Free tool, calibrated to the IBM 2025 report
What would one cyber security incident cost your business?
Ransomware and data breaches do not send an invoice for one line item. Answer a few questions and see the full exposure, with every assumption shown and benchmarked against the IBM Cost of a Data Breach Report 2025.
- $6.63M
- Average breach cost in Canada, 2025, up from $6.38M
- 241 days
- To identify and contain the average breach, 181 to find plus 60 to contain
- 63%
- Of ransomware victims refused to pay in 2025, up from 59%
Estimated total cost of one incident
$351,761
Based on 6 business days of recovery for a professional services business with 5,000 personal records, discovered by the attacker, through a ransom note or leak.
Professional services global average
$6,247,200
Canadian average, all sectors
$6,630,800
Benchmarks are enterprise-weighted averages from the IBM Cost of a Data Breach Report 2025. A 25 person Ontario business will land well below them, which is exactly why a tailored estimate matters.
Where the money goes
Business interruption and lost business
$44,347
25 people × $38 × 85% loss, over 6 business days of recovery. Lost business is the single largest category in the 2025 report at $1.89 million.
Detection, escalation and forensics
$38,615
Breach coach, forensic investigators, containment and eradication. Globally this category averages $2.01 million and is the fastest falling, thanks to AI-assisted detection.
Ransom and emergency data recovery
$24,313
Exposure weighted by how recoverable your data is without paying. Incidents disclosed by the attacker averaged $6.96 million.
Breach notification
$17,500
5,000 records × $4 for notice, call centre and credit monitoring. Notification is the smallest global category at $534,300.
Legal counsel and PIPEDA reporting
$51,486
Privacy counsel, mandatory breach reporting, record keeping obligations. Part of post-breach response, $1.64 million globally.
Regulatory and contractual exposure
$8,000
Client contract penalties and audit response.
Rebuild and hardening
$17,500
Rebuilding endpoints and servers, new controls, password and identity resets.
Lost customers and reputation
$150,000
3% churn assumption for professional services applied to $5,000,000 annual revenue.
This is a planning estimate, not a quote. It excludes cyber insurance deductibles and premium increases, executive time, and the deals you never hear about because the incident made the news.
What the 2025 numbers actually say
Every benchmark below comes from the IBM Cost of a Data Breach Report 2025, published by IBM Security and Ponemon Institute.
$6.08M
Global average cost of a breach, down 9% from $6.69M, the first drop in five years
$6.63M
Canadian average, fourth highest in the world and rising while the global figure fell
241 days
Mean time to identify and contain a breach, a nine year low, still eight months of exposure
$6.86M
Average cost when the lifecycle passes 200 days, versus $5.30M when it stays under
$2.60M
Saved by organizations using AI and automation extensively in security, along with 80 fewer days of breach lifecycle
$917,900
Added to the average breach when staff use unsanctioned AI tools, the newest top cost amplifier
51%
Of breaches were malicious or criminal, with human error at 26% and IT failure at 23%
$7.15M
Average breach cost where security skills are short, versus $5M where they are not, the case for outsourcing
$6.96M
Average cost when the attacker discloses the breach, and only 40% of victims involved law enforcement
Where the average $6.08 million goes
- Lost business$1.89M
- Detection and escalation$2.01M
- Post-breach response$1.64M
- Notification$534,300
How long each attack route takes to resolve
- Third-party or supply chain compromise267 days
- Malicious insider260 days
- Phishing254 days
- Compromised credentials246 days
- Vulnerability exploitation245 days
Supply chain compromise and malicious insiders take the longest because both abuse trust that most monitoring never questions.
Source: IBM Cost of a Data Breach Report 2025, IBM Security and Ponemon Institute, August 2025. Figures are USD as published, shown in Canadian dollars at 1.37 CAD per USD. Canadian breach reporting obligations under PIPEDA apply on top of these costs.
Spend a fraction of this on preventing it.
Layered managed cybersecurity, tested restores, and 24/7 monitoring from a team based in Burlington, Ontario. The 2025 report puts a managed security service provider at $175,479 lower average breach cost.
