What does a business incident actually cost?
This site documents what every type of business incident costs, and why. Vendor-neutral, fully cited, updated with 2026 data.
What is one hour off your MTTR actually worth?
Type your incident profile. Then tick the investment levers you'd consider. We'll model the year-1 and 3-year net result.
2026 Incident Cost Index
See full indexA consolidated reference table aggregating per-incident costs across all major incident types. No other resource publishes this cross-category view.
| Incident Type | Avg Cost Per Incident | YoY Change | Source |
|---|---|---|---|
| Data breach (global) | $4.99M | +12% | IBM CODB 2026 |
| Data breach (US) | $11.5M | +13% | IBM CODB 2026 |
| Ransomware (recovery, excl. ransom) | $1.7M | +11% | Sophos 2026 |
| Insider threat (credential theft) | $779K | +15% | Ponemon 2025 |
| P1 IT incident | $794K | n/a | PagerDuty 2024 |
Showing 5 of 17 rows. View complete index.
Browse by Incident Type
Every major category of business incident documented with cost data, cost components, and industry comparisons.
How Incident Cost Is Calculated
Incident cost is not just the ransom payment or the downtime bill. It has four components, all of which compound:
Cost by Industry
Full breakdown| Industry | Avg Breach Cost | Ransomware Risk | Key Regulatory Exposure |
|---|---|---|---|
| Healthcare | $6.64M | High | HIPAA |
| Finance | $6.29M | Very High | GLBA/SEC |
| Technology | $5.50M | High | Reputational |
| Retail | $3.54M | Moderate | PCI DSS |
| Public Sector | $2.86M | Moderate | Operational |
Source: IBM Cost of a Data Breach Report 2026. Showing top 5 industries by breach cost.
Cost by Company Size
Full breakdownIBM CODB 2023, the last edition to publish a size split. Fixed forensics and legal costs do not scale down with revenue, so a major incident hits small orgs disproportionately.
IBM CODB 2023: $3.29M at 500-1,000 employees, $4.87M at 1,001-5,000. Rising target profile with security programmes still immature relative to enterprise.
Global average $4.99M, United States $11.5M (IBM CODB 2026). IBM no longer splits the average by headcount, so the size bands above are dated to its 2023 edition.
Incident Response Firm Pricing
All IR firmsMost named DFIR firms publish no pricing at all. These reference pages give the published price where one exists, attributed to the AWS Marketplace listing or filed G-Cloud document that carries it, and the pricing model plus quote drivers where it does not.
Frequently Asked Questions
How much does a business incident cost on average?
What is the most expensive type of security incident?
What are the four components of incident cost?
How much does an incident response retainer cost?
You're using a tool we built.
Digital Signet builds custom software and AI automation for security teams. Triage automation, evidence collection, post-mortem tooling, workflow automation.
See what we build →