A Cyberattack Could Cost More Than Your Entire IT Budget. Is Your Firewall Worth the Investment?

For most small and medium businesses, yes, though the case rests less on headline breach figures than on downtime, recovery and regulatory costs. IBM's 2025 Cost of a Data Breach Report put the global average breach at US$4.44 million, and its 2026 report, as covered in the regional press, put the ASEAN average at US$4.12 million. Those studies lean towards larger organisations, so treat them as a ceiling rather than a forecast. More useful for an SME is Sophos's survey of ransomware victims, which found mean recovery costs of US$1.53 million in 2025, excluding any ransom. Against that, a Fortinet FortiGate 50G with five years of Unified Threat Protection costs S$3,798 at SourceIT, about S$760 a year (listed 30 Oct 2026). A firewall does not remove the risk, but it removes many of the cheapest ways in.

What does a cyberattack actually cost?

Survey samples differ; the Singapore-only Sophos figure comes from a small sample. Use these as orders of magnitude.

Where does the money go?

• Downtime. Staff who cannot work, orders that cannot be taken and projects that slip. For many SMEs this is the largest cost, and it is rarely counted.
• Recovery. Forensics, rebuilding systems, restoring data and overtime for whoever does it.
• Customers. Notification, goodwill and contracts lost when clients ask why their data was exposed.
• Regulators. The PDPC fined Ezynetic S$17,500 in 2025 after a ransomware attack exposed 190,589 people's data; fines for other recent cases range from S$17,500 to S$58,000. The fine is often the smallest part.
• Insurance and future costs. Higher premiums, new controls demanded by insurers or customers, and management time.

CrowdStrike's 2025 survey of small businesses found three-quarters of micro-business leaders believed a cyberattack would likely or definitely put them out of business.

What does a FortiGate cost per year?

SourceIT prices listed 30 Oct 2026, hardware plus Unified Threat Protection. Add installation, and endpoint protection, backup and MFA for a complete baseline.

A firewall is cheaper per month than most office coffee budgets. A week of downtime is not.

Is a firewall worth it on its own?

It is worth it as part of a baseline, not as the whole answer. The firewall closes common entry routes: exploits against exposed services, malicious websites and downloads, and devices calling home to attackers. Other routes need other controls: endpoint detection for what users run, MFA for stolen passwords, and isolated backups so that a successful attack is recoverable rather than fatal. CSA's Cyber Essentials standard sets out that baseline, and CSA estimated in 2024 that implementing Cyber Essentials hygiene for an organisation with fewer than 20 endpoints costs about S$1,800 to S$4,500 after funding.

Can grants offset the cost?

• CSA's CISO-as-a-Service offers eligible SMEs up to 70% co-funding for a consultant-led health check and plan.
• Pre-approved cybersecurity solutions under the Productivity Solutions Grant may be funded at up to 50% of eligible costs, up to S$30,000, according to Enterprise Singapore. Check whether the package you want is pre-approved before committing.

How to build the business case

1. Estimate one day of downtime: revenue lost plus staff cost.
2. Multiply by a realistic outage of five to ten working days.
3. Add recovery, notification and legal costs.
4. Compare with the five-year cost of a firewall, endpoint protection, MFA and backup.
5. Present it as insurance with a known premium.

For the economics on the attacker's side, read AI Is Making Cybercrime Cheaper, and for a stolen-device scenario, One Stolen Laptop. How Much Could It Really Cost Your Business?

Buying in Singapore

SourceIT supplies the FortiGate 30G, 50G, 70G and 90G with 1-, 3- and 5-year UTP and local warranty, plus Microsoft Defender for Endpoint and Synology backup systems. Prices listed 30 Oct 2026. Browse the FortiGate firewall collection. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page. Government buyers can purchase through GeBIZ.

Frequently asked questions

How much does a data breach cost in Singapore? IBM does not publish a Singapore-only figure. Its 2026 report, as reported regionally, put the ASEAN average at US$4.12 million, mostly from larger organisations.

How much does ransomware recovery cost? Sophos's survey found a mean recovery cost of US$1.53 million in 2025 and US$1.7 million in 2026, excluding ransom payments.

What is the maximum PDPA fine? Up to 10% of annual Singapore turnover for organisations with turnover above S$10 million, or S$1 million, whichever is higher.

How much does a FortiGate cost per year? At SourceIT on 30 Oct 2026, a FortiGate 50G with 5-year UTP is S$3,798, about S$760 a year.

Are there grants for SME cybersecurity in Singapore? CSA's CISO-as-a-Service offers up to 70% co-funding for eligible SMEs, and pre-approved cybersecurity solutions may qualify for the Productivity Solutions Grant.