The real cost of a workplace security incident in Arizona

Most owners we talk to in the East Valley and Phoenix metro have never sat down and added up what a single security incident would actually cost them. They have a number in their head — usually the deductible on their commercial policy, sometimes a vague figure they remember from a chamber-of-commerce talk — and that's it. The real number is almost always larger, and it almost always lives in places you can't see on a P&L: legal hours, employee turnover, premium hikes at renewal, and customer churn that takes ninety days to show up in the books.

This post is the version we wish every Arizona business owner read before they decided whether to fund a security program. It uses real numbers from the Department of Justice, Bureau of Justice Statistics, FBI Uniform Crime Reporting, IBM's 2024 Cost of a Data Breach study, the ACFE's 2024 Report to the Nations, Hiscox's embezzlement work, the National Retail Federation, and Phoenix Police Department open data. Where 2026 figures aren't yet published, we say so.

The headline: a single material security incident at an Arizona small or mid-size business — commercial burglary, an employee-theft scheme, a workplace-violence event, or a premises-liability claim — typically lands somewhere between $25,000 and $250,000 all-in, and a meaningful share of those incidents go materially higher once litigation, insurance, and reputational losses are tallied. Below is how that number is built, where Arizona-specific factors push it up, and how operators we work with reduce their actual exposure.

The five buckets of cost most owners miss

When a real incident happens, the cost shows up in five places, not one. Direct loss is just the first.

• Direct loss. Stolen cash, stolen inventory, damaged property, ransom or extortion paid, fraud written off.
• Operational downtime. Hours or days the business cannot operate normally — police on site, evidence collection, locksmith, IT rebuild, employees who go home, customers who reschedule.
• Insurance and risk-pricing impact. Deductibles paid, premium increases at renewal, sometimes non-renewal of a policy entirely. Carriers price the next 36 months off the most recent claim.
• Legal and regulatory exposure. Notice obligations, defense costs, settlement or judgment, OSHA exposure if it's a workplace-violence event, state AG involvement if customer data is implicated.
• People and reputation. Employee turnover after a frightening event, customers who quietly stop coming back, the senior-leadership hours pulled out of revenue work to manage the fallout.

Treat any single-line cost estimate skeptically. The five buckets compound in ways most owners don't model until after the fact.

Direct loss: what the FBI and Phoenix PD data show

Start with the most visible bucket. The FBI's Crime Data Explorer and Phoenix Police Department open data give us decent visibility into what a single property-crime event actually costs an Arizona business in 2024–2025.

Phoenix PD reported roughly 892 commercial burglaries in 2024, a 14.3% decline from the prior year, and 167 commercial robberies, down 8.7%. Those declines are real, but the per-incident loss has not declined the same way. FBI UCR's last published average dollar value for property stolen per reported robbery was $1,373 nationally, with banks at $3,483. Commercial-burglary loss tends to run higher than robbery on a per-event basis once stolen inventory, broken doors, broken glass, broken cameras, and the cost of an emergency locksmith are added. A single commercial burglary at a mid-size East Valley business in our experience runs $4,000 to $25,000 in direct loss before any operational downtime is counted.

Robbery and burglary are still the events most owners picture when they hear "security incident." They shouldn't be. The data says insider events and liability events cost more, and they happen more often than most operators believe.

Insider loss: embezzlement and occupational fraud

This is the bucket Arizona owners underestimate the most. The ACFE 2024 Report to the Nations, which examined 1,921 real occupational-fraud cases across 138 countries, found that organizations with fewer than 100 employees suffered a median loss of $141,000 per occupational-fraud case — the second-largest median loss across all organization sizes. Hiscox's earlier embezzlement work put the average single-scheme loss closer to $357,650, with small and mid-size businesses representing roughly 68% of cases.

The ACFE data also shows the median fraud lasts twelve months before detection. The Hiscox work found 70% of embezzlement schemes ran more than a year, and 85% were perpetrated by someone at the manager level or above. Translation: when insider theft happens, it has usually been happening for a long time, the perpetrator is usually trusted, and the dollar figure is usually six figures by the time anyone notices.

Corruption schemes — kickbacks, vendor steering, billing fraud — were the most common scheme type at small organizations, occurring in 44% of cases. Most owners we talk to have never run a vendor-master review or a duplicate-vendor check. Most should.

Workplace violence: the BLS numbers nobody wants to read

The Bureau of Labor Statistics tracks workplace violence as a category of occupational injury and fatality. The most recent published BLS data shows 470 workplace homicides in 2024, with shootings accounting for roughly 80.6% (379 of 470). On the nonfatal side, more than 57,000 cases of workplace violence required days away from work, restriction, or transfer over the most recent two-year reporting window. Women accounted for 72.5% of those nonfatal cases.

The National Safety Council estimates that work-related deaths and injuries cost the U.S. economy roughly $1.3 trillion in 2023, with an average of approximately $40,000 per disabling workplace-injury incident. That's the average — the floor for an event that involves violence, weapons, or principal-on-employee assault is materially higher once OSHA reporting, defense costs, workers' compensation impacts, and turnover are added.

