₱4.7M: the real cost of a breach for Philippine SMBs

01 Where the ₱4.7M goes

Across 12 Filipino SMBs we worked with after the fact, on incident response rather than a red team, we collected the real cost data and built a line-item average [ IBM 2024 ] . The figure landed at ₱4.7 million. Every breach decomposed into the same five categories. The proportions moved. The categories did not.

Direct fraud loss ran between ₱600,000 and ₱6 million, with a median of ₱1.4 million. This is the money that left the account through wire fraud, altered payroll or merchant-account abuse. You recover it in roughly 12 per cent of cases if you report inside 24 hours, and almost never after the third business day.

Incident response and forensics ran from ₱250,000 to ₱2.8 million, median ₱750,000, for work spanning 5 to 15 days. Businesses without a retainer paid far more than those with a partner already on the books, because crisis-mode rates sit around double the normal figure.

Regulatory exposure under the Data Privacy Act can reach ₱5 million per violation [ NPC · Data Privacy Act ] . In practice we saw fines of ₱200,000 to ₱1.8 million, most settling between ₱400,000 and ₱800,000. The NPC weighs the size of the business and the quality of the response. Firms that delayed notification or had no documented plan paid materially more.

02 The silent killer

Business interruption is the line item that consistently blew past what owners expected. We watched operations stall for anywhere from 4 days to 6 weeks. For a 30-person firm that means ₱800,000 to ₱4 million in lost margin and recovery cost, and trading firms and BPOs took the hardest hit because their revenue lives or dies on systems staying up.

This is why IBM and our own local data both file response cost and interruption together as the single largest combined item, often larger than the fraud itself. The system you build before a breach decides your total cost more than the size of the breach does. Attackers now sit inside a network for days before anyone notices, and every one of those days carries a price [ Mandiant M-Trends 2025 ] .

03 The math against a red team

A Filipino SMB red team scales from a focused entry engagement to a full scope covering Microsoft 365, Active Directory and social engineering. Even at the fuller end, that lands well under a fifth of the average breach cost.

Prevent a single breach across a five-year horizon and the return sits between 5x and 17x. Prevent nothing and the cost was roughly one month of one mid-level salary. Shorten the response window by even three days when a real incident hits, because your asset inventory is current and your runbook is written, and the saving in interruption cost alone often covers the engagement [ Verizon DBIR 2024 ] .

Weight that ₱4.7M by the 30 to 55 per cent chance an unprotected SMB gets hit, and the expected cost of doing nothing lands between ₱1.4 million and ₱2.6 million. A credible red team costs a small fraction of that. The question was never whether to assess. It is whether you find the holes through us, on your schedule, with time to plan, or through an attacker, on theirs, with the balance dropping in real time.

04 What you actually buy

You do not buy a vulnerability scan. A scan hands your team a list of CVEs they already knew about. What a red team gives you is the story a scan cannot: how an attacker would target your business given your industry, your online footprint and your people; how they gain the first foothold; what they reach once inside; and how long they stay invisible against your current monitoring.

That story is what makes findings actionable. Thirty vulnerabilities is overwhelming. A single sentence, "the attacker reaches your accounting workstation in 4 hours, here is the one change that stops it", is a decision the owner can make on Tuesday. You get it as a 25-to-40-page report: a 15-minute executive summary for you, a technical section for your IT provider, and a remediation roadmap with quotes for the changes that need budget.