How To Present Cyber Security Challenges to Department Leaders to Prioritise Future Technology Investments

Prevention Versus Recovery: A Costed Example

Consider an outage at a 50-person office that lasts one day. If the average annual salary in the office is £30,000, one day of downtime will cost the business over £11,400, factoring in a drop in efficiency of 50% for two days.

With ransomware attacks, you should consider the impact both of downtime and of the need to roll-back for an extended period. Recovery from a ransomware infection requires either identification of the time of infection or, more commonly, the recovery and testing of multiple restore points until a clean environment is confirmed.

Let’s say that a ransomware infection impacts a finance system, affecting a team of five users. For our example, the average salary of each staff member is £35,000 per year. It would not be uncommon for the recovery window of such an infection to cause three days of downtime, during which systems are rebuilt and tested, until at last a clean recovery point is found from a week ago.

For the next two weeks, the finance department not only has to recover from three days of outage, but they have also lost the previous week’s work. The efficiency of the team is impacted: not only does the department need to continue to process the normal day-to-day transactions, but they must also spend a considerable amount of time identifying and reproducing the work lost over the next two weeks. The total cost to the organisation is £6,700 for three days of outage only affecting five members of staff!

Put in these terms, the preventative costs of investing in cyber security suddenly don’t seem so extensive when compared to the cost to recover. Let’s now take a look at how presenting cyber security challenges through a cost-benefit analysis approach will help you achieve the investment you need.

A Cost-Benefit Analysis Approach to Cyber Security

A cost-benefit analysis is a method used to evaluate a project by comparing its losses and gains — essentially a quantified and qualified list of pros and cons. Undertaking a cost-benefit analysis is a great way to assess projects because it reduces the evaluation complexity to a single figure. As you can imagine, this makes a cost-benefit analysis an invaluable tool when it comes to explaining the intricacies and selling the value of a robust cyber security strategy to your department leaders.

One of the most important things to emphasise in your cost-benefit analysis is the trade-off between paying to prevent a mess versus paying to clean up a mess. A recent Cabinet Office report stated the estimated cost of cybercrime to the UK economy is a whopping £27 billion. And when it comes to individual attacks, a Sophos survey in April 2021 found that the average total cost of recovery from a ransomware attack has more than doubled in a year, increasing from $761,106 in 2020 to $1.85 million in 2021.

Of course, investing in preventative cyber security measures also comes at a cost. Research firm Gartner forecast that global spending on information security and risk management services will reach $150.4 billion in 2021 – an increase of 12.4% from 2020.

In this context, one thing remains crystal clear: for most organisations, the cost of prevention pales in comparison to the cost of a breach. So how you apply a cost-benefit analysis to get department leader buy-in for your cyber security strategy?