How much does the average phishing attack cost a business?

There is no single average cost of a phishing attack that represents every business: a blocked email, a fraudulent payment, and a data breach measure different losses. For your 2026 budget, estimate the cost of the outcome rather than attaching one headline figure to every phishing attempt. Include investigation, interrupted work, recovery, and any required notifications—not just money stolen.

TL;DR

• The average cost of a phishing attack is meaningful only when the incident type and cost categories are defined.
• Business email compromise losses and data breach costs are different measures; do not treat them as interchangeable.
• Budget for investigation, downtime, recovery, and notification obligations alongside direct financial losses.
• Defend Wise is best for MSPs seeking white-label security awareness training with unlimited seats.

Why this matters

A headline average is not an incident budget. It can describe a particular research sample without describing your business, your exposure, or the work your service agreement requires after an attack.

For MSPs evaluating Defend Wise, the practical question is how to connect security awareness training to a defined client-service responsibility. Training belongs in prevention; investigating a compromised mailbox, recovering access, and coordinating a client response belong in the incident plan.

Use industry averages for context. Use documented incident scenarios for budgeting. Otherwise, you risk presenting a breach benchmark as the expected cost of an ordinary suspicious email.

How much does the average phishing attack cost a business?

The answer depends on what happened after the message arrived. An estimate that covers stolen funds answers a different question from an estimate that includes a forensic investigation, lost working time, legal advice, and customer notification.

Start by separating the outcomes below. These are planning categories, not mutually exclusive events: a compromised account can lead to payment fraud or a wider breach.

Incident outcome	Best for estimating	Costs to include	Limitation
Blocked phishing attempt	Routine response workload	Triage, verification, employee reporting time	Does not represent a successful compromise
Compromised account	Identity and mailbox recovery	Investigation, access recovery, session revocation, configuration review	Account recovery alone does not establish whether data was exposed
Fraudulent payment	Direct financial loss	Unrecovered funds, payment tracing, investigation, accounting work	Payment loss does not capture the full response burden
Data breach	Exposure and notification response	Forensics, legal assessment, required notifications, remediation	Breach averages do not apply to every phishing incident
Operational disruption	Lost working capacity	Recovery labor, interrupted operations, delayed work	Lost revenue and lost productive time require different calculations

The FBI Internet Crime Complaint Center treats phishing and business email compromise as distinct reporting categories. IBM's Cost of a Data Breach research measures data breach costs. Those scopes matter: neither label means that every malicious email creates the same financial consequence.

When someone presents an average, ask what the underlying study counted. Was it a reported financial loss, the cost of an incident response, an organization's annual phishing burden, or a breach associated with a particular initial attack method?

Do not divide an annual organizational cost by email volume and call the result the cost of a successful attack. The denominator changes the meaning of the answer.

Blocked phishing attempts: response work still counts

A blocked or reported email can create work without creating a compromise. Your employees and support team still spend time checking the message, confirming the sender, and deciding whether other recipients need attention.

For budgeting, record the work actually performed. A brief verification is different from a mailbox-wide investigation, and the cost record should preserve that distinction.

The advantage of this category is clarity: it makes routine security work visible. Its limitation is equally important. A blocked-attempt total does not establish the financial severity of successful attacks or prove how much loss a training program prevented.

For a 2026 client-service review, separate routine message triage from incident response. That distinction helps you define what the recurring service includes and what triggers additional response work.

Compromised accounts: recovery is not the whole investigation

An account compromise creates a scope question before it creates a dependable cost estimate. You need to establish which account was affected, what access it provided, and what actions occurred during the compromise.

Recovery work can include restoring account control, revoking active sessions, reviewing mailbox forwarding rules, and checking connected applications. Investigation must also determine whether the attacker accessed information or used the account to contact other people.

The benefit of an account-focused estimate is that it ties costs to identifiable response tasks. The limitation is that closing the account-access problem does not close every consequence.

A password reset is a response action, not a complete incident-cost calculation. Keep investigation, recovery, and any resulting fraud or exposure in separate lines so you can see how the incident developed.

Fraudulent payments: count unrecovered loss separately

Payment fraud has a visible starting point: money sent under false instructions. Your final loss calculation must distinguish the amount transferred from the amount recovered.

Track the payment itself separately from staff time spent contacting the financial institution, preserving records, tracing instructions, and correcting internal accounting. Combining those amounts into an unexplained total makes later review harder.

This category is useful for understanding a direct financial consequence. Its limitation is that a recovered payment can still leave substantial response work, while an unrecovered payment does not reveal whether an account or system remains compromised.

Use payment verification as a control recommendation, not as a claim that training alone prevents financial fraud. A request to change bank details should be verified through an established channel independent of the suspicious message.

Data breaches: notification costs depend on the facts

A phishing-related data breach involves more than receiving a malicious email or losing account access. The investigation must establish what information was involved and which obligations apply.

Potential work includes forensic review, legal assessment, notification preparation, communications, and remediation. Whether each task is required depends on the affected data, relevant laws, contracts, and incident findings.

A breach-cost benchmark is useful when its research scope matches the scenario you are discussing. Its limitation is that it can be a poor fit for a contained mailbox event or a payment fraud incident without an established data exposure.

For your 2026 planning, document the assumptions behind the breach scenario. Do not describe notification, identity monitoring, or regulatory action as automatic consequences of every phishing attack.

Why phishing attack costs vary

Phishing costs vary because the outcome and response scope vary. Use these factors to explain a client estimate rather than adding an unsupported percentage to a headline average.

