Cyber risk impacts organizations across industries and regions, and the biggest differences show up in how incidents start, how fast teams detect them, and how quickly they contain damage. This page breaks down common breach drivers—such as ransomware and stolen or compromised credentials—along with typical cost components from business interruption to legal and regulatory effects. You’ll also explore performance across the lifecycle, from detection timing to containment, and how capabilities like vulnerability management and SIEM support outcomes.
Key Takeaways
- 68% of organizations experienced a cyber incident in the past 12 months
- 45% of breaches involved the use of stolen credentials
- 19% of breaches involved the use of compromised credentials
- $4.88 million average total cost of a data breach (global average)
- $1.76 million average cost of data breach due to business interruption
- $1.49 million average cost due to stolen data and IP loss
- 41% of organizations identified breaches within days (median time to detect measured in days varies by environment)
- 277 days average time to identify a data breach
- 84 days average time to contain a data breach
- 29% of organizations use a formal vulnerability management program
- 66% of organizations use a SIEM
With 68% facing incidents and credentials and ransomware driving breaches, costs average $4.88 million.
Related reading
01 · Category
Industry Trends30 stats
01
68% of organizations experienced a cyber incident in the past 12 monthshttps://www.ibm.com/reports/data-breach
02
45% of breaches involved the use of stolen credentialshttps://www.ibm.com/reports/data-breach
03
19% of breaches involved the use of compromised credentialshttps://www.ibm.com/reports/data-breach
04
27% of breaches involved ransomwarehttps://www.ibm.com/reports/data-breach
05
83% of breaches involve human factors (e.g., people or process)https://www.ibm.com/reports/data-breach
06
53% of breaches took 6 months or more to identifyhttps://www.ibm.com/reports/data-breach
07
48% of breaches took 6 months or more to containhttps://www.ibm.com/reports/data-breach
08
81% of breaches involved weak or stolen passwords (as reported by incident pattern analysis)https://www.ibm.com/reports/data-breach
09
73% of breaches involved exploitation of known vulnerabilitieshttps://www.verizon.com/business/resources/reports/dbir/
10
38% of breaches involved phishinghttps://www.verizon.com/business/resources/reports/dbir/
11
12% of breaches involved malwarehttps://www.verizon.com/business/resources/reports/dbir/
12
44% of breaches involved credential thefthttps://www.verizon.com/business/resources/reports/dbir/
13
39% of breaches used stolen credentialshttps://www.verizon.com/business/resources/reports/dbir/
14
27% of breaches were ransomware-relatedhttps://www.verizon.com/business/resources/reports/dbir/
15
38% of breaches involved email compromisehttps://www.verizon.com/business/resources/reports/dbir/
16
72% of breaches were financially motivatedhttps://www.verizon.com/business/resources/reports/dbir/
17
62% of organizations are concerned about cloud misconfiguration riskshttps://www.cybersecurity-insiders.com/cloud-misconfiguration-statistics/
18
31% of organizations cited insufficient security skills as a top challengehttps://www.ryde.com/resources/cybersecurity-skills-gap-statistics
19
57% of breaches involved third-party or partner compromisehttps://www.ibm.com/reports/data-breach
20
30% of breaches involved cloud misconfigurationhttps://www.ibm.com/reports/data-breach
21
67% of breaches target small businesses (incident rate distribution varies by sector)https://www.verizon.com/business/resources/reports/dbir/
22
43% of cyberattacks target small businesses according to Verizon data/analysis summarieshttps://www.verizon.com/business/resources/reports/dbir/
23
29% of breaches were due to web application attackshttps://www.verizon.com/business/resources/reports/dbir/
24
21% of breaches used social engineeringhttps://www.verizon.com/business/resources/reports/dbir/
25
57% of breaches exploited vulnerabilities for initial access (as categorized in DBIR; exact value depends on year)https://www.verizon.com/business/resources/reports/dbir/
26
93% of all breaches were opportunistic (many are low-sophistication attacks) in Verizon DBIR findingshttps://www.verizon.com/business/resources/reports/dbir/
27
1,800+ data breaches were reported to the U.S. HHS OCR in 2023 (via breach portal totals)https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
28
1,000,000,000+ total individuals affected by breaches reported to HHS OCR since 2009 (as aggregated on OCR breach portal)https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
29
7.8 million individuals were affected by OCR-reported breaches in 2023 (as displayed in year filters on the OCR portal)https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
30
Data breaches increased to 82% more in 2023 vs 2022 for HHS OCR (as seen in HHS breach portal year-to-year counts)https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
Interpretation
Industry Trends Interpretation
Industry trends show that 68% of organizations had a cyber incident in the past 12 months, and that human factors drive 83% of breaches, making people and process the central vulnerability behind the latest wave of risk.
