Is Cybersecurity Training a Good Investment?

Cybersecurity training costs money. But the cost of neglecting that training can be even more severe. According to the Ponemon Institute’s Cost of a Data Breach Report 2019, the global average total cost of a data breach is $3.92 million dollars.[ii] For companies in the United States, that number is even worse: the average American data breach costs $8.19 million. That’s the equivalent of losing over $22,000 every day for one year.

And the pain doesn’t stop there. A cybersecurity incident can continue to cost money for years after the initial attack. Of the companies studied by the Ponemon Institute, 67% of breach costs on average were accrued in the first year, 22% in the second year, and 11% of costs occurred more than two years after a breach.[iii]

Cybersecurity breaches don’t just hurt the company coffers. They can lead to legal repercussions as well. In the case that a lawsuit or insurance claim arises as the result of a cyberattack, an organization’s cybersecurity training – or lack thereof – will likely be questioned. If the company is found negligent, the penalties can be severe at both a federal and state level. As of 2019, 31 states had enacted cybersecurity-related legislation, covering a broad swath of industries and sectors.[iv]

Cybercrime is big business, and intellectual property is an attractive target for criminals. A company’s intellectual property is its crown jewels. And while intellectual property breaches aren’t always as widely reported as other types of cyberattacks, they are every bit as harmful. Ramifications of intellectual property theft can include loss of property, loss of competitive advantage, loss of market share, and even risks to national security.

For some companies, recovering from an intellectual property breach has been shown to be impossible. Once their intellectual property has been stolen, it is impossible to control who accesses, trades, and benefits from it. In a rapid development market, clones of products can be made faster than ever. Not only is the money invested in R&D gone, clones at lower costs are a real theat to market share and long-term company profit.  When a company is robbed by cybercriminals, their intellectual property is typically sold and cybercriminals profit.

One of the longest-lasting and most pervasive forms of damage caused by a cyberattack is the loss of public trust. Reputational damage is difficult to quantify, but impossible to ignore. And providing a year’s worth of identity theft protection coupled with a statement assuring that “we take cybersecurity seriously” doesn’t go very far with angry consumers.

Trust is difficult to build and incredibly easy to lose. In the corporate realm, that loss can lead to loss of customer relationships, increased insurance premiums, and public scrutiny and shame. In the military sphere, mission readiness and international cooperation may be irretrievably damaged. And in the political arena, a loss of public trust can lead to national instability.