When companies talk about security incidents, fines are the first thing they think of. The sanctions under the General Data Protection Regulation make the headlines, and they are real. In the bill for an incident at a mid-sized company, however, they are frequently not the largest item – often not even the second largest.
The expensive items lie elsewhere: in the investigation, in the recovery, in the standstill of operations and in the customers who do not come back. This article sorts through the cost categories and gives figures where reliable sources exist. Where they do not, we say so explicitly – because freely estimated euro amounts help no one make an investment decision.
“Most companies don't underestimate the fine. They underestimate the weeks in which nothing runs, and the customers who stop enquiring afterwards.” – Thomas Werner, CCO Eucerta AG and Lead Auditor
What the evidence shows: costs are rising, and the targets have got smaller
The IBM Cost of a Data Breach Report 2026 puts the global average cost of a data breach at 4.99 million US dollars – twelve per cent more than the previous year and an all-time high. The report attributes the increase partly to higher costs for detection, escalation and business interruption. It also reports a 56 per cent rise in AI-supported attacks.
Two qualifications belong with this. First, this average is shaped by large organisations and cannot be transferred to a business with 25 employees. Second, it describes data breaches, not every operational outage. For the question of which direction the risk is heading in, it is nevertheless the most reliable reference available.
Who actually gets hit is shown by the BSI report on the state of IT security in Germany 2025. For the reporting period from 1 July 2024 to 30 June 2025, the BSI describes a shift away from large, elaborate attacks towards many small, easily executed ones: around 80 per cent of reported attacks, for example with ransomware, were directed at small and medium-sized enterprises, which frequently lack the means and the knowledge to protect themselves on their own. In addition, an average of 119 new vulnerabilities per day became known during the reporting period, around 24 per cent more than in the preceding period.
The message from both sources combined: attackers prefer poorly protected targets, and the cost per incident is growing.
The four cost categories that actually arise
Instead of a total figure that no one can seriously put on a single SME, it is worth looking at the structure. Four blocks arise almost every time.
Investigation and recovery
As soon as an incident is noticed, the work begins: isolating systems, finding the cause, determining the scope, identifying the affected data. In most SMEs this work requires external support, because the specialist knowledge is not available in-house. Recovery follows – rebuilding systems, restoring data, reissuing access rights, closing gaps.
The main cost driver here is preparation. Anyone who has current, tested backups and knows which systems have to be running again in which order shortens this phase considerably. Anyone who only clarifies both during the incident pays hours for searching instead of for recovery.
Business interruption
The block that is often underestimated. When a network is encrypted, it is not IT that comes to a standstill but the business: no orders, no deliveries, no invoicing. Every company can estimate this item itself, and more precisely than any study can: take your average daily revenue and multiply it by the number of days you would be able to work without your central systems. The result is your personal risk figure – and usually more convincing than any international average.
Notification obligations and legal consequences
The General Data Protection Regulation requires that personal data breaches be reported to the supervisory authority within 72 hours and, under certain conditions, that the individuals concerned be notified as well. At the same time it requires appropriate technical and organisational measures commensurate with the risk. This creates effort for legal advice, communication and follow-up questions – regardless of whether a fine is ultimately imposed.
Among the factors relevant to setting the level of a fine is which technical and organisational measures a company had taken. This is precisely the point at which a documented management system pays off twice: it reduces the probability of occurrence, and in an emergency it demonstrates the due care that was exercised.
Loss of trust
The block that is hardest to quantify and has the longest-lasting effect. Customers who learn of an incident ask questions, renew later or switch. With business customers there is the added fact that the incident ends up in their supplier assessment.
`[CHECK: An evidence-based statement would be strong here. Suggestion: either add a source on customer churn following security incidents or – if available – an anonymised observation from Eucerta audits. Without evidence the paragraph remains qualitative, as it stands now.]`
What ISO 27001 changes about this calculation
ISO 27001 works in two places, and it is honest to keep the two apart.
Preventively: an information security management system forces you through the steps that get left undone in day-to-day business. You define which information and systems are worth protecting in the first place, assess the risks in a traceable way and decide on measures with reasons given. The 93 controls of Annex A are worked through one by one – each with a justified decision, including the decision against a control. Access management, updates, training and dealing with service providers are not recommendations in this, but components of the system. That matches what the BSI names as the decisive lever: consistent management of your own attack surfaces.
Limiting damage: when it does happen, preparation determines the cost. An ISMS requires defined procedures for security incidents, named responsibilities, tested recovery and documented communication channels. Instead of improvisation in the first few hours, there is a sequence. That shortens downtime and thus the most expensive block in the bill.
What ISO 27001 does not do belongs here just as much: it is no guarantee against attacks, and a certificate that exists only on paper protects no one. What is audited is therefore not the folder but the effectiveness – more on this on our page on ISO 27001.
What the investment side looks like
The counter-calculation at Eucerta is transparent: €179 per month for the first standard, €149 for each additional one, a 36-month term, a fixed price for companies with up to 30 employees. Assessment and registration are included, the certificate is valid for three years from the audit date, and between audits the system stays up to date in the platform. You can do the maths in the cost calculator.
Combining this with ISO 9001 often makes sense, because both standards share the same basic structure and context, leadership, internal audits and management review only arise once – our page on the integrated management system describes the principle. Anyone who already operates their ISMS and only needs the proof will find the conditions under express certification.
Conclusion
The honest answer to the question in the title is: it depends on your daily revenue, your backups and your preparation – and that is precisely why you can draw up the calculation yourself, better than any study does it for you.
What the evidence shows: the cost per incident is rising, and around 80 per cent of reported attacks hit small and medium-sized enterprises. What follows from this is not panic but a priority. A management system for information security is the structured answer to both findings – and its cost is predictable, whereas an incident never is.
Your next step: Work out your own figure – daily revenue times days of downtime – and compare it in the cost calculator with the price of your certification.
Further reading:
