The Email Breach Bill Is Bigger Than The Stolen Money

Executive takeaway

An email attack can cost a small business far more than the money initially stolen. Recovery work, delayed payments and lost business can keep the bill growing after the incident ends. The research makes a useful case for treating email protection as a predictable operating expense, but its cost comparisons are scenarios—not guaranteed savings. Start with well-configured account and email controls, assess who can maintain them, and consider managed help where expertise is thin.

Buy against your actual exposure, and remember that outsourcing protection does not outsource responsibility for a breach.

The attack ends. The business disruption does not.

Stolen funds are only one part of the email breach bill. After a fraudulent payment is stopped—or the attacker loses access—a business may still face recovery work, interrupted billing and customers who need reassurance before paying another invoice.

Business email compromise, or BEC, is email-based deception designed to make someone act on a false business instruction. An attacker might impersonate an executive requesting an urgent transfer, send a fraudulent supplier invoice or manipulate payment details so money goes to the wrong account.

These attacks exploit the work email already does. When an inbox supports billing, customer contact and supplier coordination, compromising it threatens everyday operations—not just the confidentiality of messages.

That distinction matters for a small team. Checking which instructions were genuine, restoring access and confirming bank details can pull the same people away from collecting receivables, answering customers and keeping orders moving.

The scale of malicious email provides context for this exposure. MedhaCloud’s email security statistics reports roughly 3.4 billion phishing emails sent daily and 28% year-over-year growth in email-based threats in 2025, summarized in the first infographic below.

Email threat backdrop

• 3.4 billion daily: reported global phishing-email volume.
• 28% growth: reported increase in email-based threats in 2025.

Context for the threat environment—not a forecast of any individual business’s losses.

Phishing means using deceptive messages to trick recipients into revealing information or taking harmful action; it overlaps with BEC but is not an interchangeable measure. Neither the daily volume nor the growth figure tells a particular company how likely it is to suffer a successful attack.

The budgeting question is therefore not simply how much money could be stolen. It is what a small business should spend to reduce disruption it cannot comfortably absorb.

For a 50-person business, that means examining payment exposure alongside the staff time available to prevent and recover from fraud. Any later cost model should illustrate those trade-offs, not present a hypothetical loss as an observed outcome or an inevitable bill.

Source: Medha Cloud, 52 Email Security Statistics for 2026 (2026); threat growth refers to 2025

Follow the money beyond the fraudulent payment

The fraudulent payment is only the first line of the bill. To understand the operating impact of business email compromise, separate money stolen from the work needed to restore accounts, keep invoices moving and rebuild customer confidence.

A useful cost ledger has five categories:

• Direct loss: Record money sent to the attacker, distinguishing the original transfer from any funds recovered. Keep this separate from the expense of investigating the payment.
• Recovery work: Capture the effort to secure compromised accounts, investigate what happened and restore normal operations. Helpdesks resetting credentials and outside specialists supporting incident response belong here.
• Revenue disruption: Track interrupted billing, delayed receivables and business actually lost. Sales teams reassuring customers after fraudulent invoices are addressing a trust problem that may outlast the account compromise.
• Staff time: Finance teams may recheck payments while leaders coordinate the response with advisers and insurers. Those hours displace ordinary work, even when they do not generate an additional payroll expense.
• Compliance effort: Depending on the data involved and applicable obligations, the response may include legal review, notifications, audits or customer security questionnaires. These tasks consume technical and management capacity as well as any external fees.

Late cash is not the same as lost revenue—but it can still create an immediate problem. A customer may intend to pay in full yet pause while verifying bank details; meanwhile, the business still needs to cover payroll and suppliers.

For a lean company, that timing gap can mean drawing on a credit line or postponing investment before anyone knows whether customers will leave permanently. Track delayed receipts separately from confirmed lost sales, rather than treating every unpaid invoice as permanent damage.

Recurring remediation needs its own budget line. WifiTalents’ email-security statistics compilation reports $1,500 per employee annually in phishing-remediation costs, a broad organizational benchmark—not an SMB-specific certainty, a per-incident charge or a prediction for an individual employer.

That annual figure concerns ongoing remediation activity, including handling suspicious messages and account issues. It should not automatically be added to a successful breach’s recovery bill, because some of the same work may already be counted.

Use the five categories as a checklist, not five automatically additive totals. If a recovery estimate already includes internal labor or legal work, adding those costs again overstates the damage; similarly, delayed receivables should not also be booked as lost revenue.

The reported $4.45 million all-organization breach average is not a small-business forecast. A defensible estimate starts with the company’s payment exposure, collection cycle and available staff hours—not a headline average.

More security spending does not mean enough operating capacity

Small businesses are buying more email protection, but purchasing a tool is not the same as having people available to run it. The Gitnux industry-statistics compilation reports a $1.1 billion SMB email-security segment in 2023, with projected compound annual growth of 15% through 2027—meaning growth builds on each preceding year’s total.

Those figures provide directional market context, not evidence that any particular business spends too little. They describe purchases and expectations, not whether alerts receive attention, settings stay current or suspicious payment requests get investigated promptly.

For teams without security specialists, cloud-delivered protection and managed services offer an appealing way to reduce operational work. Mordor Intelligence’s market analysis describes growth in cloud deployment and integrated protection, reflecting a shift away from relying solely on equipment businesses must maintain themselves.

The main options perform different jobs, and they can overlap:

• Email gateways act as checkpoints, filtering messages before they reach employees’ inboxes.
• Cloud-integrated protection connects to the existing email service to identify threats within that environment, rather than relying only on a checkpoint at entry.
• Managed operations add people to the process: a provider handles agreed tasks such as monitoring, investigating alerts and coordinating responses.

The important distinction is where the protection runs versus who operates it. A cloud subscription can remove hardware maintenance without removing the need to review warnings, tune controls or decide what happens when a legitimate invoice is blocked.

For a 50-person business, the practical question is not simply how many mailboxes a subscription covers. It is who can investigate a suspected account takeover while the same small team is also handling billing, payroll and customer support.

Buyers should therefore ask what work remains with their staff, what response coverage is included and who can authorize urgent action. Payment exposure and available staff time are more useful selection criteria than vendor size: managed protection can outsource operational tasks, but it does not make the business’s financial consequences disappear.

What the numbers look like for a 50-person business

Consider an illustrative 50-person business with $5 million in annual revenue. This is a planning scenario—not an observed breach outcome, a forecast, or a claim that every business faces the same losses.

The WifiTalents statistical compilation reports benchmarks of 10% post-breach revenue loss for small businesses and $50,000 in recovery costs. Applying those figures to this hypothetical company produces the following arithmetic:

Scenario component	Calculation	Modeled amount
Annual revenue impact	$5 million × 10%	$500,000
Recovery spending	Reported benchmark applied to this scenario	$50,000
Combined scenario	Revenue impact plus recovery spending, if non-overlapping	$550,000

The $550,000 total is a conditional combination, not a single immediate cash bill. It also does not establish how frequently an incident of this severity would occur.

Revenue loss is not equivalent to profit loss: some costs associated with forgone sales might also disappear, while fixed costs remain. Nor is revenue loss necessarily the same as delayed collections—a late invoice can strain cash flow without becoming permanently lost revenue.

Before adding the categories, check what each benchmark includes and whether their measurement periods align. If recovery costs already include lost business or staff disruption, adding those effects again would double-count part of the damage.

Place the existing comparison figure here, labeling the breach amounts as illustrative and any combined total as conditional on non-overlapping categories. Omit unverified subscription figures from the comparison.

On the prevention side, assume one protected mailbox per employee only as a starting point. The budgeting reference behind the raw report’s subscription range has not been verified here, so that range and its annualized total should not be presented as established pricing.

Instead, request current quotes and calculate 50 mailboxes × the quoted monthly rate × 12. That yields an annual subscription estimate—not the all-in cost of operating an email-security program.

A useful budget separates:

• Subscriptions: the quoted licenses and included features.
• Implementation: setup, migration, and configuration work.
• Ongoing operations: alert review, training, and payment-verification procedures.
• Response readiness: internal responsibilities and any separately priced support.

Place the second infographic here, showing the distinction between revenue impact, recovery spending, cash-flow delays, and prevention costs. Keep modeled amounts visually separate from reported benchmarks.

Managed protection can shift monitoring and administration to a provider, but it does not transfer the financial consequences of a successful attack. For this business, the buying questions are how much money email can redirect and whether staff have capacity to operate the controls—not how large or fashionable the vendor is.

The contrast between a substantial incident scenario and a recurring protection budget motivates assessment, not guaranteed ROI. A defensible investment decision still needs business-specific costs, an incident-frequency assumption, and a credible estimate of how much the proposed protection could reduce losses.

Qualitative comparison of native suite controls, enterprise platforms and specialized email-infrastructure providers for small organizations. Method: This comparison table synthesizes characteristics discussed in the prevention-cost and decision-guide sections, contrasting feature depth, cost and operational complexity across three archetypal options: native suite controls, large integrated platforms, and specialized providers like DuoCircle. Entries are inferential and intended as directional guidance, not vendor ratings.[2][8][15][18]

Managed protection buys expertise, not immunity

Managed email protection buys operational capacity, not immunity from fraud. The shift toward cloud and managed delivery described in email security market research matters because businesses need people to run their defenses—not simply more features to license.

Depending on the contract, a provider can monitor threats, manage email authentication, tune detection rules and support incident response. Authentication helps receiving systems check whether messages genuinely come from an authorised sender; maintaining it requires ongoing attention as legitimate sending services change.

