Reference: Size Breakdown · Updated September 2026

Incident Cost by Company Size: SMB vs Mid-Market vs Enterprise

Incident cost scales with company size, but not linearly. Fixed costs of incident response (forensics, legal, regulatory notification) hit small businesses disproportionately relative to their revenue. A ransomware demand of $200,000 is trivial to a Fortune 500; it may be existential for a 50-person business.

Comparison Table

Organisation size	Avg breach cost	Source edition	Notes
Under 500 employees	$3.31M	IBM CODB 2023	Up 13.4% on the $2.92M IBM reported for the same band in 2022
500-1,000 employees	$3.29M	IBM CODB 2023	Up 21.4% on $2.71M the prior year, the steepest rise of any size band
1,001-5,000 employees	$4.87M	IBM CODB 2023	Up from $4.06M; the band where cost begins tracking the global average
All sizes, global average	$4.99M	IBM CODB 2026	Record high; IBM reports the global average but no longer splits it by headcount
All sizes, United States	$11.5M	IBM CODB 2026	More than double the global average

IBM Cost of a Data Breach, 2023 and 2026 editions. The 2023 report is the most recent to break average breach cost down by organisation headcount; later editions, including 2026, report the global and US averages but no longer publish a size split. The size figures above are therefore correctly dated to 2023 rather than restated as current.

Small Business (Under 500 Employees)

$3.31M

Average breach cost, under 500 employees (IBM CODB 2023, the last edition to publish a size split)

Existential downside for small orgs

Fixed response costs (forensics, legal, notification) do not scale down with revenue, so the combined direct cost and lost business is often unrecoverable without cyber insurance. The often-repeated figure claiming most breached small businesses shut within six months has no verifiable source and was disavowed by the National Cyber Security Alliance in 2022.

Fixed IR costs hit hardest

Forensics, legal counsel and regulatory notification cost broadly the same whether the breached organisation has 20 employees or 2,000: the work is driven by the incident, not by headcount. That is the structural reason the same breach lands far harder on a small balance sheet.

Limited security staffing

Most SMBs have no dedicated security personnel. First responders are generalist IT staff, extending detection and containment time.

Common attack vectors

Phishing for credentials, exposed remote-access services and unpatched public-facing systems are the entry points that recur most often in SMB ransomware cases. All three are addressable before an incident, which is what makes them worth naming.

Mid-Market (100-1,000 Employees)

Mid-market organisations face a particularly challenging risk profile: they hold enough sensitive data and revenue to attract sophisticated attackers, but their security programmes are often immature relative to their enterprise peers. IBM's last published size breakout put organisations of 500 to 1,000 employees at $3.29M and those of 1,001 to 5,000 at $4.87M (Cost of a Data Breach 2023), an impact large enough to disrupt multi-year financial planning. Mid-market organisations are increasingly being used as the entry point for supply chain attacks against their larger enterprise customers.

Challenge	Impact
No dedicated CISO or security team	Delayed detection; MTTD 2-3x higher than enterprise avg
Limited IR retainer	Emergency hourly rates 2-3x retained rates; slower response
Rising regulatory footprint	More regulated data as businesses scale; HIPAA, PCI, GDPR apply
Supply chain entry point risk	Used to target their enterprise customers; double exposure

Enterprise (1,000+ Employees)

Enterprise breach costs range from $4.99M globally to $11.5M in the US (IBM CODB 2026 US average). Enterprise organisations face cost multipliers that smaller organisations do not: cross-subsidiary blast radius (a breach in one business unit triggers investigation across all); board and regulatory scrutiny (SEC disclosure requirements, earnings impact disclosure); and the expectation of a formal post-incident review and remediation programme that can cost $1M-$5M in itself.

Enterprise organisations that suffer a breach typically see a 5-10% stock price drop in the first week post-disclosure (academic studies 2020-2025). For a $10B market cap company, that is $500M-$1B in market value, dwarfing the direct breach cost.

Why the Cost Gap Is Non-Linear

Enterprise costs are higher in absolute terms, but SMB costs are often higher as a percentage of annual revenue:

Organisation	Typical Revenue	Breach Cost	Cost as % Revenue	Recovery Likelihood
50-person SMB	$5M/yr	$300K avg	6%	Challenging without insurance
500-person mid-market	$100M/yr	$3M avg	3%	Survivable with insurance
5,000-person enterprise	$2B/yr	$8M avg	0.4%	Manageable - material cost
50,000-person enterprise	$50B/yr	$11.5M US avg	0.02%	Operational disruption only

Cyber Insurance by Company Size

Size	Typical Annual Premium	Coverage Limit	Key Requirements
SMB (under $10M revenue)	$1,200-$7,500/yr	$1M-$2M	MFA, patching, backup proof
Mid-market ($10M-$500M)	$10K-$100K/yr	$5M-$25M	MFA, EDR, IR plan, annual assessment
Enterprise ($500M+)	$200K-$2M+/yr	$25M-$500M+	SOC, CISO, full security programme

Frequently Asked Questions

What is the cost of a cyber attack on a small business?

IBM's most recent published breakdown by organisation size put the average breach at $3.31M for organisations under 500 employees, up 13.4% on the $2.92M it reported for the same band a year earlier (Cost of a Data Breach 2023). IBM no longer publishes a size split, so that 2023 figure is the last authoritative one. The strain on a small organisation comes from the combination of direct response costs, which do not scale down with headcount, and lost business revenue.

Why do fixed incident response costs disproportionately impact SMBs?

Forensics, legal counsel and regulatory notification are priced by the incident rather than by headcount, so a small organisation pays broadly what a large one pays for the same breach. Run it against your own numbers: take the response quote you would face and divide it by your annual revenue. The same absolute cost that is a rounding error at enterprise scale can be several percent of turnover for a 20-person business, before any lost revenue is counted.

Do larger companies have lower incident costs as a percentage of revenue?

Yes. Enterprise breach costs as a percentage of annual revenue are typically 0.02%-0.4%. SMB breach costs are often 3-10% of annual revenue. However, enterprise incidents create stock price impacts, regulatory disclosure obligations, and cross-subsidiary remediation costs that smaller organisations do not face.