The Threat Floor: What Security Actually Costs a Small Business

Most small-business breaches in 2026 come through an unpatched appliance, an account without a second factor, or a backup nobody has restored. None of that is clever, and the six controls that close those gaps cost a 50-person firm between $10,500 and $44,000 a year. The incident they prevent costs more, and the distance between those two numbers is the case for spending before you have a reason to.

I call that spend the threat floor: what a firm pays just to be a normal, defensible business, before any of the interesting security work matters. Below the floor, every other purchase is decoration. Above it, you can make risk decisions with a straight face.

The figures here are the newest I could verify at the time of writing: the FBI’s complaint data, Verizon’s breach data, IBM’s cost survey, and Sophos’s ransomware survey of firms with 100 to 5,000 employees. The only public dataset I know of that asks small organizations what incidents cost them is the UK government’s breach survey, so I use that too. Where a number describes large enterprises, I say so.

What the FBI’s numbers actually count

The FBI’s Internet Crime Complaint Center logged 1,008,597 complaints in 2025, with reported losses of $20.877 billion, a 26 percent increase over 2024. The average loss per complaint was $20,699. Those figures get quoted everywhere and then misread, because they count what people chose to file with a federal tip line, not what a breach costs a business.

Split the total apart and the shape changes. Investment fraud accounted for $8.65 billion, business email compromise $3.05 billion, and tech support scams $2.13 billion. Phishing and spoofing produced the most complaints, 191,561, but only $215.8 million in reported losses, about $1,130 per complaint. Volume and damage are different distributions. The crimes that empty an account pay far better per victim than the ones that fill an inbox.

BEC is the number I would put in front of an owner. 24,768 complaints produced $3.05 billion in losses, about $123,000 per complaint. The report’s transaction breakdown shows 86 percent of BEC losses moved by wire transfer or ACH. That is a payment-controls failure wearing a cybersecurity costume. A firm can pass a penetration test and still wire $123,000 to a fake vendor because nobody called a known number to confirm the change.

Ransomware tells the opposite story: 3,611 complaints and $32.3 million in reported losses. Nobody should read that as the cost of ransomware. It is the residue victims bothered to report, and it misses most ransom payments and nearly all recovery bills. The IC3 data ranks fraud categories well and sizes operational recovery badly.

AI now appears as a descriptor with real weight: 22,364 complaints tagged as AI-related, carrying $893 million in losses. In practice that means synthetic voices, generated text, and fabricated documents used inside ordinary fraud. The tool changed. The target is still a person with the authority to approve a payment.

The way in is a known vulnerability

Verizon’s 2026 Data Breach Investigations Report, released 19 May 2026, found that exploiting a vulnerability was the starting point for 31 percent of breaches. In 19 years of the report, that is the first time exploitation beat stolen credentials. The same release puts social engineering over text and voice at roughly 40 percent more success than email phishing. It also finds third-party involvement in 48 percent of breaches, a 60 percent rise, and frequent use of unapproved AI tools at work up from 15 percent to 45 percent of employees in a single year.

Read those four findings as a map of a 40-person company. The vulnerability is the VPN concentrator, the firewall management page, the file transfer appliance, or the web application the sales team bought on a card. The social engineering is a text to accounts payable. The third party is the payroll bureau and the IT provider. Shadow AI is the assistant someone pasted a contract into.

None of it requires a novel attack. CISA maintains the Known Exploited Vulnerabilities catalog precisely because attackers reuse the same flaws for months after a patch exists. Rank patching by what is being exploited rather than by severity score and a two-person IT team can keep pace with the part that matters. The catalog is free, CISA’s scanning service is free, and the constraint is the hours to act on the output.

Why the global average does not describe your company

IBM’s 2026 Cost of a Data Breach report puts the global average at $4.99 million, a 12 percent increase and a record high, with a 56 percent rise in AI-driven attacks led by deepfake impersonation and AI-enabled malware. The number is real. It is also not yours. An average over a global sample describes the sample; the components that make it large, lost business and detection-and-escalation time, scale with revenue and with how long the firm is down. A company earning $8 million a year cannot lose $4.99 million in business. It can lose the company. Quoting the average in a board meeting buys paralysis or contempt, and both are expensive. I made the longer argument about what that report measures separately.

A closer comparison comes from Sophos’s 2026 ransomware survey, which drew 2,158 responses from organizations of 100 to 5,000 employees between January and March 2026. Mean recovery cost, excluding ransom, was $1,700,200. The median was $375,000, and 19 percent spent between $1 million and $5 million. Among the smallest firms surveyed, 100 to 250 employees, only 34 percent stopped an attack before encryption, against 46 percent of the largest.

