Frankly, it’s costing U.S. businesses more than other nations’ enterprises worldwide, according to data collected in the 2014 Cost of Cyber Crime Study: United States from the Ponemon Institute and HP Enterprise Security. The mean cost of cyber crime for a company in the U.S. last year was $12.7 million per year; other countries’ enterprises mean costs ranged from Germany’s $8.13 million to Russia’s mere $3.33 million. The study observes a $1.1 million (or 9.3 percent) increase in cyber crime costs for the U.S. from last year’s report.

Small enterprises also have plenty to worry about. The study found that the cyber crime cost per capita in a smaller enterprise was significantly higher than in a larger organization ($1,513 vs. $517). If not resolved quickly, costs rack up as well. The average time to resolve a cyber attack was 45 days in 2014, with an average costs to participating organizations of more than $1.5 million during that period – a 33 percent increase from 2013, based on a 32-day resolution period. Malicious insider threats are even worse – taking 65 days on average to contain, the report notes.

Information theft accounts for 40 percent of all total external costs, and costs related to business disruption or lost productivity account for 38 percent of external costs (up seven percent from the report’s five-year average). Detection and recovery combined account for 49 percent of the total internal activity costs, including cash outlays and direct labor to address the breach.

However, companies deploying security intelligence systems experienced a substantially higher return on their investment (30 percent higher) than all other technology categories represented in the study. High ROI was also gleaned from extensively deployed encryption techniques and advanced perimeter controls.

If your enterprise utilizes security governance practices – investing adequate resources, appointing a high-level security leader, employing certified or expert staff – have seen cost-savings estimated at $1.7 million, on average.