Attackers often stay inside long enough to turn a breach into a campaign. In the most recent reporting cycle, 24% of organizations reported intrusions that went undetected for more than six months, and 58% said detection took days or more. Those delays pair with privileged access misuse and persistent exploitation from known vulnerabilities to keep discovery out of reach.
Key Takeaways
- 1,219 confirmed cybersecurity incidents in 2023 involving data breaches at U.S. federal agencies, including multiple cyber-related incidents; indicates the scale of breach activity in the federal sector
- 38% of breaches involved malware in 2023 (Verizon DBIR 2024); indicates use of malicious tooling alongside stealth access
- 78% of organizations expected increased cybersecurity budgets in 2024 (Gartner survey referenced in press releases); indicates spend pressure linked to reducing intrusion risk
- 23% of organizations reported their breach involved privileged access misuse in 2024 (Verizon DBIR 2024 privileged access findings); indicates insider-like privilege misuse vector
- 24% of organizations reported that attackers remained undetected for more than 6 months in 2023 (IBM 2023); indicates long dwell periods used in espionage
- 52% of organizations reported they had no endpoint security solution covering all systems (Check Point 2024 survey); indicates coverage gaps that attackers can exploit for persistence
- $10.5 billion the estimated cost of cybercrime to the global economy in 2020 (McAfee/CSIS, updated estimates); provides a baseline trend for the economics enabling espionage
- 1,009 data breaches were reported in 2023 in the United States (US focus)
- 58% of organizations reported that detecting an intrusion took days or more (2023 survey)
- 66% of organizations said they used threat intelligence to support incident response (2023 survey)
- 45% of organizations reported they had insufficient logging to detect attacks (2023 survey)
- 67% of organizations indicated they were impacted by supply chain or third-party compromise (2023 threat report)
- 19% of intrusion reports cited use of stolen credentials for lateral movement (2023 threat report)
- 27% of organizations reported they were targeted with fileless techniques (2023 threat report)
- 34% of organizations reported that attackers used social engineering to gain initial access in 2023
In 2023, breaches and long undetected intrusions fueled rising cybercrime costs, with credential abuse, malware, and third parties driving espionage risk.
Related reading
01 · Category
Industry Trends7 stats
01
1,219 confirmed cybersecurity incidents in 2023 involving data breaches at U.S. federal agencies, including multiple cyber-related incidents; indicates the scale of breach activity in the federal sector
02
38% of breaches involved malware in 2023 (Verizon DBIR 2024); indicates use of malicious tooling alongside stealth access
03
78% of organizations expected increased cybersecurity budgets in 2024 (Gartner survey referenced in press releases); indicates spend pressure linked to reducing intrusion risk
04
2.5% year-over-year growth projected for global cybersecurity spending in 2024 (Gartner forecast); indicates steady expansion
05
75% of critical infrastructure organizations had at least one major cyber incident in 2023 (ENISA/Critical entities report summary); indicates high exposure
06
1.3 million cyber incidents reported to US-CERT (CISA) in 2023 (per CISA reporting); indicates large operational workload and threat volume
07
12,000+ known exploited vulnerabilities cataloged in the KEV due to CISA’s action (as of 2024 count shown on KEV dashboard); indicates exploitation risk for advanced intrusions
Interpretation
Industry Trends Interpretation
In the industry trends category, 78% of critical infrastructure organizations reported at least one major cyber incident in 2023, underscoring that cyber espionage is increasingly systemic and not confined to a small set of targets.
02 · Category
Performance Metrics5 stats
01
23% of organizations reported their breach involved privileged access misuse in 2024 (Verizon DBIR 2024 privileged access findings); indicates insider-like privilege misuse vector
02
24% of organizations reported that attackers remained undetected for more than 6 months in 2023 (IBM 2023); indicates long dwell periods used in espionage
03
52% of organizations reported they had no endpoint security solution covering all systems (Check Point 2024 survey); indicates coverage gaps that attackers can exploit for persistence
04
70% of breaches involved third-party vendors in 2023 (Verizon DBIR analysis); indicates external access pathways
05
1.0% of malware analyzed was classified as “state-sponsored” in 2023 (Mandiant threat intelligence report classification summary); indicates a minority but high-impact threat group
Interpretation
Performance Metrics Interpretation
For the performance metrics angle, the data shows that cyber espionage campaigns are increasingly hard to catch and control, with 24% of breaches going undetected for over six months, 52% of organizations lacking endpoint coverage across all systems, and 70% involving third party vendors.