Then there is the part most surveys leave out. The UK’s Cyber Security Breaches Survey 2025/2026, published 30 April 2026, found that the median perceived cost of a business’s most disruptive breach was zero pounds, and that the 95th percentile for micro and small businesses was £4,000. Most incidents cost little. A minority cost the firm. Both are true, and planning for a blend of the two is how companies end up underinsured and overconfident at the same time.

The six controls that make up the floor

Every serious framework converges on the same short list. CISA’s guidance for small businesses divides the work by role: the CEO sets the culture and approves the incident plan, a named program manager drives it, and the IT lead handles the technical controls. NIST’s Cybersecurity Framework 2.0 organizes the same work into six functions and ships a quick-start guide written for firms with modest or no security plans. The CIS Controls rank the actions by how well they defeat attacks that actually occur. The cybersecurity archive goes deeper on each; here I compress all of it into six things a small firm has to pay for.

Identity. MFA on every account that touches money, email, or administration, with phishing-resistant authentication for administrators and email, and no standing local admin rights on laptops. CISA’s page is blunt that any MFA beats none and that only FIDO-style authentication resists a real phishing proxy.

Patching, ranked by exploitation. Internet-facing systems first, then everything on the KEV list, with automatic updates wherever the vendor supports them. The measure is how long your worst exposed system stayed vulnerable after a known exploit existed, not how many patches you applied last quarter.

Endpoint detection on every machine, including the owner’s laptop and the one the bookkeeper uses at home. Small firms get compromised through the least-managed device in the company, and that device is usually missing from the asset list.

Backups with a restore test. CISA notes that many ransomware victims had no backups or damaged ones, and that restore time routinely exceeds expectations. A backup nobody has restored is a hope with a retention policy.

Training that ends in a report. Quarterly phishing simulation is table stakes. Given the shift to voice and text, the training also has to cover a call from “the bank” and a text from “the CEO.” The output you want is a staff member who reports the attempt within five minutes, not a quiz score.

A written incident plan with one owner. Two pages, printed, with names and phone numbers, because the network may be the thing that is down. Rehearse it quarterly with the people who can authorize spending. Only 25 percent of businesses in the UK survey had a formal incident response plan, and 21 percent of micro businesses did.

What the floor costs

The table prices those six controls for a 50-seat firm. The cost column is my planning range for 2026, built from labor hours at a $75 loaded hourly rate plus per-seat tooling, and it assumes the firm already pays for a business productivity suite. These are estimates to argue with, not quotes. Change the hours or the rate and you get your own floor. The right-hand column is sourced.

Control	What it covers at 50 seats	Annual cost	What failure costs
Identity	MFA on email, finance, and admin accounts; FIDO for administrators; no standing local admin	$0–$3,000	BEC complaints averaged about $123,000 in reported losses in 2025 (IC3)
Patching	KEV-first patching, automatic updates, CISA scanning enrollment, weekly review of what is exposed	$3,000–$9,000	31% of breaches start with vulnerability exploitation (Verizon, 2026)
Endpoint detection	Agent and logging on every laptop and server, including the owner’s	$3,000–$12,000	Ransomware recovery: $375,000 median, $1.7 million mean (Sophos, 2026)
Backup and restore	Immutable or offline copies, quarterly restore test with timing	$1,500–$6,000	No usable backup means rebuilding on someone else’s schedule (CISA)
Human layer	Onboarding training, quarterly phishing simulation, text and voice drills	$1,000–$4,000	Mobile social engineering succeeds about 40% more often than email phishing (Verizon, 2026)
Response	Two-page plan, named owner, quarterly tabletop, DFIR contact arranged in advance	$2,000–$10,000	3% of ransomware victims took more than three months to recover (Sophos, 2026)
Total, 50 seats		$10,500–$44,000	$210–$880 per seat per year

Set the total against a single BEC at roughly $123,000, or a ransomware recovery at the $375,000 median. The floor is affordable in the sense that matters: it is a budget line, not a capital event. What makes it feel expensive is that the benefit arrives as an absence. Nobody gets a plaque for the breach that did not happen, and the person who insists on the spending is rarely the person who would have been blamed.

Where the money goes wrong

The most common failure I see in assessments is buying detection before identity. A firm licenses an endpoint platform, pushes it to most machines, and leaves the finance director’s mailbox without MFA because enrollment was inconvenient during quarter close. The coverage chart looks good and the account that can authorize a wire is open.

