With the average cost of a data breach in 2023 hitting $4.45 million and the median time to contain stretching to 203 days, this post breaks down the key cybersecurity breach statistics that explain where the damage comes from and what organizations can do to reduce it.
Key Takeaways
- 35% of organizations reported a breach in the last 12 months
- 10.3 million records were exposed in data breaches across the globe in 2023
- 24% of organizations experienced 6–10 breaches in the last 12 months
- $4.45 million average cost of a data breach in 2023
- $150 average cost per record exposed globally
- 11.0% year-over-year increase in average total cost of a data breach
- 1.0x reduction in time-to-identify and contain for organizations with mature security governance (reported as relative difference)
- 277 days average time to identify and contain a breach in 2023
- 74 days median time to identify a breach
- 71% of organizations use multifactor authentication
- 54% of organizations use security automation/orchestration to respond to incidents
- 57% of organizations have a formal incident response plan
Breaches are rising, with stolen credentials, financially driven attacks, and slow detection driving millions in costs.
Industry Trends
135% of organizations reported a breach in the last 12 months[1]
Verified210.3 million records were exposed in data breaches across the globe in 2023[2]
Verified324% of organizations experienced 6–10 breaches in the last 12 months[1]
Verified426% of breaches were caused by stolen credentials[1]
Directional543% of breaches were financially motivated[1]
Single source629% of breaches involved compromised credentials[1]
Verified721% of organizations reported breaches attributable to phishing[1]
Verified833% of organizations detected breaches in under 1 month[1]
Verified944% of breaches involved the use of malware[1]
Directional1048% of breaches involved unauthorized access to databases[1]
Single source1156% of breaches resulted from malicious attacks[1]
Verified1261% of organizations faced at least one incident due to third-party issues[1]
Verified1368% of organizations had to remediate systems after a breach[1]
Verified1423% of breached records were encrypted[1]
Directional1520% of breaches involved social engineering[1]
Single source1641% of breaches involved cloud assets[1]
Verified1724% of breaches involved web application vulnerabilities[1]
Verified1816% of breaches involved ransomware[1]
Verified1976% of breaches involved customer data[1]
Directional2062% of organizations reported that breach costs continued to rise[1]
Single source2173% of organizations had a policy to secure endpoints[1]
Verified2229% of organizations had no security training program for employees[1]
Verified2335% of organizations said they were hit by a breach due to a cloud misconfiguration[1]
Verified2434% of organizations had to notify regulators after breaches[1]
Directional2538% of organizations faced litigation after breaches[1]
Single source2630% of breaches affected multiple business units[1]
Verified279.4% of breaches involved the use of stolen customer credentials[1]
Verified2814% of organizations reported breaches caused by insiders[1]
Verified2947% of breaches affected more than one country[1]
Directional3023% of organizations reported that an incident occurred within the same week it was detected[1]
Single source3164% of breached organizations required additional training during incident response[1]
Verified3238% of organizations reported that breach response took longer due to unclear incident ownership[1]
Verified3345% of organizations reported communication issues during breach response[1]
Verified3426% of organizations reported a breach due to missing or ineffective patching[1]
DirectionalIndustry Trends Interpretation
With 35% of organizations reporting a breach in the last 12 months and 62% saying breach costs kept rising, the data shows that incidents remain frequent and increasingly expensive, not just disruptive.
