It’s one of the first questions people ask when something goes wrong, and one of the hardest to answer without knowing more. The honest answer is that it depends on the incident. This guide explains what drives the cost, what the latest Australian figures say, and how to keep a response proportionate.
What cybercrime costs Australian businesses
The Australian Signals Directorate’s Annual Cyber Threat Report 2025–26 puts the average self-reported cost of cybercrime per report at:
- $55,400 for small businesses
- $141,300 for medium businesses
- $148,100 for large businesses
- $93,500 across all businesses, up 16% on the year before
These are averages of what businesses told ASD the incident cost them, which can include lost money, downtime and recovery. They aren’t the cost of incident response alone, and individual incidents vary widely. They do show why a quick, well-run response is worth it.
What drives the cost of a response
Incident response is mostly skilled people’s time, so cost follows the amount of work needed to answer the important questions. The main drivers are:
- Scope. How many accounts, systems, sites and people are involved.
- Dwell time. How long the attacker had access before anyone noticed. More time usually means more activity to review.
- Type of incident. A single compromised mailbox is very different from ransomware across a whole network.
- Evidence. Whether the records that answer the key questions still exist, and how much of them there is to review.
- What you need to know. Some incidents need only enough to contain and recover. Others need a detailed account for insurers, lawyers or regulators.
- Recovery support. How much hands-on help is needed to get back to normal safely.
How Authene prices a response
We don’t start with a blank cheque. After triage we agree the questions that need answering and give you an estimate. If the scope changes, we tell you before it does, not after. That approach, along with our others, is explained on our incident response page.
Will cyber insurance cover it?
Many cyber insurance policies cover incident response, forensic investigation and some recovery costs. Policies differ, and most have an incident process you need to follow, sometimes including a requirement to use or notify their panel. Check your policy and call your insurer early.
How to keep the cost down
- Act early. A compromise caught in hours costs far less to investigate than one discovered after months.
- Don’t destroy the evidence. Wiping machines or deleting accounts can turn a short investigation into a long one, or make some questions impossible to answer.
- Know who you’ll call. An incident response retainer removes procurement and onboarding from the first hours, when time matters most.
- Turn on logging before you need it. Many cloud services keep limited records by default.
- Rehearse. A tabletop exercise finds gaps in your plan while the stakes are low.
- Close the common gaps. Most incidents start with a weak setting, not an exotic attack. Security hardening deals with those first.
The real cost is the one you don’t see
The response fee is usually a small part of what an incident costs. Downtime, lost payments, customer trust and repeat attacks cost more. Recovering twice costs twice, which is why getting the response right the first time is the cheapest option in the end.
If you’re dealing with an incident now, email response@authene.com.au. A responder replies within 15 minutes, 24/7/365, and we’ll give you an estimate once we understand what’s needed.
Sources
- Australian Signals Directorate, Annual Cyber Threat Report 2025–26