The second is treating insurance as a control. A policy transfers part of the financial tail, after deductibles and exclusions, and does nothing about the four days when nobody can invoice. The rest of the exposure stays on your balance sheet, which is where the risk register belongs, not the insurance file.

Then there is buying against headlines. News about MFA bypass prompts another authentication product; news about agents prompts an AI security product. The appliance from 2021 stays unpatched, because patching is nobody’s project and everybody’s interruption. Tools are easy to buy and hard to own, so they accumulate while the boring work waits for a quiet week.

The last is spending on the tail you cannot survive before the floor you can afford. If four days of downtime would end the business, a bigger detection budget is not the answer. A tested recovery plan, a line of credit, and an honest conversation with your largest customer are. That is the part of the risk register most small firms never write down, and the part that decides whether an incident is a bad month or the last one.

What this means for operators

The floor is an operating cost, and it should be budgeted per seat the way you budget a phone or a laptop. Firms that fund security as a series of projects restart the same work every time a project ends, which is why the same MFA gap reappears in every audit and the same findings get re-sold every two years.

Ownership is the control that makes the other five hold. CISA’s structure, one named program manager reporting to the CEO monthly, is the most useful thing in its guidance and the part small firms skip. My view: a firm without a named owner does not have a security program. It has purchases and a hope.

Evidence is what converts spending into defensibility. Enrollment reports, patch reports, restore logs, and tabletop notes are the artifacts insurers, customers, and regulators ask for. If you cannot produce the report, then from their side of the table the control does not exist. That is also the practical answer to who should own this work: the person who can produce those reports every quarter, not the person with the longest title.

And the response side needs to be real before it is needed. The order of operations after a compromise, isolate, preserve, notify, then clean, is where small firms do the most self-inflicted damage. I wrote the sequence down in The First 72 Hours After a Breach because the decisions made in the first hour cost more than the ones made in the first week.

What to do

1. Price the floor at your seat count before the next renewal. Multiply headcount by $210 and $880 to get the range, then check which of the six you already pay for. Start with the productivity suite you own and confirm what it includes before buying anything new.
2. Close the MFA gap within 30 days. Pull the enrollment report for email, finance, and every administrative account. Fix exceptions, then make enrollment a condition of the next password reset. Report the number to the owner monthly until it reaches 100 percent.
3. Patch by exploitation, not by severity. Put every internet-facing system on a weekly review against CISA’s KEV catalog and set a written deadline for critical items. Enroll in CISA’s free scanning so you learn what is exposed before someone else does.
4. Restore one system from backup and time it. Pick the system you would miss most, restore it to a clean environment, record how long it took, and fix what broke. Repeat quarterly and keep the log, because the log is the evidence.
5. Write the two-page plan and name one owner. Names, phone numbers, order of decisions, and who can authorize emergency spending. Have it approved by the person who signs checks, not by IT alone.
6. Rehearse wire fraud instead of a hacker movie. Send the team a fake invoice with changed bank details and time how long it takes them to call a known number. Since 86 percent of BEC losses move by wire or ACH, the control is a callback rule with no exceptions, including for the CEO.
7. Hold the next tool purchase until the six have evidence. Before signing, ask which control the tool improves, who owns it, and what report it produces. If the answers are vague, it is a subscription rather than a control, and it belongs in next year’s budget.

The decision I would put in front of an owner this quarter: does the floor become a line item with a named owner and a quarterly report, or does it stay a set of projects that restart whenever something in the news scares people? One of those gets cheaper every year, and the 2026 data favors the firm that picks it: the attacks arrive through known gaps, the cheap controls close those gaps, and the average breach cost in the press describes somebody else’s company.

Sources

1. 2025 Internet Crime Report — FBI Internet Crime Complaint Center, 2026-04.
2. Vulnerability exploitation top breach entry point, 2026 industry-wide DBIR finds — Verizon, 2026-05-19.
3. Cost of a Data Breach Report 2026 — IBM, 2026.
4. The State of Ransomware 2026 — Sophos, 2026.
5. Cyber security breaches survey 2025/2026 — UK Department for Science, Innovation and Technology, 2026-04-30.
6. Cyber Guidance for Small Businesses — CISA, updated 2024-04.
7. Known Exploited Vulnerabilities Catalog — CISA, accessed 2026-08-12.
8. Cyber Hygiene Services — CISA, accessed 2026-08-12.
9. NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide — NIST, 2024-02-26.
10. The NIST Cybersecurity Framework (CSF) 2.0 — NIST, 2024-02-26.
11. CIS Critical Security Controls v8.1 — Center for Internet Security, 2024-06.