The Preparedness Gap: Only 34% of Small Businesses Have a Written Incident Response Plan

Most small business owners think they''re covered. They''re not — and the gap between feeling prepared and actually being prepared is where breaches turn into business-ending events.

According to 2025 research from Guardz, only 34% of small and mid-sized businesses have a formal, written incident response plan. That means roughly two out of every three SMBs would be improvising — in real time, under pressure, with money and reputation on the line — the moment something goes wrong.

Why this isn''t a knowledge problem

It would be easy to assume the other 66% simply don''t know incident response plans matter. They do. Nearly every small business owner has heard the warnings about ransomware, phishing, and data breaches. The gap isn''t awareness — it''s bandwidth.

Roughly 47% of businesses with fewer than 50 employees allocate zero dedicated cybersecurity budget, and the same size businesses often have nobody whose job is specifically to own security or compliance. In practice, that means the owner, the office manager, or whoever''s most comfortable with computers is quietly acting as the IT department, the compliance officer, and the incident response lead — unpaid, untrained for it, and stretched thin running the actual business at the same time.

Writing a formal incident response plan takes real, uninterrupted time: identifying critical assets, defining who does what during an incident, setting up communication protocols, and documenting recovery procedures. For a business owner already wearing five hats, that''s a task that''s easy to know matters and still never get to.

Why the cost of skipping it is so lopsided

The math here isn''t close. IBM''s data shows that a tested incident response plan reduces the average cost of a breach by roughly $232,000. Meanwhile, basic prevention — including a real IR plan — typically costs a small business somewhere between $5,000 and $15,000 a year. Recovering from an actual incident without a plan in place commonly runs into six figures once you account for downtime, data recovery, and reputational damage.

That''s a 15-40x difference between the cost of being ready and the cost of not being ready. And for a meaningful share of small businesses, that number isn''t abstract — a large share of small business owners say a breach in the range of $100,000 or less could put them out of business entirely.

Yet the gap persists, for the same reason most SMB compliance gaps persist: it''s not that owners don''t understand the risk. It''s that fixing it has historically required either hiring a security person they can''t afford, or hiring a consultant for a project that takes weeks and costs thousands of dollars up front — before the business has any confidence the plan will actually hold up when tested.

This is exactly the wedge Scarlet Risk was built to close

Scarlet Risk exists because the traditional path to a real incident response plan — a consultant engagement, a multi-week timeline, a five-figure invoice — was never actually built for a business with 10, 30, or 80 employees. It was built for enterprises with dedicated security teams and budgets to match.

Scarlet Intelligence, the AI engine behind Scarlet Risk, generates a custom incident response playbook built specifically around your company''s size, industry, and applicable frameworks — not a generic template pulled from a binder. It''s part of what Scarlet Comply, one of the three intelligence suites inside the platform, does continuously: turning the parts of compliance that used to require a consultant into something a business owner can generate and understand themselves, in minutes rather than weeks.

This is precisely the gap the Scarlet Go tier, starting at $25/month, was built to close. No enterprise deployment. No consultant retainer. No six-figure breach recovery bill waiting on the other side of "we''ll get to it eventually." Just a real, usable incident response plan, built for your actual business, in the time it takes to answer a handful of questions.

Bottom line

The preparedness gap is real, and it''s costing small businesses far more than it should. Closing it doesn''t have to mean a six-figure enterprise tool or a consultant invoice — it means finally having a plan that fits the business you actually run.