Question 1

How much does a ransomware attack cost a small business?

Accepted Answer

Most of the cost of a ransomware attack is not the ransom — it is the downtime. When you add lost revenue, lost staff productivity, and recovery (forensics, rebuild, legal, and breach notification), a serious incident commonly runs from the tens of thousands into the hundreds of thousands of dollars for an SMB. The average ransomware outage lasts roughly three weeks. Use the calculator to model an illustrative range for your size and downtime.

Question 2

What makes up the cost of a ransomware attack?

Accepted Answer

Three big buckets before any ransom: lost revenue while you cannot operate, lost staff productivity for people who cannot do their jobs, and recovery costs — incident response, forensics, rebuilding systems, legal advice, and notifying affected customers. On top of that sit harder-to-quantify losses like customers who never come back and reputational damage.

Question 3

Is it cheaper to prevent ransomware than to recover from it?

Accepted Answer

Almost always. Managed security for a small or mid-size business runs a few hundred to a few thousand dollars a month, while a single serious ransomware incident routinely costs many multiples of a full year of that protection. Prevention — MFA, endpoint detection and response, tested backups, and an incident response plan — is a fraction of the cost of one attack.

What would a ransomware attack actually cost you?

How many people work there?

Annual revenue?

Days of downtime