Defensible Cyber Risk
Defensible Cyber Risk LLC
Security Budgeting
Real-World StoriesPart 1 of 4

What a Breach Actually Costs a Small Organization

Security budget conversations usually start with a feeling, not a number. Here is what breach response actually costs, broken down by size and by category, so the conversation can start with the second one instead.

7 min read

Every organization eventually has the security budget conversation. It usually goes one of two ways. Either a number gets picked because it feels responsible (a few thousand dollars, rounded to something that sounds reasonable), or the number gets picked because it feels affordable: whatever is left over after everything else is funded. Neither number is connected to what an actual incident would cost. That disconnect is the starting point for this series.

This post is not about scaring anyone into spending more. It is about replacing the feeling with a number, because that number is the only thing that makes the rest of this series (how to spend your first five thousand dollars, where budgets get wasted, and how to have this conversation with a board) actually useful.

$15K–$200K our estimated planning range for total incident cost at organizations under 50 employees, anchored to insurance claims data
$142K average total incident cost for organizations under $50M in revenue, per NetDiligence's 2025 Cyber Claims Study of more than 10,000 insurance claims
$4.99M 2026 global average cost of a data breach across all organization sizes, according to IBM

That $4.99 million global average is real, and it is also not your number. It is pulled sharply upward by breaches at organizations with millions of customer records and dedicated legal departments. For an organization with fewer than 50 employees, the more honest range is much smaller, and much more useful to actually plan around.

What size actually predicts

Insurance claims data broken down by organization size shows a consistent pattern. In NetDiligence's 2025 Cyber Claims Study, which analyzed more than 10,000 real cyber insurance claims from 2020 through 2024, organizations under $50 million in revenue averaged $142,000 in total incident cost, and forensics alone averaged about $41,000 of that. Cost does not scale down proportionally with size, because a meaningful share of incident cost is fixed. Forensics work has a base fee whether ten records or ten thousand were exposed. Notification is charged per affected person, and that rate does not get cheaper because your organization is small. That is why a small incident can still be disproportionately expensive relative to its scale.

The ranges below are our estimates by headcount, anchored to that claims data. The claims study groups organizations by revenue rather than employee count, and a handful of very large claims pull its averages upward, so treat these as planning ranges rather than predictions.

Micro organizations (1–9 employees)
Fixed costs dominate: forensics base fee, legal, notification
$15,000–$50,000
Small organizations (10–49 employees)
Fixed costs plus early business interruption
$50,000–$200,000
Medium organizations (50–249 employees)
Per-record and lost-business costs start to dominate
$200,000–$1,000,000

If your organization sits in the first two rows, and most of the small businesses and nonprofits this blog is written for do, that is the range worth holding in your head during a budget conversation. Not $4.99 million. Not zero.

Where the money actually goes

"Incident cost" sounds like a single number, but it is really a stack of separate bills, and most organizations have never seen the stack broken apart. Here is roughly what it looks like once an incident is underway.

External incident response and forensicsSpecialized responders typically bill $250–$600 per hour, with some specialized work billing higher; a complex case can exceed $100,000 in fees alone. Claims data puts average forensics cost at about $41,000 for organizations under $50 million in revenue.
$10K–$100K+
Legal counselBreach notification law varies by state, and most organizations need counsel to determine what is actually required and when.
Varies
Notification and credit monitoringCharged per affected person, at a rate that does not shrink because your organization is small.
Per-record
Executive and staff time divertedCovered in detail below. It is one of the largest and least-budgeted costs of any incident.
$10K–$20K+

The cost almost nobody puts in the budget conversation

The bills above are the ones an organization expects. The one that consistently surprises leadership is the cost of its own people's time. During an active incident, executive and IT staff time gets consumed at a rate that is easy to underestimate until you price it out.

A two-hour incident meeting with six leaders, at a fully loaded cost of $150 to $250 per hour each, runs roughly $1,800 to $3,000. During the first week of a real incident, meetings like that often happen daily. A parallel technical working session with three or four IT and security staff, at a lower hourly rate but a longer duration, adds another $900 to $1,200 per session. Multiply those by a week of active response, and the internal time cost alone runs $10,000 to $20,000 or more, a cost that never shows up on an invoice.

The honest framing: None of this is meant to produce fear. It is meant to produce an accurate number, because an accurate number is the only thing that makes a security budget decision rational instead of emotional. A few thousand dollars a year to reduce the likelihood of a $50,000 to $200,000 incident is not a hard trade once the second number is real.

What this series covers

The rest of this series turns that comparison into an actual plan. The next post walks through exactly how to spend your first $5,000 on security, sequenced by impact, with real 2026 pricing. The post after that covers the three most common ways small organizations waste the budget they do allocate. The series closes with the specific questions a board or leadership team should be asking about the number, not just approving it.

None of it requires guessing. The cost of doing nothing is a real, researchable number. So is the cost of doing something about it.

Sources
  1. IBM, Cost of a Data Breach Report 2026 (2026).
  2. NetDiligence, Cyber Claims Study 2025 Report (2025), Tables 3 and 4, p. 52.
Responder hourly rates, internal staff time costs, and the headcount-based cost ranges are Defensible Cyber Risk estimates based on practitioner experience, anchored to the claims data above.

Want a real number for your organization specifically?

A 30-day Security Business Review gives you a prioritized picture of your actual exposure, not a generic industry average, so your next budget conversation starts with your number.

Start a Conversation
Security Budgeting Breach Costs Real-World Incidents Small Business Nonprofit Security Risk Management