What’s the average cost of a cybersecurity data breach?

This is a question that I’m often asked to comment on and the reality is that it’s a figure that most people underestimate.

Accenture report that the cost for an Enterprise is somewhere between £600,000 and £1,115,000 but according to the Cyber Intelligence Research Group, 70% of all cyber-attacks are aimed at small businesses who typically have less security in place than their corporate counterparts (and are therefore easier targets). The UK Government’s figures report the average cost of a data breach for an SME at £310,000 per incident.

It’s interesting by comparison that in a recent Experian survey, they found that SME business owners estimated the cost to be circa £180,000 which is a big difference. I think one of the issues with sizing the expense of a data breach is that it depends what costs are being measured.

What is known, is that all the different reports are showing 100% ongoing annual increases in their figures, which is a major issue for the board of any sized business.

I’m also clear that the costs are only going to increase and in my experience businesses of all sizes are ill prepared for this.

Spear Phishing aimed at the board (otherwise known as Whaling or CEO Cybercrime) is rife. There is a successful attack every 15 minutes in the UK. This shows that current levels of cyber awareness within businesses are inadequate. The GDPR regulations which became law in May 2018 brought with them the expectation that staff are regularly and effectively educated, and it is something that the Information Commissioner expects to see as a sign that the organisation is taking the security of their client’s data seriously.

Cifa’s annual report Fraudscape released in April 2018 showed that identity fraud is rising and 80% of all fraudulent applications are made on-line.