Cost Analysis
1$4.45 million average cost of a data breach in 2023[1]
Verified2$150 average cost per record exposed globally[1]
Verified311.0% year-over-year increase in average total cost of a data breach[1]
Verified430% of total breach cost comes from detection and escalation[1]
Directional536% of total breach cost comes from remediation[1]
Single source620% of total breach cost comes from customer-related costs[1]
Verified724% of organizations spent more than $10 million to respond to a breach[1]
Verified82.2x higher cost for organizations with breached systems that contained sensitive data[1]
Verified93.9 million records exposed on average per breach (global median range reported as part of the study)[1]
Directional10$1.22 million average cost for detection and escalation activities[1]
Single source11$1.77 million average cost for remediation activities[1]
Verified12$1.25 million average cost for customer notification and post-breach costs[1]
Verified13$1.41 million average cost for business interruption[1]
Verified14$0.29 million average cost for legal expenses[1]
Directional15$0.18 million average cost for regulatory expenses[1]
Single source16$0.28 million average cost for lost productivity (staff time and downtime)[1]
Verified1765% of organizations said costs were impacted by the time it took to contain[1]
Verified1831% of breach costs were attributed to stolen data misuse[1]
Verified1923% of breach costs were attributed to incident response technology costs[1]
Directional2038% of breach costs were attributed to employee downtime[1]
Single source2110% of breach costs were attributed to reputational damage[1]
Verified2217% of breach costs were attributed to fraud and financial loss[1]
Verified23$2.98 million average breach cost for organizations with <500 employees[1]
Verified24$5.11 million average breach cost for organizations with 50,000+ employees[1]
Directional25$3.93 million average breach cost for organizations in the financial services sector[1]
Single source26$4.87 million average breach cost for organizations in healthcare[1]
Verified27$4.24 million average breach cost for manufacturing[1]
Verified28$4.82 million average breach cost for the public sector[1]
Verified29$5.54 million average breach cost for the energy/utilities sector[1]
Directional304% of breach costs were attributed to cyber insurance premiums[1]
Single source3150% of organizations reported that they used incident response services from external vendors[1]
Verified326.5% of organizations had no cyber insurance[1]
Verified3367% of organizations used third-party incident response services[1]
Verified3445% of organizations reported that they spent more than $1 million on consultants[1]
Directional35$10 million+ is the cost threshold for the most expensive breaches in the IBM Cost of a Data Breach dataset[1]
Single source367.5% of breaches resulted in a materialized court settlement (cost impacts reported within the study)[1]
Verified3712% of breach costs were attributed to the cost of monitoring stolen data[1]
Verified3819% of breach costs were attributed to system downtime[1]
VerifiedCost Analysis Interpretation
With the average cost of a data breach rising 11% year over year to $4.45 million in 2023, nearly half of that impact still comes from operational work, with 30% tied to detection and escalation and 36% to remediation.
Performance Metrics
11.0x reduction in time-to-identify and contain for organizations with mature security governance (reported as relative difference)[1]
Verified2277 days average time to identify and contain a breach in 2023[1]
Verified374 days median time to identify a breach[1]
Verified4203 days median time to contain a breach[1]
Directional5108 days median time to contain for organizations with strong security practices[1]
Single source6279% higher breach cost for slower detection (relative comparison in the study)[1]
Verified72.6x higher breach cost when identification takes longer than 200 days[1]
Verified83.2x higher cost when time to contain exceeds 30 days[1]
Verified928% of organizations detected breaches within days (time-to-detect distribution reported in the study)[1]
Directional1032% of organizations contained breaches within days (time-to-contain distribution reported in the study)[1]
Single source118.7% of breaches were detected within 1 day[1]
Verified1212% of breaches took 1–2 weeks to identify[1]
Verified1319% of breaches took more than 6 months to identify[1]
Verified1423% of breaches took more than 6 months to contain[1]
Directional1539% of organizations reported it took more than 30 days to contain a breach[1]
Single source1652% of breaches were identified by monitoring tools[1]
Verified1724% of breaches were identified by user/customer reports[1]
Verified1818% of breaches were identified by law enforcement notifications[1]
Verified1930% of breaches required re-issuing credentials[1]
Directional2044% of breaches required restoring systems from backups[1]
Single source2157% of organizations increased security controls after the breach[1]
Verified2248% of organizations implemented new security tools during incident response[1]
Verified2331% of organizations improved logging/monitoring post-breach[1]
Verified2421% of organizations improved identity/access controls post-breach[1]
Directional2525% of organizations had to rebuild compromised systems after containment[1]
Single source2633% of organizations reported security teams used external assistance to accelerate containment[1]
Verified2716% of breaches were attributed to inadequate vulnerability management (as a performance gap reported in the study)[1]
Verified2829% of breaches were detected using SIEM capabilities (detection method distribution reported in the study)[1]
Verified2918% of breaches were detected using endpoint detection tools[1]
Directional3012% of breaches were detected using intrusion detection/prevention systems[1]
Single source319.4% of organizations had an incident within their first 12 months of operation for a given security stack (security operations maturity reported)[1]
VerifiedPerformance Metrics Interpretation
With a median of 74 days to identify and 203 days to contain, detection is often slow and expensive, since breaches where identification takes longer than 200 days cost 2.6 times more and 39% of organizations reported it took over 30 days to contain.