For Arizona businesses, the operational reality is straightforward: an active-aggressor or weapons event at a small or mid-size workplace effectively shuts the business down for days, generates police-evidence cycles that lock up parts of the facility, and produces an employee-retention problem you'll be managing for the next two quarters. Most owners we work with have never run a tabletop exercise on a workplace-violence scenario. Most should — it's the cheapest preparation dollar in the entire program. Our risk consulting service includes scenario tabletops as a default deliverable.

Liability exposure: when an incident becomes a lawsuit

The fastest way for a $25,000 incident to become a $250,000 incident is litigation. Arizona's premises-liability statute gives a plaintiff two years from the date of injury to file a lawsuit, and Arizona courts will impose a duty on a business to take reasonable steps to protect invitees from foreseeable harm. "Foreseeable" is the operative word, and it is interpreted broadly. Prior incidents on or near the property, prior calls for service, the surrounding crime profile, and industry-standard practices all factor in.

Negligent-security verdicts and settlements are not small. National plaintiff-side data shows hotel-assault cases averaging more than $1 million in resolution, single nightclub-shooting settlements running into the low seven and even eight figures, and inadequate-lighting and inadequate-locks cases routinely producing six-figure resolutions even where the underlying event was less severe. The mechanism is consistent: when a plaintiff can show the business knew or should have known about a foreseeable risk and failed to take reasonable steps, the case settles or it tries, and either path is expensive.

Cyber and data-incident liability is its own category. IBM's 2024 Cost of a Data Breach Report put the global average at $4.88 million per breach — a 10% jump year over year and the largest annual increase since the pandemic. For small and mid-size enterprises specifically, the report cited an average of $4.5 million. Most Arizona small businesses don't carry enough cyber liability coverage to absorb that, and most don't realize their commercial general-liability policy explicitly excludes most data-incident exposure.

The insurance impact

Even when insurance pays, it costs. A material claim on a commercial property, general-liability, or workers' compensation policy typically produces a 15–40% premium increase at the next renewal, and in tougher placement years it can produce a non-renewal letter that forces the business into the surplus-lines market at significantly higher rates. An owner we worked with last year saw their commercial GL premium rise 31% after a single after-hours burglary that involved roughly $6,800 of direct loss. The premium impact dwarfed the loss.

Why the Arizona-specific numbers are different

National data is directionally useful but it underprices a few Arizona realities.

First, our operating environment is hard on people and equipment. Cameras, locks, and access-control hardware degrade faster in 110°+ heat than in temperate markets. Battery-backup systems fail earlier. Door seals warp. Owners who installed their security stack five years ago and haven't refreshed it are running on equipment that no longer performs to the spec they bought.

Second, Arizona's licensing framework — administered by the Arizona Department of Public Safety — distinguishes credible operators from low-cost vendors who rely on undertrained 1099 contractors. A liability case turns on whether the business hired a properly licensed firm with documented training, supervision, and insurance. We've written about how to verify AZ DPS licensing in detail; most owners assume their vendor is properly licensed and have never actually pulled the agency record to confirm.

Third, Phoenix metro's growth profile creates a foreseeability problem. Many commercial corridors that were quiet five years ago now sit on busier crime maps, and the legal duty of care has shifted with them. A property's risk profile does not stay static — and a defense based on "we never had an incident before" is a defense that loses.

Where security spending actually saves money

Owners ask us to defend the spend on a security program. The honest answer is that most programs we recommend pay for themselves on the insurance line alone within 12–24 months, before any incident is ever prevented. A documented program — written policies, trained personnel, verifiable supervision, working surveillance with retention, formalized access control — moves a business from "uncontrolled" to "controlled" in the underwriter's eyes, and the renewal pricing follows.

Beyond the insurance math, the loss-prevention math is straightforward. The ACFE's 2024 work showed that organizations with active fraud-detection controls in place caught fraud earlier and lost roughly half as much as those without. NRF's loss-prevention research has shown similar effects on retail shrink: stores with consistent presence, working camera coverage, and trained associates lose materially less inventory than stores without.

The unfortunate truth is that the businesses that need a security program the most are usually the ones that decide they can't afford one. The math, when it's actually run, almost always says the opposite.

What this means for you

If you operate a small or mid-size business in Arizona, three things are true at the same time. The first is that the per-incident cost of a real security event is materially higher than most owners assume — typically $25,000 to $250,000 once direct loss, downtime, insurance impact, and liability exposure are added together. The second is that the events most likely to land at the top of that range are not the burglary you're picturing — they're insider fraud, workplace-violence events, and premises-liability cases that the business didn't see coming. The third is that the controls that prevent or contain these events are not exotic. Documented policies, trained and properly licensed personnel, working camera coverage, vendor-master discipline, basic access control, and a tabletop exercise on the two scenarios you'd hate to handle live — that's most of the program for most operators.

If you've never had an outside party stress-test what you're running, that's the place to start. A 30-minute conversation with someone who runs the work for a living will tell you more about your actual exposure than another quarter of guessing.

Talk to STRAPT

STRAPT is a veteran-led security and risk consulting firm based in Phoenix. We run executive protection, residential and estate security, event security, armed and unarmed guard work, and risk consulting across the Valley and the rest of Arizona. We bias toward smaller, better-trained programs that actually fit the risk profile in front of us — and we say so when a prospect doesn't actually need us.

If you'd like a confidential read on what your specific exposure looks like and what a right-sized program would cost, the assessment is free. Request a conversation, or browse our resources for owner-level material on specific topics.