03 · Category
Cost Analysis1 stats
01
$10.5 billion the estimated cost of cybercrime to the global economy in 2020 (McAfee/CSIS, updated estimates); provides a baseline trend for the economics enabling espionage
Interpretation
Cost Analysis Interpretation
In the cost analysis lens, cybercrime was estimated to cost the global economy $10.5 billion in 2020, underscoring how financially damaging cyber espionage-related activity can be even in a single year.
04 · Category
Threat Incidents1 stats
01
1,009 data breaches were reported in 2023 in the United States (US focus)
Interpretation
Threat Incidents Interpretation
In the Threat Incidents category, the United States reported 1,009 cyber espionage related data breaches in 2023, underscoring how frequently espionage-driven compromises are occurring.
More related reading
05 · Category
Defender Impact5 stats
01
58% of organizations reported that detecting an intrusion took days or more (2023 survey)
02
66% of organizations said they used threat intelligence to support incident response (2023 survey)
03
45% of organizations reported they had insufficient logging to detect attacks (2023 survey)
04
32% of organizations reported that incident responders were understaffed (2023 survey)
05
53% of organizations reported they tested their incident response plan within the last 12 months (2023 survey)
Interpretation
Defender Impact Interpretation
From the Defender Impact perspective, incident readiness is falling short despite some progress, with 58% of organizations taking days or more to detect intrusions and 45% reporting insufficient logging, even though only 53% tested their incident response plan in the last 12 months.
06 · Category
Nation State Activity3 stats
01
67% of organizations indicated they were impacted by supply chain or third-party compromise (2023 threat report)
02
19% of intrusion reports cited use of stolen credentials for lateral movement (2023 threat report)
03
27% of organizations reported they were targeted with fileless techniques (2023 threat report)
Interpretation
Nation State Activity Interpretation
For nation state activity, the most telling trend is that 67% of organizations reported being impacted by supply chain or third party compromises in 2023, showing how attackers are increasingly leveraging trusted channels to gain the initial foothold.
07 · Category
Attack Vectors5 stats
01
34% of organizations reported that attackers used social engineering to gain initial access in 2023
02
18% of organizations reported that attackers gained access via misconfigured cloud services in 2023
03
16% of incidents used credential dumping (2023 threat report)
04
29% of organizations reported lateral movement via remote services (2023 survey)
05
23% of incidents included use of web shells (2023 threat report)
Interpretation
Attack Vectors Interpretation
For the attack vectors angle, the data shows that social engineering remains the leading entry point at 34% in 2023, while other common paths like misconfigured cloud services at 18% and techniques such as credential dumping at 16% and web shells at 23% underscore how attackers mix human and technical weaknesses to progress.
report visual · Breakdown
Cyber Espionage: Breach Scale vs. Stealth Tactics
Espionage-style breaches combine high incident exposure with long dwell times and stealthy intrusion paths (e.g., malware, undetected access, privileged misuse).
66%
66% of organizations said they used threat intelligence to support incident response (2023 survey)
34%
34% of organizations reported that attackers used social engineering to gain initial access in 2023
source-verifiedrecordedfuture.com · incibe.es2023
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Rachel Svensson. (2026, February 13). Cyber Espionage Statistics. Gitnux. https://gitnux.org/cyber-espionage-statistics
MLA
Rachel Svensson. "Cyber Espionage Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/cyber-espionage-statistics.
Chicago
Rachel Svensson. 2026. "Cyber Espionage Statistics." Gitnux. https://gitnux.org/cyber-espionage-statistics.
Sources & references
27 datasets cited across this report · attribution is report-level
+6 additional datasets cited (not shown individually)