The Real Cost of a Security Breach

When we leave our homes and cars, we lock the doors. Interactive doorbells and cameras alert us to motion on our properties. Subscription services allow for monitoring and recording of front porches and backyards. If such measures aren’t in place, we risk physical and emotional loss.  

Is protecting your business different? The cost of a security breach isn’t just financial. It can impact your reputation, your recovery, and the overall morale of your business. Continuity and protection go beyond the role of one single department. Attention to cybersecurity and operational resilience is imperative from an overall business perspective.  

The Dangers Lurk

Before looking into the actual cost of a security breach, it is important to understand some of the main sources of today’s security attacks. Forbes reported that in 2023, there were 72% more data breaches since the previously number recorded in 2021. This amounted to 2,365 cyberattacks impacting 343,338,964 victims. Email remains the primary conduit for malware, with a staggering 35% of malicious software being distributed through this channel in 2023.

Whether through phishing, smishing, trusted third party access, or an employee mistakenly welcoming a cyber-criminal by clicking a familiar-looking link, simple, innocent actions can create chaos in a split second.    

Underlying ways that breaches happen include:  

• Weak or stolen end-user information such as reused or simple passwords   
• Sharing credentials with multiple employees or third-party vendors  
• Permissions inappropriately assigned and managed  
• Unsuitable configurations in place  
• Undetected vulnerabilities, often due to a lack of proper change management, CMDB registry, and patch management processes  

Marketing insight guru Statista reports that in 2023, the manufacturing sector experienced the most cyberattacks, at nearly one quarter of the yearly total. Finance and insurance companies followed closely behind, at just under 20%. The 2023 statistics report on the current, most targeted areas of cyber-attacks include:    

1. Artificial Intelligence. The use of Wi-Fi and Bluetooth enables the operation of everything from a doorbell to a furnace and is rapidly being integrated into vehicles. Automatic features involving machine learning such as cruise control systems and stereos are creating portals through which hacking and security threats can occur, even to the point of being able to listen in on people’s conversations as they drive.  
2. Emails and Texts. Despite valiant attempts by IT professionals to train and protect their workforce, over 71% of businesses report that they have experienced a successful phishing attack. It is estimated that 3.4 billion phishing emails are sent each day, which makes one in every 4,200 emails scandalous. Manufacturing, Finance, Education, and Healthcare are among the most targeted sectors. 
3. eCommerce. Cybercrime is alive and well and lurking in the websites shopped each day. This sector has two disadvantages. Attackers only need the first six numbers of a credit card to enlist software that can generate the remaining digits, and they are eager to use ecommerce sites to test their accuracy. Also, there is little guarantee that ecommerce sites enlist the necessary tactics to thwart the influx of fraud. Shoppers are naïve to the protective measures (or lack thereof) taken by the sites they visit. 
4. Supply Chain. In 2023, there were over 2,700 entities impacted by supply chain cyberattacks - the highest number since 2017. Because they involve third-party access to business data, systems, vendor information, and software, cyber attackers find their way in through the basic collaboration of resources. The intricate connectivity involved in supply chain management creates a seemingly trustworthy forum for communication and collaboration. This comfort zone makes it easy for a cybercriminal to pose as a partner rather than a deceiver.  

In recent years, the allure and success of Cybercrime has become a revenue-generating business, with hackers offering their services to interested participants. Called Crime-as-a-Service (CaaS), toolkits and ‘package deals’ are provided, arming others with the ability to invade and steal. Intricate codes and special skills are a thing of the past and the ability to hack is becoming somewhat of a mainstream, managed service. 

More Than a Price to Pay

Statista reports that, ‘in 2023, the most common cause or delivery of cyber-attacks in the United States was unpatched vulnerability, encountered by 23% of companies nationwide’. They also reported a 21% increase of phishing attacks, amounting to an all-time high in financial burdens of $12.5 billion U.S. dollars. 

Looking at the impact of security breaches only from a numbers angle, however, gives an incomplete report card. Data breaches reach much further and impact more than a compilation of yearly stats. 

1. The overall recuperation and recovery effort needed after a breach is tremendous and extends both internally and externally. Having to rebuild the company brand requires an increase in marketing initiatives. Clients and customers need to be reassured that they can trust the business they are working with.   
2. The risk of others gaining proprietary information has competitors actively mining data at the first word of a breach. Blueprints, strategies, recipes, and other specifics can land at the fingertips of criminals and competitors, particularly during a time of weakness.  
3. While an attack is underway, a threat actor can insert changes within a website or other systems that go undetected and thus continue to harm or impact the business.   
4. Legal fees come into play when a company fails to properly protect and mitigate security risks. They intensify if customers or clients impacted by the company’s breach decide to pursue a lawsuit. The potential price tag on this misstep can span from thousands to millions of dollars.  
5. Breaches can have varying effects on employees within a workforce. While some may feel vulnerable, others might experience feelings of envy towards colleagues who are compensated for working overtime to address the issue. Will personnel stick around? What will they tell their peers and business partners about the breach – and how quickly will that news spread?  
6. Implementing proper security measures following a breach is vital. It protects the future of a business while helping to restore its reputation. However, having to manage security reactively versus proactively is at a greater expense to the business.  

Questions to Ponder

Having foresight into the world of cybersecurity is key. The price of a breach – monetary and beyond, far outweighs the cost of having a defense plan in place from the start. Research has proven that cyberattacks particularly target companies that are weak in their operational resilience programs.   

Your cyber and operational resilience plans need to have answers to security questions such as:  

• What back-up processes are in place to assure multi-instance and validated data integrity?  
• How are your files secured locally, remotely, and offline?  
• How do you manage employees utilizing personal devices for work activities?  
• What are the regulatory obligations regarding compliance of sensitive information?  
• How are administrative rights and permissions for your systems managed?  

Your business has options to assist with developing its cybersecurity and operational resilience program. These options include hiring skilled staff, utilizing software, or hiring outside consultants. It is likely that you will use a mixed course of action to fit your business needs and resources.  

Enlisting a partner in this equation may prove to be a beneficial investment. Cyber partners can support and bolster existing practices, assist with due diligence, and bring experience to quickly mature the present systems and practices in place. This helps to mitigate business risks while providing metrics, benchmarking, and project prioritization.  

Diligence Matters

Nearly 70% of cyber experts surveyed feel their organization lacks cybersecurity presence and strength. In a world where simply opening an attachment could mean disaster, businesses must be diligent. Given the risks and impacts of a cybersecurity breach, the true cost of a poorly laid plan goes beyond dollars and cents. Operational efficiency and resilience require a full-court press approach, rather than resting the responsibility on the shoulders of one single department.  

Security and resilience involve the business at each level. Recovery impacts brand reputation, customer and employee satisfaction, competitor dangers, legal and regulatory fees, and carries the possibility of permanent closure. With today’s many options, resources, and supporting data, companies have solid solutions to pursue in mitigating against cyber and resilience threats.    

Whether yours is a large corporation or a small homegrown business, the Cayuse cybersecurity team is ready to guide your business in the safest way possible. Gaining traction on a defense plan already in place or enlisting the help of experts to generate a new one, involves a strategy that requires knowledge and skill to finesse.

Let's make sure that you are doing what your business requires, to safeguard your people, processes, and systems from harm. 

Editor's note: This post was originally published in 3/2023 and has been updated for freshness, accuracy, and comprehensiveness.