Small organizations (those with fewer than 500 employees) spend an average of $7.68 million per incident.