Saltar al contenido principal

Kaspersky Lab survey shows real business loss from cyberattacks now $861K per security incident

13 de septiembre de 2016

On average a single cybersecurity incident now costs large businesses $861,000. Meanwhile, small and medium businesses (SMB) end up paying $86,500. Most alarmingly, the cost of recovery significantly increases depending on the time of discovery.

On average a single cybersecurity incident now costs large businesses $861,000. Meanwhile, small and medium businesses (SMB) end up paying $86,500. Most alarmingly, the cost of recovery significantly increases depending on the time of discovery. SMBs tend to pay 44% more to recover from an attack discovered a week or more after the initial breach, compared to attacks spotted within one day. Enterprises pay a 27% premium in the same circumstances. These are the main findings of Kaspersky Lab’s report “Measuring the Financial Impact of IT Security on Businesses” based on the 2016 Corporate IT Security Risks survey1.

Budget increases address complexity

In the 2016 survey, Kaspersky Lab for the first time compared an organization’s security budget to losses incurred from serious incidents. Overall, businesses expect IT Security budgets to grow at least 14% over the next three years, due to the increased complexity of IT infrastructure. A typical small businesses currently spends 18% of their total IT budget on security, whereas enterprises allocate 21%. The research shows a significant disparity between businesses of differing sizes, with annual security budget varying from just $1,000 for very small businesses to more than one million US dollars for large companies.

Cost of recovery: employee overtime and more

To estimate the total cost of recovery, Kaspersky Lab and B2B International asked businesses to report their losses from the most serious security incident in different categories. Although the most frequent cost is for additional staff wages, businesses reported significant spending due to lost business opportunities, improvement in IT security, employing external specialists and hiring new staff. Enterprises spend $79K on training and $85K on requesting help from external experts –19% of the total loss.

Talking about ROI

“Based on our worldwide survey, the average IT Security budget is ‘worth’ just 2.5 cyberattacks once all direct and indirect losses are taking into account. With thousands of threats attacking corporate world every day, an efficient cybersecurity definitely pays off. Businesses understand the threat clearly; 59% of SMBs and 62% of enterprises say they will improve their security regardless of an ability to measure return,” comments Vladimir Zapolyansky, Head of SMB Marketing, Kaspersky Lab.
“However, the survey proves that reaction time post-breach has a direct impact on financial losses. This is something that cannot be remedied via budget increases. It requires talent, intelligence and an agile attitude towards protecting one’s business. As a security vendor, our goal is to provide tools and intelligence for businesses of all sizes, keeping in mind the difference in ability to allocate security budgets,” adds Zapolyansky.
The full report titled “Measuring the Financial Impact of IT Security on Businesses” is available at Kaspersky Lab’s website here.  


1 Corporate IT Security Risks is the annual survey conducted by Kaspersky Lab in cooperation with B2B International. In 2016 we have asked more than 4000 representatives of small, medium and large businesses from 25 countries on their views on IT Security and real incidents they had to deal with.

Kaspersky Lab survey shows real business loss from cyberattacks now $861K per security incident

On average a single cybersecurity incident now costs large businesses $861,000. Meanwhile, small and medium businesses (SMB) end up paying $86,500. Most alarmingly, the cost of recovery significantly increases depending on the time of discovery.
Kaspersky logo

Sobre Kaspersky

Kaspersky es una empresa de ciberseguridad y privacidad digital global fundada en 1997. Con más de mil millones de dispositivos protegidos hasta la fecha ante ciberamenazas emergentes y ataques dirigidos, la enorme experiencia de Kaspersky en cuestión de información y seguridad ante amenazas se transforma de forma constante en soluciones y servicios innovadores que ofrecen protección a negocios, infraestructuras vitales, gobiernos y consumidores de todo el mundo. El completísimo catálogo de la compañía incluye los mejores productos y servicios de protección de terminales, así como soluciones de ciberinmunidad para combatir amenazas digitales sofisticadas y en constante evolución. Ayudamos a que más de 200 000 clientes corporativos protejan aquello que más les importa. Más información en www.kaspersky.es.

Artículo relacionado Comunicados de prensa