More than half of all Danish SMEs have not given serious thought to major operational disruptions. This can make a cyberattack more costly and difficult to manage than it needs to be.
A cyberattack rarely results in just a single IT bill. The costs can start with downtime and emergency assistance and continue with recovery, lost revenue, legal assistance, and customer communications. Therefore, the question should not be limited to what cybersecurity costs. Management should also ask what it costs the company to be unprepared.
More than half of SMEs have not given this serious consideration
A new analysis from SMVdanmark is based on responses from 1,166 small and medium-sized enterprises. It shows that 52 percent have not given serious thought to how they would handle major operational disruptions such as cyberattacks, power outages, or supply chain issues. 41 percent have given such matters consideration, while 7 percent say they do not know.
Among the companies that have considered contingency planning, 80 percent have factored in cyberattacks or IT outages. At the same time, 31 percent of the prepared companies feel well or very well prepared for a major unforeseen crisis. The same is true for only 10 percent of companies that have not given specific consideration to contingency planning.
The figures do not prove that a plan in and of itself prevents an attack. They show that companies that have made preparations in advance are more likely to be ready to take action. This is crucial when every minute without access to email, financial systems, customer data, or production can prolong the downtime.
A cyberattack costs more than the recovery itself
When a company is affected, the costs are spread across various parts of the business. Some are immediately apparent. Others only become apparent when customers have to wait for responses, deliveries are delayed, or employees are unable to do their jobs.
A cyberattack can, among other things, lead to:
- lost work time and revenue during downtime
- Emergency assistance from IT and security specialists
- Recovery of systems, accounts, and data
- legal assistance, investigations, and any necessary notifications
- Crisis communication and enhanced customer service
- loss of customer trust or business-critical information
The Danish Business Authority’s report, “Digital Security in Danish SMEs 2024,” compiles older estimates that illustrate the order of magnitude. Among other things, the report cites a 2021 estimate from SMVdanmark, which estimated that a ransomware attack on a small business with 10 to 49 employees would cost 376,350 DKK in lost e-commerce revenue alone. The report also cites a 2019 study by Dansk Erhverv, which found that a cyberattack cost Danish businesses an average of 160,000 kr.
These figures are not current price quotes or definitive figures for any individual company. Rather, they illustrate why comparing a security solution to a single, isolated expense incurred after an attack is too narrow a perspective. The actual cost can consist of many expenses occurring simultaneously.
Preparation makes a crisis shorter and more manageable
Effective cybersecurity starts with simple decisions: Who leads the response? Who contacts the IT provider? How do you isolate a compromised account or device? Where can you find contact information and instructions if the normal systems are unavailable?
Sikkerdigital recommends a simple emergency plan for cyberattacks that includes key roles and contact information, so that small businesses can respond more quickly. The plan should be stored in a way that ensures it can be accessed even during an IT outage, and it should be tested using realistic scenarios.
Preparation also includes the measures that reduce risk before a crisis: up-to-date systems, secure access, reliable backups, monitoring, and clear workflows. None of these measures provides a guarantee against attacks. Taken together, they make it harder for an attacker to gain a foothold and easier for the company to respond.
Employees must be able to recognize and report threats
An emergency response plan is only effective if employees know what to do. They must be able to recognize suspicious emails, pause when faced with unusual payment requests, and report incidents promptly. Early reporting can enable the IT department to block an account or investigate an email before the incident escalates.
Ongoing awareness training provides employees with knowledge, while phishing simulations help them practice their responses in real-world scenarios. This combination makes it possible to track completion rates, quiz results, and progress over time. As a result, these efforts become a measurable part of the organization’s preparedness rather than an annual activity without follow-up.
Realistic Cybersecurity Preparedness for a Small Business
An initial contingency plan doesn't have to be a major project. Start with the business processes that cannot come to a standstill, and assign responsibilities before an incident occurs.
- Map out critical operations. Describe which systems, data, vendors, and employees are necessary to serve customers and keep operations running.
- Assign roles and points of contact. Designate decision-makers, an IT contact, a communications coordinator, and alternates. Save the plan outside the systems that may be affected.
- Mitigate the most likely risks. Prioritize strong access security, updates, backups, data breach monitoring, and training that align with your company’s risk profile.
- Practice a specific scenario. For example, go through a scenario involving a compromised email account or a ransomware attack. Note where the plan is unclear and who is missing information.
- Measure and Improve Track training status, phishing test results, reported incidents, and the time from detection to action.
Compare the planned investment with the potential outage
Cybersecurity must be tailored to a company’s size, systems, and risk profile. Therefore, it doesn’t make sense to purchase every conceivable tool. It makes sense to identify the critical risks and select measures that the company can implement, document, and improve.
A fixed investment in training, phishing tests, monitoring, and management can be included in the budget. Downtime, emergency assistance, and lost customers can occur without warning. That is the financial difference between working on preparedness now and waiting until after an attack has occurred to begin.
See what a more structured emergency response plan costs
SecureFirst combines awareness training, phishing simulations, data breach monitoring, and compliance into a single platform. You can start with the modules that best suit your needs and track your progress over time. Calculate your price or book a free demo to get a concrete starting point for your next steps.