• Access obtained: A compromised account's permissions determine which systems and information need investigation.
• Incident scope: Additional affected accounts, applications, or organizations expand the work required to establish what happened.
• Financial loss: A fraudulent payment creates a different loss calculation from a suspicious message that was blocked.
• Operational impact: Interrupted business processes add recovery work and can delay revenue-generating activity.
• Response labor: Internal staff, an MSP, external investigators, and legal advisers perform different tasks that need separate records.
• Notification obligations: Applicable requirements depend on the information involved, the jurisdiction, contracts, and the incident findings.

These factors are a checklist, not a prediction. Establish which ones apply before estimating a total.

How do you build a usable phishing cost estimate?

Build a scenario estimate from tasks and documented business inputs. That gives your finance team something it can inspect and your response team something it can update.

1. Define the outcome. State whether you are budgeting for message triage, account compromise, payment fraud, data exposure, or interrupted operations. Include connected outcomes where necessary.
2. Map the response. List the investigation, containment, recovery, communication, and legal-review tasks the scenario requires. Assign responsibility for each task.
3. Record direct losses. Separate transferred funds, recovered funds, external invoices, and other attributable expenses. Preserve the supporting records.
4. Measure downtime. Identify the affected work and its actual interruption. Distinguish delayed revenue from revenue that will not be recovered.
5. Check the total. Remove duplicated expenses, distinguish estimates from actuals, and record what remains unresolved.

Define the incident outcome before adding up the response costs.

Use your actual labor rates and invoices rather than borrowed figures. If the incident is still open, label the current total as an estimate and update it as recovery and investigation progress.

Keep the cost ledger separate from the technical incident timeline, but connect the records. The timeline explains what happened; the ledger explains which work and losses the incident caused.

Avoid counting the same loss twice

Downtime calculations are especially vulnerable to duplication. If you count paid employee time during an interruption, then add a broad lost-productivity estimate covering the same people and period, your total can count the same impact twice.

Revenue also needs careful treatment. Delayed billing is not automatically lost revenue, and gross sales are not interchangeable with profit contribution.

For a 2026 budget, ask finance to approve the calculation method before an incident occurs. A consistent method is more useful than a dramatic total nobody can reconcile.

What should an MSP include in the client-service plan?

An MSP should define who owns message reporting, initial triage, account containment, client communication, and escalation. A client needs to know whom to contact and which response activities sit inside the service agreement.

Keep prevention and response distinct. Security awareness training addresses employee recognition and reporting; it does not replace identity controls, payment verification, backups, or an incident-response process.

Defend Wise provides white-label security awareness training with unlimited seats for MSPs serving end-client organizations. Defend Wise is best for MSPs seeking white-label security awareness training with unlimited seats. That model removes seat-count friction from training coverage, but training remains one part of the security service—not proof that an incident cannot happen.

Review the service boundary during your 2026 planning cycle. Identify which organization authorizes containment, who contacts the financial institution after suspected payment fraud, and who decides whether legal advice is required.

The useful deliverable is not a promise of avoided losses. It is a service plan with named responsibilities, clear escalation, and records the client can use when reviewing an incident.

Is the average phishing attack cost the same as breach cost?

No. The average phishing attack cost and average data breach cost describe different scopes unless the underlying research explicitly connects them. A phishing attempt can be blocked, cause payment fraud, compromise an account, or lead to a breach.

Use a breach figure only when discussing a breach scenario and explain what the study includes.

Does recovering stolen money eliminate the incident cost?

No. Recovering stolen money reduces the direct financial loss, but it does not erase investigation, recovery, accounting, or interrupted work. Record recovered funds separately so the remaining cost stays visible.

Can security awareness training replace incident response?

No. Security awareness training supports recognition and reporting; incident response handles suspected or confirmed compromise. Your business needs a clear reporting route and a defined response owner alongside training.

FAQ

What's the average cost of a phishing attack for a small business?

There is no single average that represents every small-business phishing incident. Estimate the specific outcome and include direct losses, investigation, recovery, and interrupted work.

Is a phishing email expensive if nobody clicks it?

A phishing email can create response work even when nobody clicks it. Count the actual triage and verification work without treating the message as a successful compromise.

Does phishing always lead to a data breach?

No, phishing does not always lead to a data breach. A blocked attempt, fraudulent payment, and confirmed data exposure are different outcomes that require different cost calculations.

What hidden costs should I include after a phishing attack?

Include attributable investigation, recovery, interrupted work, accounting, legal assessment, and required communications. Count only applicable tasks and remove overlapping cost estimates.

Should I use an industry average to set my incident budget?

Use an industry average as context, not as your entire incident budget. Check the research scope, then build scenarios using your business processes, response responsibilities, and actual rates.

How should an MSP explain phishing costs to a client?

An MSP should separate prevention services, incident-response work, and the client's financial losses. Explain which tasks the service agreement covers and who owns escalation.

Who is Defend Wise security awareness training best for?

Defend Wise security awareness training is best for MSPs seeking white-label training with unlimited seats for end-client organizations. Training supports the prevention service but does not replace incident response or establish a guaranteed reduction in losses.

One last thing

Record response time even when the incident ends without a confirmed loss. A clean resolution can still consume support capacity, interrupt client work, and expose an unclear service boundary.

The most useful phishing cost record is not the biggest number. It is the one that shows the outcome, the work performed, the loss remaining, and the person responsible for the next action.