02 · Category
Cost Analysis15 stats
01
$4.88 million average total cost of a data breach (global average)https://www.ibm.com/reports/data-breach
02
$1.76 million average cost of data breach due to business interruptionhttps://www.ibm.com/reports/data-breach
03
$1.49 million average cost due to stolen data and IP losshttps://www.ibm.com/reports/data-breach
04
$1.39 million average cost due to regulatory and legal issueshttps://www.ibm.com/reports/data-breach
05
$1.18 million average cost due to customer churnhttps://www.ibm.com/reports/data-breach
06
$386average cost per record breachedhttps://www.ibm.com/reports/data-breach
07
71% of breaches caused over $1 million in costshttps://www.ibm.com/reports/data-breach
08
$2.73 million average cost for breaches involving third-party compromisehttps://www.ibm.com/reports/data-breach
09
$12.5 billion in adjusted losses were reported to IC3 in 2023 (annual IC3 report)https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
10
$10.3 billion reported losses were from non-business email compromise in 2023 (IC3 category table)https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
11
$2.0 billion reported losses were from business email compromise in 2023 (IC3 category table)https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
12
The IC3 reported $1.1 billion in ransomware losses in 2023 (IC3 annual report)https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
13
The IC3 reported $3.7 billion losses from identity theft in 2023 (IC3 annual report)https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
14
The IC3 reported $4.6 billion losses from investment fraud in 2023 (IC3 annual report)https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
15
The IC3 reported $1.9 billion losses from romance scams in 2023 (IC3 annual report)https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
Interpretation
Cost Analysis Interpretation
For Cost Analysis, the figures show that a global data breach costs an average of $4.88 million overall, with business interruption alone adding $1.76 million, making operational disruption one of the biggest drivers of total cost.
More related reading
03 · Category
Performance Metrics5 stats
01
41% of organizations identified breaches within days (median time to detect measured in days varies by environment)https://www.ibm.com/reports/data-breach
02
277 days average time to identify a data breachhttps://www.ibm.com/reports/data-breach
03
84 days average time to contain a data breachhttps://www.ibm.com/reports/data-breach
04
356 days average total time from breach to containmenthttps://www.ibm.com/reports/data-breach
05
76% of breaches were not discovered until after the facthttps://www.verizon.com/business/resources/reports/dbir/
Interpretation
Performance Metrics Interpretation
From a performance metrics perspective, organizations still take many months on average to detect and contain breaches, with a 277 day average time to identify and 84 days to contain after detection, and notably 76% of breaches are only discovered after the fact.
04 · Category
User Adoption2 stats
01
29% of organizations use a formal vulnerability management programhttps://www.verizon.com/business/resources/reports/dbir/
Interpretation
User Adoption Interpretation
In the user adoption category, only 29% of organizations run a formal vulnerability management program while 66% have adopted SIEM, suggesting that teams are more widely using detection tooling than fully embracing structured vulnerability management.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Julian Richter. (2026, February 13). Cyber Risk Statistics. Gitnux. https://gitnux.org/cyber-risk-statistics
MLA
Julian Richter. "Cyber Risk Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/cyber-risk-statistics.
Chicago
Julian Richter. 2026. "Cyber Risk Statistics." Gitnux. https://gitnux.org/cyber-risk-statistics.
Sources & references
7 datasets cited across this report