These figures came from a survey of 5,500 businesses in 26 countries.

• 90% had experienced a security incident
• 46% lost sensitive data
• The most expensive types of security breaches come from employee fraud, cyber espionage, network intrusion, and the failure of third party suppliers

The survey methodology used previous year’s data to pinpoint areas where companies have to spend money following a breach, or have lost money as a result of a breach. Typically businesses have to spend more on professional services (such as external IT experts, lawyers, consultants, etc.), and earn less due to lost business opportunities and downtime.

On average, a larger enterprise faces bills of $551,000 including:

• Professional services (IT, risk management, lawyers): up to $84K with a spend probability of 88%
• Lost business opportunities: up to $203K, 29%
• Downtime: up to $1,4M, 30%

In addition, there is often staff re-training, infrastructure upgrades, and importantly reputational damage from downtime or compromised information – Sony and Ashley Maddison for example.

• Indirect spend: up to $69K
• Including reputation damage: up to $204,750

Most frequently, a serious security breach is the result of a malware attack, phishing, leaks of data by employees and exploited vulnerable software.

Large companies pay significantly more when a security breach is the result of a trusted third party failure.

SMBs tend to lose a significant amount of money on almost all types of breach, paying a similar high price on recovering from acts of espionage, DDoS (denial of service resulting in web site unavailability), and phishing attacks.

On the bright side, one of the key findings of the 2015 IT Security Risks survey is that IT specialists are taking cyber threats much more seriously than last year. The second half of 2014 was rich with security breaches and APT (advance persistent threat) announcements. This lesson has been learned - 50% (up from 30% last year) of IT professionals list prevention of security breaches as one of their three major concerns.

Brian Burke, Head of Market Intelligence Team at Kaspersky Lab said, “We have not seen too many reports on the consequences of IT security breaches, estimating a loss in real money. It is hard to come up with a reliable method of producing an average, but we understood that we had to do it, to bridge the theory of the corporate threat landscape with business practice. As a result, we have a list of corporate threats that caused the most significant damage – the ones we believe businesses should pay the utmost attention to”.

The full report is here.