Cyber risk costs a business through recurring work as well as losses after an attack: assessing exposure, maintaining safeguards, training staff, preparing response plans and deciding whether insurance fits. There is no universal annual cybersecurity budget in the available figures. Reported incident costs, insurance premiums and prevention spending measure different things and should not be added together as if they were one bill.
Why cyber risk belongs in the operating budget
A business’s systems, staff, suppliers and threats change over time, so cyber risk management is not a one-off purchase. It is continuing operational work: deciding what needs protection, keeping controls usable, preparing people to respond and revisiting those decisions as the business changes.
As an Amazon Associate I earn from qualifying purchases.
The UK Department for Science, Innovation and Technology’s 2025/2026 survey found that 30% of businesses had conducted a cyber-security risk assessment and 25% had a formal incident-response plan. Those figures describe reported adoption in the UK, not a universal standard or a recommended budget. They nevertheless illustrate the recurring work that can sit behind cyber readiness.
What does cyber risk cost a business?
There is no single figure that captures a company’s cyber-risk expense. A useful budget separates three categories: prevention and readiness, insurance premiums, and losses when an incident occurs. A survey’s average loss is not the same as the cost of prevention, and an insurance-market premium total does not show what an individual business should spend.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Reported incident costs are not a full breach-cost estimate
In its 2025 survey of UK businesses, DSIT reported an average self-reported cost of £990 per business for cyber crime excluding phishing when zero-cost responses were included, rising to £1,970 when those responses were excluded. For cyber-facilitated fraud, the corresponding averages were £5,900 and £10,000. These figures vary with the treatment of zero responses; cyber crime results were a subset of all breaches and attacks, not a forecast or a measure of every direct and indirect consequence. DSIT’s 2025 survey sets out the categories and methodology.
The later UK 2025/2026 survey presents a different view: the median perceived cost of the most disruptive breach or attack was £0 among businesses, while the 95th percentile was £4,000 across all businesses and £10,000 among medium and large businesses. These are survey respondents’ perceived costs, not an accounting of all downtime, reputational harm, lost customers or other indirect effects. A low median and a costly minority tail can therefore coexist. The 2025/2026 survey gives the UK-specific results.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Insurance-market totals describe a market, not your quote
The US National Association of Insurance Commissioners (NAIC) reported about $9.14 billion in US direct written cyber-insurance premiums in 2024, with 4,368,614 policies in force and nearly 50,000 reported claims; reported claims rose almost 40%. In Q4 2024, US cyber-insurance rates declined by an average of 5%. Globally, premiums written were nearly $15 billion in 2024. These measures cover different geographies and market activity; none predicts an individual business’s premium or loss. The NAIC’s 2025 market report contains the US data and global premium estimate.
Recommended Free Tools
Which parts of cyber readiness create recurring work?
Assess changing exposure
Review what the business depends on: accounts and devices, customer or employee information, business-critical systems, and suppliers with access to them. An assessment is useful when it informs decisions—what to protect first, who owns each task and what the business would do if a service became unavailable—not merely when it produces a document.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Maintain access controls
Authentication is one concrete example of an operational control that needs attention as accounts and staff change. In the UK 2025/2026 survey, 43% of micro businesses required two-factor authentication, up from 35% the previous year. That is an adoption statistic, not an evaluation of any particular authentication product. A physical security key can be considered for business accounts where the service supports it, but compatibility and account-recovery arrangements matter.
Train people and plan for disruption
Staff need practical guidance for the kinds of requests and incidents they may encounter, along with a clear route for reporting something suspicious. A response plan should identify who makes decisions, who contacts relevant providers, how the business communicates and which operations need priority. Plans need review as roles, systems and suppliers change.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Should a small business buy cyber insurance?
Insurance can transfer some financial consequences of covered incidents; it does not replace safeguards or guarantee that a disruption will be painless. The UK 2025/2026 survey found that 47% of businesses reported some form of cyber insurance, but only 10% had a specific cyber policy. Another 22% did not know whether they had any form of cover. The gap is a practical reason to check existing business policies before assuming either that cyber incidents are covered or that they are excluded.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Whether a dedicated policy is worthwhile depends on the business’s exposure, available response resources, interruption consequences and the policy’s actual terms. Compare limits, retention or deductible, exclusions, conditions and what response support is included. A bundled policy may provide some cyber cover, but its scope can differ from a dedicated policy. The survey figures do not establish a recommendation or a price for any particular small business.
How to build a useful cyber-risk budget
- List critical operations and dependencies. Identify systems, accounts, data and suppliers whose failure would materially interrupt the business.
- Assign ongoing control work. Set ownership for assessment, access controls, staff guidance, backups or other safeguards appropriate to the business, and plan reviews rather than treating setup as completion.
- Prepare for response. Record decision-makers, provider contacts, reporting paths and priorities for restoring critical operations; make sure the plan is known by the people expected to use it.
- Review insurance alongside existing cover. Confirm whether cyber cover is embedded in a broader policy or separately purchased, then assess limits, exclusions, retention and response provisions against the business’s interruption risks.
- Revisit when the business changes. New systems, suppliers, staff responsibilities or services can alter exposure and the effort needed to manage it.
The right budget is therefore a business-specific allocation of recurring staff time, tools or external support, response preparation and any insurance premium—not a number inferred from an average incident loss or a national insurance-market total. The available sources establish the need for continuing decisions, but do not prescribe one annual amount.
When to use internal or external support
Some businesses can assign security ownership internally; others need outside cyber-security support, such as a managed provider, assessment specialist or incident-response service. The choice depends on internal expertise and capacity, the complexity of systems and suppliers, and how quickly the business would need help during a disruption. External support can fill a capability gap, but the business still needs clear ownership of decisions and an understanding of what the service does and does not cover.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
