Direct and indirect costs of cyber incidents in the small enterprise
Authors
Keywords
cyber incidents, small and medium-sized enterprises, direct costs, indirect costs, cyber risk
Summary
The present study examines the critical need for a precise differentiation of the economic consequences of cyberattacks for the most vulnerable group of market participants - small and medium-sized enterprises (SMEs). At present, the conditions for doing business in the digital sphere are entirely shaped by increasingly sophisticated technological challenges (AI-based threats, automated attacks, etc.), as well as regulatory pressures (the implementation of more niche and stringent requirements such as the NIS2 Directive), which place companies under significant financial strain. In this context, small businesses often prove to be financially unprepared due to their inherent pragmatic focus on direct and visible costs following such incidents. The main objective of this report is to propose a logical framework for differentiating the costs associated with cyber incidents in SMEs, enabling more accurate identification, tracking, and assessment of economic consequences in the short, medium, and long term.
Pages: 15
DOI: https://doi.org/10.58861/tae.grdier.2026.04


