Lost Laptops: More Expensive than you Think

New research quantifies the primary factors driving the cost of a lost or stolen laptop. Learn from Intel IT’s best practices.

Portable computing has opened up the world, allowing executives and managers access to enterprise data without having to be on company premises. From a business perspective, this translates directly into stronger sales capabilities, better customer service, and a more productive workforce.

However, mobility has a downside: Lost or stolen laptops. The experience of losing a laptop can range from being a merely unpleasant inconvenience to precipitating a public relations disaster following the loss of intellectual property or customer data.

Loss Ledger

To better understand the range of potential outcomes, the Ponemon Institute compiled data on 138 instances of laptop loss or theft within a 12-month period by the employees, temporary employees, and subcontractors of a representative sample of U.S. businesses.

The researchers developed a cost accounting framework including seven distinct components:

1. Laptop replacement cost: The obvious cost of a lost laptop is the need to get a new one, including any necessary software licenses and other overhead.
2. Detection and escalation cost: The person whose laptop disappeared will probably spend at least a few hours—and in some cases, a few days—reporting the loss and requisitioning a new machine.
3. Lost productivity cost: Without a laptop computer available, an employee will have to recreate lost files and otherwise get back up to speed, which may take hours or even a day or two.
4. Forensics and investigation cost: A security expert, billing from around USD 50 to USD 160 per hour, typically spends a day reviewing backup files, e-mail trails, and other clues to the potential damage to the firm.
5. Data breach cost: Here’s where a lost laptop gets really expensive. According to Ponemon, it costs about USD 200 to remedy the loss of a single customer record. With the average laptop containing about 200 customer records, the average data breach cost is USD 40,000 per laptop. In the worst case surveyed, about 6,200 records were lost, resulting in data breach costs of almost USD 1 million. While most people don’t carry a large volume of customer data on their laptops, it doesn’t take a huge number of missing records to turn a laptop loss into an expensive fiasco.
6. Intellectual property loss: Particularly for firms in technology, healthcare, and communications businesses, the potential damage from IP theft is almost incalculable. Or, if you insist on putting a number to it, judging from actual incidents, stolen IP can cost a firm up to USD 250 million. Again, while most people don’t carry around the blueprints to new circuit designs on their laptops, if and when it does happen it’s potentially a market-moving event.
7. Other legal or regulatory costs: Legal counsel is expensive, especially in cases of data breach or intellectual property theft.

Bottom Line: The Cost of ‘Lost’

Summing up these cost drivers, Ponemon estimated the average cost of a lost laptop to be a whopping USD 49,246.

The bulk of that figure represents the allocated costs of a potential data breach or intellectual property loss—80 percent and 12 percent, respectively.

But even in the majority of cases where it can be established that no sensitive information went missing, a lost laptop can cost well over double the average replacement value of USD 1,582 for the hardware itself.

By understanding these cost components, IT departments and risk managers can build a better business case for implementing stronger security policies supported by encryption and advanced laptop technology, in terms that the business decision-makers can understand.

How We Protect Mobile Data at Intel

As part of our overall enterprise security strategy, Intel IT has developed a plan to help ensure a smooth, secure, and cost-effective implementation of notebook encryption.

Intel IT recognizes that securing employee notebooks requires more than data encryption. It also requires effective client management to maintain security-hardened configurations.

To help us manage employee notebooks (and desktops) more effectively and at a significantly lower cost, Intel IT is currently in the middle of a multiyear process that will upgrade our client systems and support infrastructure to take advantage of Intel® vPro™ technology.

Client systems that support Intel vPro technology include built-in hardware-based capabilities that help to improve security, maintenance, and asset tracking.

These PCs can be accessed over wired and wireless networks by authorized management applications and support staff, even when the system is off, the OS is unresponsive, software agents are disabled, or the hard drive has failed.ⁱ

Read the details in the white paper, “Strengthening Enterprise Security through Notebook Encryption.”

Download now

i Intel® Active Management Technology (Intel® AMT) requires the computer system to have an Intel® AMT-enabled chipset, network hardware and software, as well as connection with a power source and a corporate network connection. Setup requires configuration by the purchaser and may require scripting with the management console or further integration into existing security frameworks to enable certain functionality. It may also require modifications of implementation of new business processes. With regard to notebooks, Intel AMT may not be available or certain capabilities may be limited over a host OS-based VPN or when connecting wirelessly, on battery power, sleeping, hibernating or powered off. For more information, see http://www.intel.com/technology/platform-technology/intel-amt/.

ii Intel® Anti-Theft Technology (Intel® AT). No computer system can provide absolute security under all conditions. Intel® Anti-Theft technology (Intel® AT) requires the computer system to have an Intel AT-enabled chipset, BIOS, firmware release, software, and an Intel AT-capable Service Provider/ISV application and service subscription. The detection (triggers), response (actions), and recovery mechanisms only work after the Intel AT functionality has been activated and configured. Certain functionality may not be offered by some ISVs or service providers and may not be available in all countries. Intel assumes no liability for lost or stolen data and/or systems or any other damages resulting thereof.