related to perimiter security therefore the actual cost of this for a low rise office block would be the same as for a high rise block with the same basic ground floor area. Likewise large organisations tend not to share their premises with other businessess so that again tends to reduce security costs. When you talk about "malware" then most of it these days is via the internet. The skills and equipment needed for this is not something most small to medium size businesses can easily justify as a proportion of operating costs. However the up and coming infection vector these days although still quite small are USB drives people use at work and home and for which encryption provides absolutly no protection. Likewise for "road warriors" encryption is often only of use if they turn the machine off. Many don't and either let it "sleep" or put it into heibernation which leaves the data vulnerable. For DBs of sensitive data the "old iron" mainframe and terminal model is actualy very good. Upto date would be diskless clients to local servers with no external connectivity and encryption on the wire with no USB or other ports on the diskless clients. @ Rr, "The Hartford in Conn. actually offers "data privacy coverage." The limits seem to be a bit low, and coverage details aren't all that apparent in the news release" Hmm from what you quote "expenses" may well not cover fines or other liability that might arise, so it might