Incident Response Cost: What a Breach Costs to Fix

Ask what incident response costs and the internet answers in hourly rates. Eight hundred to fifteen hundred dollars an hour in an emergency, a few hundred with a retainer, a five or six figure annual commitment on top. Those numbers are repeated across dozens of pages, and not one of the pages that ranks for this question attributes a single rate to a survey, a dataset or a named sample.

There is now a measurement. In 2026 the team that writes the Verizon Data Breach Investigations Report published a separate study built on roughly 70,000 United States cyber insurance claims, and it prices the response work as its own category of loss. What follows is that data, the IBM cost figures the whole industry quotes, and the parts of your own invoice that neither one can predict.

How Much Does Incident Response Cost?

The best answer available is not a rate card. It is a distribution, and it comes from money that insurers actually paid out.

Verizon's 2026 Breach Impact Study, produced with the cyber insurance data organization CyberAcuView, reviewed 69,683 US cyber insurance claims, of which 38,181 had recorded losses paid to policyholders, for incidents occurring between January 1, 2019 and October 31, 2025. It sorts every dollar into four loss types, and one of them is response and recovery, split into incident response and data restoration.

Read the response and recovery line first, because it is the line this question is asking about. Incident response is the most common loss type in the entire dataset, appearing in more than 60 percent of claims on its own, and it is also one of the smaller ones per event. Most companies that file a cyber claim pay a forensic bill in the tens of thousands of dollars. A minority pay several hundred thousand.

The frequency matters as much as the amount. A response bill is close to certain once an incident is real enough to claim on, whether the cause was ransomware, a lost laptop or a business email compromise. Business interruption is rarer and far more expensive when it lands.

What a Data Breach Costs in Total

The response invoice is one slice. The figure most people have in mind is a different measurement entirely, and confusing the two is how budgets get set wrong in both directions.

IBM's Cost of a Data Breach Report puts the global average cost of a data breach at USD 4.99 million, a 12 percent increase over last year and a record high. The full 2026 report records a US average of USD 11.5 million, an 11 percent rise and nearly double the global figure, which IBM attributes to higher business costs and higher regulatory fines in the US. It breaks that average into four components: detection and escalation at USD 1.64 million, lost business at USD 1.54 million, post-breach response at USD 1.36 million and notification at USD 0.45 million. Post-breach response, which IBM defines as including regulatory fines, legal expenditure and credit monitoring for affected customers, rose fastest of the four at 15 percent.

Set that against a claims median of $83,000 and the gap looks like an error. It is not. IBM surveys 602 organizations that agreed to participate and reports a mean, which a handful of catastrophic breaches pull upward. The claims dataset counts tens of thousands of ordinary incidents and reports the midpoint. Both are true. The average describes the tail; the median describes your Tuesday.

Business interruption is the loss type to watch. It appeared in roughly 10 percent of claims but accounted for about 22 percent of total costs, with a median around $90,000 and extremes approaching $5 million, and it grew from 21 percent of known losses in 2023 to 32 percent in 2024. External liability, meaning lawsuits, regulatory penalties and card brand fines, showed up in only 6.4 percent of claims with a median around $22,000, though the study cautions that legal costs arrive years late and its own sample almost certainly undercounts them.

Where the loss lands also depends on who was attacked and how. Incidents traced to a supply chain attack or a compromised service provider ran a median impact around $141,000 for third party events, and business interruption alone accounted for half of all losses in that category.

What Drives the Cost of a Breach Response

Nothing in the numbers above predicts your invoice, because the invoice is hours multiplied by a rate, and five things decide the hours.

How much you can hand the responders on day one. A forensic team bills for reconstructing what happened. If your logs are centralized and retained, that reconstruction takes days. If endpoint logs rolled over a week ago and nobody can say which accounts were privileged, the same investigation takes weeks and the answer is less certain at the end of it.

How many systems are in scope. Scope is not the size of your company, it is the number of hosts, identities, cloud tenants and mailboxes that could plausibly have been touched. Every system that cannot be ruled out has to be examined.

Whether the contract already exists. Firms hold capacity for clients who signed in advance, and the hours spent on conflict checks, a purchase order and a signature during week one are hours nobody is investigating. That is most of the argument for an incident response retainer, and it is a scheduling argument as much as a pricing one.

Who is doing the work. The US Bureau of Labor Statistics reports that information security analysts had a median wage of $129,180 a year in May 2025, stated also as $62.11 an hour, with the top 10 percent above $199,850. BLS does not publish a separate wage for forensic responders, and a firm's billed rate has to carry salary, tooling, insurance, standby capacity and the hours nobody is paying for between incidents. Use that as a floor under the labor, never as a prediction of a rate.

How many people you will have to notify. This is the cost that scales with your customer list rather than your infrastructure, and it is covered below.

Incident Response Cost by Company Size

Size moves the number more reliably than industry does, and the Breach Impact Study segments by revenue rather than headcount.

