Recoverability Bulletin #2
Downtime, Not Ransom, Is the Real Cost of a Cyber Incident
Ask around a boardroom what a cyber incident costs and you’ll hear about the ransom, the lawyers, the forensics firm, the notifications. But the insurers who pay those bills keep better records than anyone, and they point somewhere else:
Most of what a cyber incident costs is downtime, the days and weeks the business can’t operate at a meaningful standard.
That finding comes out of the claims analysis in Fenix24’s 2026 State of Recoverability Report, and it should change how security leaders think about spending. Of all the costs on a cyber claim, downtime is the only one that can still be reduced once an attacker is inside. The claims data proves both halves of that.
The people who pay the bills agree
Some of the most reliable witnesses to the true cost of cyber incidents are the insurers who cover them, and their claims data has converged on a verdict. Across the world’s largest independent claims datasets, business interruption is the dominant loss component, exceeding ransom payments, forensics, legal fees, and notification costs combined. Allianz Commercial’s 2025 analysis puts business interruption above 50% of large cyber claim value. Munich Re, working from its own book, puts it at 51% of ransomware cost components. Two carriers, two datasets, one answer.
NetDiligence’s five-year claims study shows what that share does to the total. Claims with a business interruption component cost 650% more on average than claims without one, and ransomware drove 81% of the SME claims that had one. The averages inside those claims tell the story at both ends of the market. For SMEs, business interruption averaged $1.2M of a $1.8M total incident cost, with crisis services at $297K. For large companies, interruption averaged $26M of a $36.1M total, against $3.5M for crisis services. At either scale, the interruption line is several times everything else on the claim put together.
The one cost that’s still a variable
Those numbers matter to a security leader for a reason beyond their size. Business interruption behaves differently from every other loss component.
Once an incident occurs, forensics, legal, and notification costs are roughly fixed. The investigators bill what they bill, counsel costs what it costs, and the letters go to however many people were affected. Nothing the organization does after day one moves those lines much. The interruption line is different. It’s a variable, and the variable it tracks is recovery speed. Allianz’s own claims analysts note that interruption losses correlate directly with the quality of response and continuity execution. Indecision and poor coordination extend them.
Read that as a CFO would. Every other security outcome is probabilistic. You spend on prevention and the odds of a bad event go down by some amount nobody can verify. Recovery capability pays off deterministically. If the business comes back in forty hours instead of three weeks, the difference is arithmetic, and it lands on the largest line of the claim. Every hour of recovery time purchased in advance is claim value that never accrues. No other security investment has that direct a relationship to the biggest number on the loss sheet.
This is also why “we have cyber insurance” doesn’t close the issue. Carriers price what they pay. An organization that can show a short, evidenced recovery timeline is presenting a claim profile several times smaller than one that can’t. The policy transfers the loss. It doesn’t shrink it. Recovery speed shrinks it.
The number in your budget deck is the wrong one
Most security budget cases cite reported ransomware losses, and the agency that publishes them says not to. The FBI’s IC3 logged 3,600 ransomware complaints in 2025 with $32 million in reported losses. Its own methodology notes that the total generally excludes lost business, time, wages, files, equipment, and third-party remediation. It also counts only the incidents victims report to the FBI.
The Cyentia Institute, estimating across the full incident population with operational costs included, put annual ransomware losses near $95 billion for 2023. The two figures measure different things, and that’s exactly the problem. The categories the headline number excludes by design are the same downtime costs the claims data shows dominate the bill. A budget case anchored to reported losses is missing its largest line item, and a board that hears “$32 million in ransomware losses nationwide” has been handed a reason to spend less, not more.
Cyber exposure should be measured in hours of interrupted operations, not records exposed. The claims data already does this.
What an hour costs, and how to find out
Measuring exposure in hours sounds simple until you try to produce the number, because “the business” doesn’t have an hourly rate. Business services do, and they differ wildly. An hour without the e-commerce platform has a revenue figure attached. An hour without payroll costs little on Tuesday and a great deal on the Friday a pay run is due. An hour without the manufacturing execution system idles a plant whose labor and contract penalties accrue regardless.
The exposure calculation runs in three steps, and each one is work most organizations haven’t done. First, name the business services that stop when the environment goes down, service by service rather than server by server. Second, put an hourly figure on each one, drawn from revenue, idle labor, SLA penalties, and the customers who don’t come back. Third, and this is the step that separates an estimate from evidence, establish how many hours each service would take to come back, based on something that has been tested rather than a target someone wrote in a plan.
That third number is the one almost nobody has. In Fenix24’s engagements, documented recovery time objectives typically promised 24 to 48 hours. Across more than 800 clients, four came close to that for partial business operations. Multiply an honest hourly cost by the gap between the promised timeline and a demonstrated one, and you have your real exposure. For most organizations it’s the largest unexamined number in the risk register.
Buying hours before you need them
If every hour of recovery time purchased in advance is claim value that never accrues, the practical question is where hours are for sale. From the recovery side of 500+ ransomware engagements, the answer is specific. The hours get lost in conditions that existed long before the attacker showed up. Teams reconstruct application dependencies mid-incident because no current map existed. Backups that reported success turn out not to be operationally restorable. Restored data has nowhere to land because nobody provisioned storage for a full environment restore. Decisions stall because nobody agreed in advance who calls the order of restoration at 3 a.m.
Each of those is measurable and fixable in peacetime, and each one converts directly into hours. That’s the budget conversation this claims data makes possible. Instead of asking the board to fund protection against a probability, a security leader can put a price on an hour of downtime for each critical business service, show the gap between promised and demonstrated recovery time, and present recovery investment as buying that gap down. It’s the rare security proposal a CFO can evaluate like any other capital decision, because for once the return is denominated in the same unit as the loss.
Get the full report
The 2026 State of Recoverability Report is built entirely around the question every board is now asking: how long would we actually be down? It pulls together claims data, regulatory analysis, and executive surveys from leading institutions, including Allianz, Munich Re, and Accenture, then tests all of it against what Fenix24 has seen inside 500+ real ransomware recoveries. No other report pairs industry analysis with field data from the team that does more recoveries than anyone in the world. It’s the difference between what organizations say about their resilience and what happens when the environment goes down.
Click here to download Fenix24’s 2026 State of Recoverability Report.
