The Small-Business Cyber Cost-of-Confusion Worksheet

Start with the decision, not a headline

This worksheet is not designed to prove that every small business will suffer a six-figure loss. It is designed to answer a more useful question:

What is unresolved cybersecurity confusion already worth inside this business?

The answer may sit in a cyber insurance renewal, one interrupted workday, subscriptions nobody can explain, or cleanup that becomes harder every time the company adds another employee, device, vendor, or cloud service.

Use your own numbers. Broad claims data can show that losses occur, but it cannot predict the cost or probability of an incident for your company. A smaller, defensible estimate is more useful than a dramatic number that leadership does not believe.

Complete the four comparisons below. Then choose no more than three actions the business can own.

Comparison 1: Control the insurance conversation

Cyber insurance is not a substitute for security, and security work does not guarantee a lower premium. The business should still be able to explain what it represented on an application, who supports those answers, and what financial exposure remains under the policy.

Record the current baseline:

List application or renewal answers that still need support. Focus on consequential subjects such as multifactor authentication, backups, administrative access, endpoint protection, security training, incident response, and payment verification.

Marsh's US cyber insurance market update describes control posture, documentation, and accurate underwriting information as meaningful parts of the market conversation. That does not mean a specific control or Checkup will lower your rate. It means leadership should own its answers instead of discovering unsupported assumptions during renewal or a claim.

Insurance exposure to carry forward: $________ annual premium + $________ retention or deductible + any unsupported answer leadership needs to resolve.

Comparison 2: Prevent avoidable confusion during one constrained day

Do not start with a catastrophic breach scenario. Pick one realistic interruption: email unavailable, the accounting system locked, production files inaccessible, payment instructions under suspicion, a cloud provider outage, or an important laptop and account compromised together.

Name the workflow and price one day in which the business cannot operate normally.

Use affected gross margin or production contribution when possible, not total revenue as though every dollar disappears. Add the payroll that would remain idle, emergency technical or professional help, expedited shipping, customer concessions, and owner time that the business would reasonably absorb.

Illustrative example: Five employees at a $40 loaded hourly cost for eight hours creates $1,600 in idle payroll. Add six hours of emergency support at $200 per hour and the immediate estimate becomes $2,800 before lost sales, delayed work, or owner cleanup time. Replace every assumption with your own.

One-day constrained-operations estimate: $________

Now ask whether the business can answer these questions without searching through email during the event:

• Who has authority to stop the affected process?
• Who contacts the technology provider, insurer, bank, counsel, customer, or law enforcement when appropriate?
• Which systems and operations recover first?
• Where is the contact and recovery information if company email is unavailable?
• Who verifies payment or account-change instructions through a known second channel?

The value is not pretending a Checkup will eliminate downtime. It is preventing avoidable delay caused by missing ownership, unclear provider responsibilities, and recovery assumptions nobody has tested.

Comparison 3: Own security spending before it renews itself

Security waste is not limited to bad products. A capable tool can become waste when the business does not know what it covers, who reviews it, how it supports a business outcome, or whether another provider already performs the same function.

Inventory the meaningful security-related spend. Include email security, endpoint protection, backups, password management, awareness training, monitoring, managed services, consulting, cyber insurance requirements, and security features bundled into larger technology contracts.

Do not cancel a safeguard only because the owner cannot explain it today. First verify what it does, whether a contract or insurance term depends on it, and what risk would be left behind. The immediate objective is to control renewal decisions, not manufacture savings.

Illustrative example: One unexplained $250 monthly service costs $3,000 per year. An unexplained charge is not automatically unnecessary. It is a decision leadership should own before the service renews itself again.

Annual spend without a clear owner, outcome, or reviewed evidence: $________

Spend to investigate before the next renewal: $________

Comparison 4: Capitalize on growth without carrying every workaround forward

Growth creates options, but it also multiplies old exceptions. A personal mailbox becomes a business dependency. Temporary administrator access never expires. One cloud folder becomes five. Devices are bought under different rules. The original provider relationship changes, but nobody rewrites the responsibility map.