That last ratio is the one small companies should sit with. The absolute figures look survivable and the proportions do not. A large enterprise absorbing $283,000 has a line item; a company with $8 million in revenue absorbing 7 percent of it has a crisis. Response and recovery also makes up a larger share of what SMBs lose, at 40 percent of known losses, because the other three loss types require scale to generate.

NetDiligence's 2025 Cyber Claims Study, a separate analysis of 10,402 cyber insurance claims from incidents between 2020 and 2024, makes the same point from the other end: large companies were just 2 percent of the dataset yet represented over half of all incident costs. Any average built across both groups describes neither.

What Is Included in an Incident Response Invoice

The FTC's data breach response guide for business sets out what a real response involves, and it is a longer list than most first time buyers price for. It advises assembling a team spanning forensics, legal, information security, IT, operations, human resources, communications, investor relations and management, hiring independent forensic investigators to determine the source and scope of the breach, and considering outside legal counsel with privacy and data security expertise.

What sits outside the fee is consistent. Your own engineers' time is not billed to anyone and is not free. Remediation, meaning the work that stops it happening again, is a separate project. And your insurance deductible sits underneath all of it, which is why the smallest incidents never appear in claims data at all.

What Notification and Credit Monitoring Cost

Notification is the only response cost that scales with your customer list rather than your systems, and it is the one that turns a contained technical incident into a seven figure event.

IBM measures notification as its own component of the global average, at USD 0.45 million. That covers list preparation, delivery, call center capacity and regulator correspondence. The obligation itself comes from state law. California requires notification of residents whose unencrypted personal information was acquired by an unauthorized person under Civil Code 1798.82, and any organization notifying more than 500 California residents must also submit a sample copy to the Attorney General. Every other state has its own version, with its own definitions and deadlines, which is why counting the affected people is a legal exercise before it is a mailing exercise.

The FTC also advises offering at least a year of free credit monitoring or identity restoration, particularly where financial information or Social Security numbers were exposed. That is a recommendation rather than a federal requirement, but it has become the practical expectation, and it is priced per person enrolled.

How Long Containment Takes and What the Delay Costs

Time is the multiplier on every figure above, and the industry has stopped getting faster.

IBM reports that the mean time to identify and contain a breach rose to 247 days, made up of 183 days to identify and 64 days to contain, a 2.5 percent increase that reversed five consecutive years of improvement. The cost consequence is measured directly: breach lifecycles longer than 200 days averaged USD 5.65 million against USD 4.32 million for those under 200 days. Only 42 percent of breached organizations reported having fully recovered, though that is up from 35 percent the year before.

Most of that clock is spent before anyone knows there is an incident, which is why detection spending and response spending are the same budget argument. A tested incident response plan does not reduce the forensic rate. It reduces the number of days on the invoice, and days are what the invoice is made of.

Does Cyber Insurance Cover Incident Response Costs?

Usually, and with conditions that change the number you will actually pay.

The Breach Impact Study is itself the clearest lesson here, because its methodology describes the mechanics of a real claim. It records insurable loss, meaning only what the policy covered, and its authors state plainly that actual financial consequences were possibly higher, since figures are shaped by deductibles, coverage scopes and payout limits. It excludes zero dollar claims, where the total adjusted loss came in below the policy deductible, which is to say the entire population of small incidents a company absorbed itself. And it notes that specific categories of loss are subject to sublimits, internal caps on particular costs such as contingent business interruption or extortion, so the recorded amount can be the cap rather than the loss.

Three practical consequences follow. Your deductible is the first money out and it is yours. Sublimits mean a policy with an adequate headline limit can still leave the largest single component underinsured. And most carriers require you to use a firm on their approved panel, or to obtain consent before incurring costs, which is a conversation nobody wants to be having on day one.

What a Ransomware Response Costs

Ransomware is the incident type most likely to produce every loss category at once, which is why it dominates the expensive end of every dataset.

Across ransomware claims in the Breach Impact Study, extortion payments made up 32 percent of losses and business interruption 26 percent. Notably, 48 percent of ransomware claims contained no data restoration loss and no extortion loss whatsoever, which lines up with the 2026 DBIR finding, quoted in the same study, that 69 percent of victims did not end up paying the ransom, a proportion that has been growing since at least 2022.

On the ransom itself, the most honest figures come from a firm that negotiates them and publishes its own caseload. Coveware's second quarter 2026 report records an average ransom payment of $1,880,612 and a median of $150,000, a gap that tells you almost everything about how skewed this market is. It also reports that the payment rate for data exfiltration only extortion fell to a historic low of 15 percent, and that the median victim's company size rose to 750.

If the money genuinely is not there, the first call is still free. CISA advises organizations hit by ransomware to determine which systems were impacted and immediately isolate them, and to report the incident to and consider requesting assistance from CISA, the local FBI field office or the Internet Crime Complaint Center. That is not a substitute for a forensic firm, and it does not restore anything, but it costs nothing and it starts the record you will need later.

How to Reduce What a Breach Costs You

Everything that lowers this bill has to be bought before the incident, which is the awkward part of the pitch and also the whole point.