What incident response actually costs

Small businesses typically pay $120,000 to $1.24M to respond to and resolve a security incident. That figure covers forensic investigation, legal counsel, breach notification and credit monitoring, and emergency IT remediation — often before operations even fully stabilize. Bare-minimum system recovery alone can run $15,000–$50,000.

Compare that to prevention: a comprehensive cybersecurity program for a 50-person company typically runs $75,000–$150,000/year — a small fraction of even the low end of that breach-cost range. A tested incident response plan is one of the biggest cost reducers in IBM’s Cost of a Data Breach research, cutting average breach costs by well over $1M in recent years.

Why cyber insurance often doesn’t pay out

Most denials aren’t fraud — they’re gaps between what a business claimed on its application and what was actually running when the attack hit. 82% of denied cyber insurance claims involved organizations without fully implemented MFA, and 41% of applications are denied on first submission, most often over missing MFA or inadequate endpoint protection.

In Travelers v. International Control Services (2022), Travelers discovered after a ransomware attack that MFA wasn’t as fully deployed as the company had attested on its application. Rather than litigate, the parties agreed to a stipulated judgment voiding the policy from inception — leaving the ransomware claim unpaid.

The City of Hamilton, Ontario faced a similar outcome on a much larger scale: after a February 2024 ransomware attack that cost the city roughly $18.4M to recover from, its insurer denied a $5M claim because MFA hadn’t been consistently enforced across every department — despite being partially rolled out.

Source: CBC News →