. Companies in regulated industries (such as healthcare and finance) can see data breach costs rise by $1 million to $2 million or more due to fines and penalties.
4. Reputational damage and customer trust
Brand damage from a cyberattack can be devastating for small businesses. Customers are less likely to trust a company that has been involved in a breach, especially if personal or financial data was compromised. This can lead to lost business, negative media coverage, and long-term damage to the business’s reputation.
5. Increased cybersecurity and insurance costs
Once an attack has happened, small businesses are usually forced to take steps to improve their cybersecurity posture, including cybersecurity insurance. Unfortunately, cybersecurity insurance premiums tend to rise after an attack, adding to the financial burden. Businesses may see their cyber insurance premiums rise by 30% to 50% after an attack.
As you can see, the costs of an attack add up fast. Ultimately, becoming a victim of a cyberattack will cost more than taking the steps to prevent the attack in the first place.
The Cost of Cybersecurity for Small Businesses
Investing in comprehensive cybersecurity measures can be expensive, but the consequences of not investing can be even more expensive. Just what is involved and how much will it cost your small business to shore up your cybersecurity?
To protect your thriving small business, experts suggest dedicating 5-10% of your IT budget to robust security solutions i.e. basic malware protection and data backup services.
You should consider going further, though. For example, you might consider adding services like:
Threat intelligence – Systems or platforms that collect, analyze, and interpret data related to cyber threats. Threat intelligence tools help businesses improve their ability to detect and respond to threats in real-time.
Penetration testing – The practice of simulating real-world cyberattacks to identify security vulnerabilities that could be exploited, so they can be addressed.
Incident response planning – Defining the process for identifying, managing, and mitigating the effects of a security breach or cyberattack, so you’re prepared if one happens.
When working with a managed service provider, many cybersecurity services will be part of a comprehensive plan. Generally, the cost is based on number of users and will range from $20/user/month to $100/user/month. Services and tools may be included in that cost. This compares to $75,000 to $120,000 per year plus tools for an in-house cybersecurity specialist.
Taking the first steps to protect your small business from cyberattack
Small businesses can take several steps to protect themselves from cyber threats. Safeguard your business from cybercrime by using these strategies:
1. Train employees on cybersecurity best practices: Invest in training staff on cybersecurity including identifying phishing emails, avoiding clicking on suspicious links, and using strong passwords.
2. Implement strong password policies: Implement strong password policies, including password complexity requirements and regular password changes. This alone can help prevent cybercriminals from accessing sensitive information through weak or easily guessable passwords.
3. Proactively guard your software & systems: Always employ the latest security updates to stay ahead of online thieves. Ensure your software, systems, and data are secure. This proactive strategy can help protect against potential vulnerabilities that malicious actors could exploit.
4. Make use of anti-virus and anti-malware software: Anti-virus and anti-malware programs are designed to protect critical business data from being. These formidable defenses swiftly identify and eliminate malicious programs, preventing irreversible damage to your systems.
5. Implement firewall protection: Implement firewall protection to monitor and control incoming and outgoing network traffic. This can help prevent unauthorized access to sensitive information and block malicious traffic.
6. Backup data regularly: Regularly back up your data to protect against data loss due to cyber-attacks. To guarantee your backup information stays secure and uncorrupted, it is vital to store it safely in a remote spot, away from the risk of cyberattacks.
7. Use two-factor authentication: Add an extra layer of protection with two-factor authentication for your account logins. It’s key to preventing unwanted access. (This includes requiring users to provide a unique code sent directly to their phone.)
Taking these first steps will help reduce the risks of a data breach.
Don’t Wait Until It’s Too Late
As a small business, you have limited money and resources. You may also lack the specialized personnel to implement and manage security. This makes small businesses like yours especially vulnerable to malicious attacks. Yet, as a small business, you can least afford the consequences of an attack.
That’s why it’s important to invest in security measures. Given the immense monetary damage that a cyberattack can cause, budgeting for and allocating funds toward cybersecurity is a sensible choice. One that you won’t regret when your company is under attack.
BlackPoint IT can help your business achieve its security goals while minimizing IT costs. Our services cover cybersecurity assessments, network administration, server maintenance, cybersecurity implementation, data backup, and more. Contact us today, and let’s explore how we can work together to elevate your business.
