What Does a Data Breach Cost a Small Business? The Downtime Math
Downtime exposes revenue and creates recovery costs, but revenue at risk is not the same as a realized loss. Use a clearly labeled scenario to decide which systems and recovery controls deserve attention.
AZ / decision fieldnote
The cost pathway starts with the work that stops.
Disruption / business exposure
Access is lost
Email, identity or business systems become unavailable
Work is interrupted
People, orders and decisions wait on recovery
Costs accumulate
Lost operating time adds to the recovery effort
Use this in your decision
Use the business dependency and recovery assumptions to examine exposure.
- Which activities stop when this service is unavailable?
- How long would tested recovery take?
- Which assumptions in the cost estimate can be evidenced?
Reading aid for this article. The analysis and supporting sources follow below.
A company with $10 million in annual revenue averages $40,000 per business day if you assume 250 trading days. Five days represents $200,000 of revenue exposure. That is a hypothetical planning input, not a prediction that every five-day outage costs $200,000.
Separate the parts of the impact
| Item | What to estimate | Avoid counting twice |
|---|---|---|
| Revenue exposure | Work or sales interrupted during the scenario | Some revenue may be delayed and later recovered |
| Lost contribution | Permanently lost revenue less avoided variable costs | Do not add full revenue and the same margin loss |
| Incremental recovery cost | External response, overtime, replacement and restoration costs | Count additional cost, not ordinary payroll twice |
| Contract and customer impact | Applicable commitments and evidenced customer consequences | Do not assume every incident creates a fine or lost customer |
An outage can affect one department, one application or a wider environment. Email being unavailable does not automatically mean every sale stops. Ask the owner of each process what work can continue, what can wait and what cannot be recovered later.
An illustrative scenario, with explicit assumptions
Suppose $200,000 of activity is exposed, 20% is permanently lost, and the contribution margin on that lost activity is 40%. The contribution impact would be $16,000: $200,000 × 20% × 40%. Add $15,000 of hypothetical additional recovery spending and the scenario totals $31,000 before any separately assessed contractual effects. Change any assumption and the answer changes. These are invented planning inputs, not client results or a benchmark.
The purpose of this exercise is to identify a decision. If the critical process can resume from a tested recovery copy within the required time, the exposure scenario changes. If nobody knows what restores, the estimate remains uncertain.
Choose improvements by the failure they address
- Identity: review privileged access, authentication policies and emergency access.
- Data: identify the workloads and permissions that matter to the process.
- Recovery: agree a safe restore scenario and measure what it actually recovers.
- Operations: name the person who sees an alert and the person who authorizes action.
A Microsoft 365 risk and ownership review can document findings and priorities. A controlled recovery validation tests an agreed Microsoft 365 workload. Neither should promise to eliminate every incident or guarantee a financial saving.
About this article
Published by AZ Innovations, led by Alwatheq Zboun. We complete scoped Microsoft 365, security, migration and automation work. See who does the work or the delivered work.
Know what you own, what it costs, and what to fix first.
You get a verified map of the systems, a named owner against each, the decisions in priority order, and next actions with prices on them. Leadership or another provider can act on it directly.