What Would One Week of IT Outage Actually Cost Your Business — in Euros, Customers, and Reputation?
On a Monday morning in February 2024, a Sligo-based logistics company arrived at work to find their systems encrypted by ransomware. By Wednesday they had confirmed the backups were corrupted. By Friday they were paying staff to process orders manually, losing three clients who could not wait, and explaining to a fourth why their invoice would be late. They were back online the following Thursday. Eleven days. The direct cost exceeded €90,000. The indirect cost — in client relationships, staff overtime, and the managing director's time — was harder to calculate and probably higher.
Most Irish SMEs have never done the calculation. They know an outage would be bad. They do not know how bad. And because the number is abstract, the investment in prevention feels optional.
It is not optional. Here is how to work out what it would actually cost you.
What Is the Real Cost of Downtime?
The cost of an IT outage is not just the bill your IT provider sends to fix the problem. It is the sum of every hour your business cannot operate normally, multiplied by the financial and reputational value of what you cannot do during that time.
That number has four components. Most businesses only think about the first one.
The Four Cost Categories
Direct revenue loss is the most visible. If your business takes orders, processes payments, invoices clients, or delivers services that depend on IT systems, every hour those systems are down is an hour of revenue you cannot generate. For a Letterkenny accountancy firm with €800,000 in annual revenue, a working week is approximately €15,000 in billable time. For a Donegal food producer with a €3 million turnover, a week of disruption to ordering and dispatch systems could represent €60,000 in delayed or lost sales.
Staff cost without productivity is less obvious but equally real. Your team is still arriving, still being paid, and largely unable to do their jobs. Some will find workarounds — processing paper, making phone calls, improvising. Most will be significantly less productive than normal. For a business with ten staff costing an average of €35,000 per year each, a week of partial productivity costs roughly €6,700 in salary alone, without accounting for the management overhead of coordinating a manual operation during a crisis.
Recovery cost includes the IT provider's emergency rates, which are typically 50–100% higher than normal rates. It includes hardware replacement if equipment was damaged or destroyed. It includes data recovery specialists if backups have failed. It includes any ransom payment if ransomware is involved and the decision is made to pay. It includes the cost of notifying affected customers and, where required, the Data Protection Commission.
Reputational cost is the hardest to quantify and the longest-lasting. Clients who cannot reach you, receive late deliveries, or discover their data was involved in an incident do not always tell you they are leaving. They quietly move to a competitor. The Sligo logistics company lost three clients permanently. They never formally complained. They simply did not renew.
Have you ever calculated what a five-day outage would actually cost your business? Most owners we speak to in Donegal and the North-West have not — and the number, when they work it out, is consistently higher than they expected. Book a free 20-minute strategy call — we can help you run the calculation and identify the highest-leverage investments to reduce it.
How to Calculate Your Own Number
The calculation is not complex. It requires honest answers to four questions.
Question one: what is your daily revenue? Take your annual turnover and divide by 250 working days. A €500,000 business generates approximately €2,000 per working day. A €2 million business generates approximately €8,000 per day. This is your baseline revenue exposure per day of outage.
Question two: what percentage of that revenue depends on IT systems? For most Irish SMEs in 2026, the honest answer is somewhere between 70% and 100%. If your invoicing, ordering, payments, communications, and scheduling all run through digital systems, a total outage affects nearly all of it.
Question three: what is your daily staff cost? Add up your monthly payroll and divide by 22 working days. Multiply by the number of staff who cannot work effectively without IT access. This gives you the daily cost of productive capacity you are paying for but not receiving.
Question four: how long would it realistically take to recover? This is the question most businesses answer too optimistically. The average time to recover from a ransomware attack for an Irish SME without tested backups is seven to fourteen days, based on NCSC Ireland incident data [^1]. With tested, isolated backups, it drops to one to three days. Without any backups, it may never be complete.
Multiply your daily exposure by your realistic recovery time. Add your estimated recovery cost. Add a reasonable estimate for client attrition. That is your number.
What Irish SMEs Find When They Do This
When businesses work through this calculation, a consistent pattern emerges. The number is large enough to justify a meaningful investment in prevention. It is almost always larger than the annual cost of the controls that would reduce it — proper backups, a tested business continuity plan, adequate insurance, a basic incident response procedure.
A business that calculates a €50,000 five-day outage exposure and then discovers that tested, isolated backups cost €1,500 per year to implement and maintain has arrived at a very clear investment decision. Most do not do the calculation. Most therefore do not make the investment.
The NCSC Ireland's 2024 annual report noted that the majority of significant incidents affecting Irish SMEs resulted in operational disruption lasting between three and fourteen days, with total costs — including recovery, lost revenue, and staff time — frequently exceeding €30,000 for businesses with fewer than 50 employees [^1].
The question is not whether a significant IT outage could happen to your business. The NCSC Ireland, An Garda Síochána, and the Data Protection Commission are unanimous that Irish SMEs are actively targeted and that incidents are increasing year on year. The question is whether, when it happens, your business survives it intact.
The Resilience Investment Comparison
Once you have your outage cost number, compare it against what adequate resilience actually costs.
Tested, isolated cloud backups with a recovery point objective of 24 hours or less: approximately €80–200 per month depending on data volume. A documented business continuity plan that non-technical staff can follow: a one-time investment of perhaps two days of management time and a few hours of professional input. Cyber insurance that covers ransomware response, business interruption, and third-party notification costs: approximately €2,000–5,000 per year for a typical Irish SME depending on turnover and sector.
The annual cost of those three controls combined is, for most Irish SMEs, less than one day of the outage they are designed to prevent.
This is not an argument that spending money on resilience is always the right answer. It is an argument that the decision should be made with clear numbers in front of you, not on the basis of vague discomfort and optimism bias.
What Next
Do the calculation today. Take twenty minutes and work through the four questions above. Write the number down. Share it with your accountant, your business partner, or your IT provider. The act of making it concrete changes the conversation.
Identify your longest single point of failure. What is the one system, one person, or one process whose loss would cause the most damage? That is where your resilience investment should start.
Test whether your recovery would actually work. When did you last restore data from a backup? When did you last check whether your backup was actually running? The answer, for most Irish SMEs, reveals the most important gap.
Ready to find out exactly where your business stands? Book a free 20-minute strategy call with our vCISO team at www.pragmaticsecurity.ie/book-a-call. No sales pitch. No jargon. Just clarity on your cyber risk — and a clear plan to address it.
Related Reading
- How to Build a Simple, Tested Business Continuity Plan That Non-Technical Staff Can Use
- How to Test Your Backups and Disaster Recovery Instead of Just Trusting They Work
- Cyber Insurance: What Insurers Now Expect You to Have in Place Before They Will Pay Out
[^1]: NCSC Ireland — Annual Cybersecurity Report 2024 [^2]: An Garda Síochána — National Cyber Crime Bureau [^3]: Data Protection Commission Ireland — Breach Reporting
Pragmatic Security — Cybersecurity advisory for Irish businesses. Based in Donegal, Ireland. CISA, CISSP, CISM certified advisors.
