An hour of unplanned downtime now costs a typical UK SME somewhere in the low thousands of pounds, and mid-size to large enterprises considerably more, with a 2024 industry survey putting the average above $300,000 per hour once lost productivity, lost sales and recovery labour are added together. The uncomfortable part is that cyber attacks account for a little over half of it. The rest comes from power cuts, failed hardware, broken internet connections, supplier outages and ordinary human error. Preparing for downtime, then, is less about buying one more security tool and more about knowing which systems your business genuinely cannot run without, and how quickly you could get them back.
Why the numbers keep climbing
Businesses are not suffering more hours of downtime than they used to. They are suffering more expensive hours. Beaming’s research put the annual bill for UK businesses at around £3.7 billion, roughly five times the 2018 figure, and that rise happened while total downtime hours fell.
The reason is dependency. Ten years ago a network problem meant people worked offline for a morning. Now it means no phones, no card payments, no CRM, no file access, no email and no ability to invoice. Splunk and Oxford Economics estimated that downtime costs the world’s 2,000 largest companies around $400 billion a year, equivalent to about 9% of profits.
Any figure quoted per hour is an average across wildly different businesses, so treat published benchmarks as a prompt rather than a prediction. A manufacturer with a stopped line and a professional services firm with idle staff lose money at very different rates.
The causes that get overlooked
Ransomware dominates board-level conversations because it is dramatic and because it makes the news. In practice, the incidents that take businesses offline are often far more mundane, and the same recovery plan covers most of them.
-
Power interruption. A brief dip is enough to bring down unprotected servers, network switches and door access systems, and equipment sometimes does not come back cleanly. Businesses with on-site data centre infrastructure often rely on standby generator and UPS solutions for data centres to maintain continuity when mains supply fails.
-
Hardware failure. Ageing kit that has been kept in service one budget cycle too long is a common single point of failure, particularly firewalls, switches and NAS devices.
-
Connectivity loss. Roadworks and damaged cabling still take out single-line premises, and lead times for repair can run into days.
-
Supplier and platform outages. When Microsoft 365, a payments provider or a hosted line-of-business application goes down, you are waiting on someone else’s engineers.
-
Human error and bad changes. A misconfigured update or an accidental deletion causes a significant share of infrastructure-related outages. The CrowdStrike incident in July 2024 grounded flights and stopped hospital systems worldwide, and it was not an attack.
Work out what an hour actually costs you
Before spending anything on resilience, put a number on the problem. A rough calculation is enough to change how a leadership team thinks about it: take your annual revenue, divide by your actual trading hours, then add the cost of paying staff who cannot work, plus the overtime and supplier fees you would incur catching up afterwards.
Then ask a harder question for each critical system: how long could we be without this before the damage becomes serious, and how much data could we afford to lose? Those two answers are your recovery time and recovery point objectives, and they are what any sensible business continuity plan is built around. Most organisations discover their tolerance is much shorter than their current setup can deliver.
Practical steps that reduce disruption
Resilience tends to come from several unglamorous measures rather than one purchase. The following are the ones that repeatedly prove their worth when something goes wrong.
Test restores, not just backups
Backups that have never been restored are an assumption, not a safeguard. Keep multiple copies, at least one off-site and one that cannot be altered or deleted from your main network, and schedule a real restore test at least quarterly. Time it, because the restore duration is your actual recovery time.
Remove the obvious single points of failure
A second internet connection on a different carrier, ideally with automatic 4G or 5G failover, is inexpensive relative to a day of lost trading. Uninterruptible power supplies on core network equipment buy you a clean shutdown. Spare configurations for firewalls and switches turn a multi-day replacement into an afternoon.
Write the plan down, on paper
An incident plan stored only in the system that has just failed is no use. Keep an offline copy listing who decides what, which suppliers to call, account and contract references, and how staff will communicate if email and internal chat are unavailable. Nominate a deputy for every named role, because outages rarely respect annual leave.
Read your suppliers’ small print
Check what your cloud and connectivity contracts actually commit to. Uptime percentages, response times and the difference between a support ticket and a genuine escalation path matter more than headline availability claims, and service credits almost never reflect what an outage costs you.
Rehearse, then adjust
Run a short tabletop exercise once or twice a year. Pick a plausible scenario, such as the office losing power on a Monday morning or a key SaaS platform being unreachable for six hours, and talk through it with the people who would have to respond. Gaps surface quickly and cheaply.
Recovery is where most plans fall over
Detection and containment get the attention, but the expensive part is the tail. Reporting suggests the large majority of UK businesses need more than 24 hours to recover fully from a significant incident, and that period is when customers notice, orders slip and staff time disappears into manual workarounds.
That is also where preparation pays back most visibly. Knowing which ten processes must keep running, having a documented manual fallback for each, and having practised the switch is what separates a contained inconvenience from a week of disruption.
If your business operates in a regulated sector, or handles personal data at scale, it is worth taking specific advice on your reporting duties and insurance position rather than relying on general guidance. The technical preparation and the compliance obligations overlap, but they are not the same thing.