For a 50-person business, the practical benefit is having specialists handle work that might otherwise fall to an overstretched IT generalist. That is an operating-model illustration, not a measured saving: the value depends on which tasks actually leave the internal team’s queue.

A useful comparison starts with workload and coverage:

• Native controls: Examine the capabilities included in the actual productivity-suite license, how they are configured and who maintains them. Do not assume “built in” means basic—or that available features are switched on.
• Targeted add-ons: Consider these when a specific detection or authentication gap remains. Check who will investigate their alerts and whether they create another console for staff to manage.
• Managed services: Assess the work the provider explicitly takes on, including monitoring hours, rule tuning, authentication changes and response support. Ask what still requires customer approval or action.

The customer retains governance: deciding acceptable risk, controlling payment approvals and assigning responsibility for business recovery. A provider may investigate a compromised mailbox, but the business still needs someone authorised to contact its bank, coordinate customer communications and address applicable reporting obligations.

Service commitments are not automatic compensation. Uptime or response-time promises should not be read as guarantees to reimburse fraudulent transfers, replace lost sales or absorb regulatory exposure; examine the contract’s remedies, exclusions and liability limits.

Before buying, ask for a written responsibility map and walk through a realistic invoice-fraud scenario. Who spots it, who can contain it, who approves action after hours, and who funds recovery? Those answers reveal more about suitability than vendor size: the right service matches the business’s payment exposure and the work its own staff cannot reliably sustain.

Build a budget around your exposure and your team

Budget for the exposure you have and the work your team can sustain. Vendor size and market momentum are not substitutes for understanding how email supports payments, billing and customer relationships.

1. Review incidents and near misses. Look for attempted payment diversions, payroll changes and impersonation of executives or suppliers. Record the investigation time and billing disruption, not just whether money disappeared.
2. Map your dependence on email. Identify where emailed instructions trigger payments and where mailboxes hold sensitive information. Consider how a compromised account could interrupt collections or damage customer confidence.
3. Check internal capacity. Name who will configure controls, monitor alerts, investigate suspicious messages and maintain policies. A subscription does not supply those working hours unless the service explicitly includes them.
4. Choose the operating model. Use native controls where they meet your requirements and staff can maintain them; add targeted protection for uncovered risks. Consider managed help when the necessary expertise or time is missing.

Start with correctly configured and monitored SPF, DKIM and DMARC, which help receiving systems check whether messages are authorized by your domain. Pair these with phishing-resistant multifactor authentication and least-privilege mailbox access—giving people only the access their jobs require.

Then assess additional business email compromise (BEC) detection for impersonation and payment fraud, alongside ongoing awareness training. These are complementary layers, not guarantees against fraudulent instructions or account compromise.

Decision tree: match protection to exposure and capacity

Review incidents and near misses
↓
Map payment instructions and sensitive information
↓
Establish and maintain baseline controls
↓
Can your team operate the required defenses?
├─ No → Managed help with an explicit scope
└─ Yes → Do native controls meet identified needs?
├─ Yes → Native controls + monitoring
└─ No  → Add targeted protection

Build the budget from those requirements, rather than applying a universal percentage of revenue. Include subscriptions, configuration, monitoring, staff training and support, with clear ownership for each recurring task.

For scale, applying the reported mailbox-pricing range of $8–$15 per month to 50 mailboxes produces $4,800–$9,000 annually in subscriptions alone. That is an illustrative calculation—not a vendor quote, a complete operating budget or evidence of avoided losses.

For managed service providers (MSPs), the takeaway is to explain what gets maintained, who responds and what remains the customer’s responsibility in business language. State pricing and loss-model assumptions plainly: managed protection outsources agreed operational work, not the financial consequences of a successful attack.

A practical decision tree to help small organizations determine when to stick with native email controls and when to adopt managed protection. Method: The decision tree encodes qualitative thresholds discussed in the decision-guide section: incident history, transaction volume, internal expertise and regulatory exposure. Nodes represent yes/no or threshold choices leading to three broad outcomes: stay with native controls, augment with focused services, or adopt fully managed email protection. Logic is derived by inference from breach economics and spending patterns.[2][7][18]

Limitations

• Several loss benchmarks come from statistical compilations with limited methodological detail; they are not reliable forecasts for an individual business.
• The supplied source list omits the budgeting references numbered 17 and 18. Mailbox prices and spending benchmarks need verification before publication.
• Market estimates use different definitions and periods, and some inline source numbers are inconsistent. Avoid combining them into a single precise market estimate.
• The research supplies neither incident probabilities nor measured protection effectiveness, so the scenarios cannot establish expected losses or guaranteed ROI.

References

1. Email Security Solutions Industry Statistics 2026 - WifiTalents
2. Email Security Solutions Industry Statistics: Market Data Report 2026
3. 52 Email Security Statistics for 2026 — BEC, Spam & Phishing
4. Email Security Market Size, Growth | Share & Competitive …