What a cyber incident costs

The bill is bigger than the ransom

When people picture a cyber incident, they picture a ransom demand: a screen that says your files are locked and a number to pay. The payment, if there even is one, is usually the smallest part of the cost.

The real bill is what happens around it: the hours spent recovering, the work that stops while systems are down, the customers who lose confidence, and the data that may not come back at all.

Four kinds of cost

• Money. Recovery, replacement, and sometimes a ransom. This is the part everyone sees.
• Time. People stop their normal work to contain the problem, rebuild systems, and check what was touched. That time is gone.
• Trust. Customers and partners who hear about an incident may think twice. Trust is slow to earn and quick to lose.
• Data. Some information cannot be recovered if there is no clean backup. What is lost is lost.

A small example

A small business is hit by ransomware. The files are locked on a Friday. There is a backup, but it is three weeks old, so three weeks of invoices and records are gone. Nobody pays a ransom, yet the business loses a week of work rebuilding, a stack of records, and the confidence of two clients who noticed the delay.

The technical event lasted minutes. The cost lasted a month.

Why this matters to you

You do not need to run a company to feel this. The same shape applies to a locked phone, a lost thesis, or a hijacked email account. Small, steady habits, the ones in this course, are far cheaper than the cleanup.