Estimate the work already waiting for the business:

Multiply internal hours by a reasonable loaded hourly cost. Add outside support and any delay that prevents onboarding a customer, integrating an acquisition, passing a supplier review, changing a provider, or delegating work safely.

Illustrative example: Twenty hours of later cleanup at $175 per hour is $3,500. Forty hours of account migration, access cleanup, data movement, and employee coordination is $7,000 at the same rate. Both exclude owner time and operational disruption. Use your actual rates and expected work.

Current cleanup estimate: $________

Next growth or business event that makes the work harder: ______________________________

The goal is not to erase all technical debt. Own the debt that constrains recovery, reliable access, customer commitments, or the next stage of growth. Preserve intentional exceptions and stop accidental ones from becoming permanent architecture.

Put the four comparisons on one page

Do not add these four numbers together and call the result a guaranteed loss. They represent different kinds of exposure and may overlap. Use them to compare priorities, challenge assumptions, and decide where a clearer baseline has practical value.

The direct Cyber Hygiene Checkup is typically $950 to $1,250, depending on business size, complexity, and selected scope. Comparing that defined price with one renewal, one day of interruption, or one cleanup estimate does not prove dollar-for-dollar savings. It gives leadership a concrete way to decide whether continued uncertainty is acceptable.

Choose three actions leadership will own

Turn the worksheet into movement. Choose no more than three actions that control a meaningful unknown or prevent avoidable delay.

A useful action is specific enough to finish. “Improve security” is not an action. “Name the owner of cyber insurance answers and verify the five consequential control claims before renewal” is.

Use these decision rules:

• Control: assign an owner and a review date to every meaningful cost or assumption.
• Prevent: close the unknowns most likely to create delay during an incident, renewal, customer request, or provider change.
• Own: document who can approve access, accept risk, stop operations, and authorize follow-through.
• Capitalize: resolve the security debt that blocks safe delegation, customer trust, contract opportunities, or the next stage of growth.
• Stop: pause renewals and purchases that lack a defined business outcome until leadership can make an informed decision.

Decide whether the Cyber Hygiene Checkup is the right first move

The worksheet can expose where value may exist. The Checkup establishes the baseline behind that decision.

It is likely worth discussing when:

• The insurance application or customer questionnaire contains answers nobody fully owns.
• Security spending has accumulated without one prioritized view of the business.
• IT support is in place, but responsibilities between the owner, staff, providers, and vendors remain unclear.
• Growth has produced stale access, inconsistent devices, undocumented recovery paths, or unresolved exceptions.
• Leadership cannot identify the five security actions that deserve attention before everything else.

The Checkup is an interview-based review. It is not a penetration test, formal audit, insurance opinion, compliance certification, managed IT service, or guarantee. The standard deliverable is a category scorecard, five priorities, a 30-day, 60-day, and 90-day sequence, and a private results discussion.

If the worksheet creates a clear owner decision, act on it. If the numbers remain uncertain because the baseline is unclear, review the Cyber Hygiene Checkup and use its direct booking option before another renewal, purchase, or incident makes the decision for you.

Market context: useful, but not your forecast

Coalition's 2026 Cyber Claims Report summarizes full-year 2025 claims across more than 100,000 policyholders in several countries. It reported an average overall claim loss of $116,000, with business email compromise and funds-transfer fraud accounting for 58% of observed incidents. Those are Coalition policyholder results. They are not a prediction of what your business will lose.

Marsh's May 2025 US market update reported that average cyber rates declined during the fourth quarter of 2024 and emphasized controls, documentation, and accurate underwriting information. The practical point is not that buying a Checkup earns a discount. It is that insurance decisions are easier to own when the business can explain its current safeguards without guessing.

Verizon's 2025 small-business snapshot found that system intrusion, social engineering, and basic web application attacks accounted for 96% of breaches in its small-business dataset. Verizon defines small business there as fewer than 1,000 employees, which is broader than the typical Trawvid Sec Checkup client. Use the pattern to test whether your review covers identity, systems, people, providers, and recovery together, not to estimate a personal loss probability.