When ransomware hits, the ransom demand gets all the attention. But for small and mid-sized businesses, the ransom is typically the smallest line item. The real costs are what follow it.

The Actual Cost Breakdown

Downtime

The average ransomware recovery takes 21 days. For a 25-person company billing at even modest rates, three weeks of impaired operations often exceeds $100,000 in lost productivity — before anyone touches the ransom question.

Recovery and Remediation

Incident response firms, forensic investigation, system rebuilds, and data restoration from backup (if you have clean backups) typically run $20,000–$50,000 for SMBs. If your backups were also compromised, that number climbs significantly.

Legal and Regulatory Costs

If customer, patient, or employee data was exposed, you likely have breach notification obligations. Legal counsel, notification letters, credit monitoring services, and regulatory defense can add another $15,000–$80,000 depending on the size of the breach and your industry.

Reputational Damage

This one doesn't show up on an invoice. But 60% of small businesses that suffer a significant breach close within six months — often not from the direct costs, but from the client attrition and lost contracts that follow.

What Actually Prevents Ransomware

The good news: ransomware is almost entirely preventable with modern controls. The majority of ransomware attacks succeed because of three things:

  • Phishing emails that trick employees into entering credentials or running malicious attachments
  • Unpatched vulnerabilities in exposed systems and software
  • Missing MFA that lets attackers use stolen credentials without resistance

Addressing those three vectors — with security awareness training, consistent patch management, and MFA on all critical systems — eliminates the vast majority of ransomware risk.

The Backup Question

Even with the best prevention, assume some attacks will get through. Tested, air-gapped backups are your insurance policy. The key word is tested — a backup you've never restored from is a backup you can't count on.