User Adoption
171% of organizations use multifactor authentication[1]
Verified254% of organizations use security automation/orchestration to respond to incidents[1]
Verified357% of organizations have a formal incident response plan[1]
Verified463% of organizations train employees on cybersecurity at least annually[1]
Directional548% of organizations use encryption to protect data at rest[1]
Single source641% of organizations use encryption for data in transit[1]
Verified762% of organizations use endpoint security tools[1]
Verified855% of organizations use vulnerability scanning[1]
Verified952% of organizations use penetration testing[1]
Directional1046% of organizations use threat intelligence feeds[1]
Single source1140% of organizations have deployed SIEM[1]
Verified1233% of organizations have implemented SOAR[1]
Verified1358% of organizations maintain security logs for at least 6 months[1]
Verified1427% of organizations conduct tabletop exercises quarterly[1]
Directional1520% of organizations use continuous controls monitoring (CCM)[1]
Single source1631% of organizations deploy CASB for cloud governance[1]
Verified1725% of organizations use cloud security posture management (CSPM)[1]
Verified1842% of organizations implement privileged access management (PAM)[1]
Verified1937% of organizations use advanced malware protection/EDR[1]
Directional2044% of organizations conduct regular phishing simulations[1]
Single source2129% of organizations use user and entity behavior analytics (UEBA)[1]
Verified2230% of organizations have a bug bounty program[1]
Verified2355% of organizations use automated patch management[1]
Verified2448% of organizations do monthly vulnerability remediation[1]
Directional2536% of organizations do weekly vulnerability remediation[1]
Single source2624% of organizations patch critical vulnerabilities within 7 days[1]
Verified2718% of organizations patch within 24 hours[1]
Verified2833% of organizations use dedicated DLP tools[1]
Verified2939% of organizations monitor for data exfiltration[1]
Directional3052% of organizations conduct cloud access reviews at least quarterly[1]
Single source3145% of organizations use secure backups with tested restores[1]
Verified3228% of organizations test backup restores at least monthly[1]
Verified3321% of organizations use ransomware recovery drills[1]
Verified3417% of organizations had a security incident tabletop exercise led by executives[1]
Directional3541% of organizations rely on managed security services[1]
Single source3632% of organizations reported using a dedicated breach war room during incidents[1]
Verified3723% of organizations used cyber insurance at the time of breach (reported coverage prevalence in the study)[1]
Verified3851% of organizations have a designated cybersecurity leadership role (e.g., CISO-equivalent)[1]
Verified3962% of organizations conduct third-party risk assessments[1]
Directional4058% of organizations require security clauses in vendor contracts[1]
Single source4134% of organizations have a formal plan to manage security incidents across subsidiaries[1]
VerifiedUser Adoption Interpretation
While many organizations have core defenses in place such as 71% using multifactor authentication and 62% using endpoint security tools, only 20% use continuous controls monitoring and just 17% have executive-led tabletop incident exercises, showing that operational rigor and advanced readiness still lag behind basic controls.
References
- 1ibm.com/reports/data-breach
- 2ericsson.com/en/reports-and-papers/cybersecurity-report