By 2025, security teams are still trying to outpace attackers who exploit basic human and process gaps even as spending keeps climbing, and 65% of organizations say they rely on security logging and monitoring to catch misuse and misconfigurations. Yet the same patchwork of tools is where statistics can go wrong, like treating “security automation” and “market growth” as proof that risk is shrinking rather than understanding what is actually happening. When 54% report ransomware as their most financially impactful threat and 38% of breaches involve phishing or email attachments, misusing statistics becomes more than a reporting issue, it becomes a decision problem.
Key Takeaways
- 57% of organizations reported deploying security automation to reduce the time to respond to threats (IBM 2024 report summary).
- 48% of organizations reported using identity governance and administration (IGA) capabilities to reduce account misuse (SailPoint 2024 survey).
- 65% of organizations said they use security logging/monitoring (SIEM/SOAR) to detect misuse and misconfigurations (Gartner, 2024 security monitoring).
- 54% of organizations said ransomware was the most financially impactful threat they experienced (2024 survey).
- In 2023, 38% of breaches involved malware spread through phishing or email attachments (Verizon DBIR 2024).
- $2.98 billion total reported losses from cybercrime in the US in 2023 (FBI IC3 2023 report).
- In 2023, malware accounted for 35% of breaches involving cyber-physical systems (ENISA threat landscape 2024, ICS).
- The global cloud access security broker (CASB) market was $1.2 billion in 2024 and forecast to reach $4.1 billion by 2030 (MarketsandMarkets, 2024).
- The global security orchestration, automation, and response (SOAR) market was valued at $2.7 billion in 2023 (Fortune Business Insights, 2024).
- The global security information and event management (SIEM) market was projected to be $35.6 billion in 2024 (Gartner market numbers summarized by vendor research).
- $1.95 million was the median cost of a data breach involving malicious or criminal conduct in 2023
- NIST SP 800-63B recommends that verifiers use MFA to mitigate account takeover and credential misuse, including phishing-resistant options
- NIST SP 800-171 requires access control policies and procedures and mandates audit logs for controlled access to protect against unauthorized use
From phishing to ransomware, most breaches and losses spur faster automation, stronger monitoring, and MFA to curb account misuse.
Related reading
Mitigation Adoption
157% of organizations reported deploying security automation to reduce the time to respond to threats (IBM 2024 report summary).[1]
Single source
248% of organizations reported using identity governance and administration (IGA) capabilities to reduce account misuse (SailPoint 2024 survey).[2]
Verified
365% of organizations said they use security logging/monitoring (SIEM/SOAR) to detect misuse and misconfigurations (Gartner, 2024 security monitoring).[3]
Verified
Mitigation Adoption Interpretation
Under the Mitigation Adoption lens, nearly two thirds of organizations using security logging and monitoring alongside 57% deploying security automation indicates that most are increasingly equipping themselves to curb misuse in practice rather than relying solely on prevention.
Threat Landscape
154% of organizations said ransomware was the most financially impactful threat they experienced (2024 survey).[4]
Verified
Threat Landscape Interpretation
In the Threat Landscape, 54% of organizations say ransomware is the most financially impactful threat they face, underscoring how dominant and costly it has become in recent cybersecurity experiences.
Industry Trends
1In 2023, 38% of breaches involved malware spread through phishing or email attachments (Verizon DBIR 2024).[5]
Single source
2$2.98 billion total reported losses from cybercrime in the US in 2023 (FBI IC3 2023 report).[6]
Single source
3In 2023, malware accounted for 35% of breaches involving cyber-physical systems (ENISA threat landscape 2024, ICS).[7]
Verified
4$10.1 billion total losses were reported to IC3 in 2022 (FBI IC3 2022 report).[8]
Verified
5OpenSSL had 1,000,000+ downloads after high-impact vulnerability disclosures (industry tracking of CVE-2022-0778).[9]
Directional
61.3 million phishing sites were blocked daily on average by Google Safe Browsing in 2023 (average)[10]
Verified
Industry Trends Interpretation
Across industry trends, attackers are increasingly leveraging email and malware at scale, with 38% of 2023 breaches using phishing or email attachments and malware tied to 35% of cyber-physical system incidents, while the US also reported $2.98 billion in cybercrime losses in 2023.
Market Size
1The global cloud access security broker (CASB) market was $1.2 billion in 2024 and forecast to reach $4.1 billion by 2030 (MarketsandMarkets, 2024).[11]
Verified
2The global security orchestration, automation, and response (SOAR) market was valued at $2.7 billion in 2023 (Fortune Business Insights, 2024).[12]
Verified
3The global security information and event management (SIEM) market was projected to be $35.6 billion in 2024 (Gartner market numbers summarized by vendor research).[13]
Verified
4The identity and access management (IAM) market is projected to reach $30.7 billion by 2027 (Fortune Business Insights, 2024).[14]
Single source
5The global endpoint detection and response (EDR) market is forecast to grow from $6.9 billion in 2023 to $20.9 billion by 2030 (Fortune Business Insights, 2024).[15]
Verified
6The cloud security market is expected to grow from $8.7 billion in 2022 to $22.4 billion by 2026 (MarketsandMarkets, 2023 forecast).[16]
Verified
7Worldwide spending on security services is projected to total $156.4 billion in 2024 (Gartner forecast, press release dated 2024-04-17).[17]
Single source
8Worldwide end-user spending on cybersecurity products and services is forecast to reach $219.0 billion in 2024 (Gartner 2024 press release).[18]
Directional
9The global unified endpoint management (UEM) market was valued at $2.2 billion in 2023 and projected to reach $8.0 billion by 2030 (IMARC, 2024).[19]
Directional
10The market for cloud security posture management (CSPM) is forecast to reach $4.6 billion by 2027 (Global Market Insights, 2024).[20]
Verified
11The privileged access management (PAM) market was estimated at $5.4 billion in 2023 and forecast to grow to $16.0 billion by 2030 (MarketsandMarkets, 2024).[21]
Verified
Market Size Interpretation
The Market Size data shows that demand for security solutions is rapidly expanding, with the cloud access security broker market rising from $1.2 billion in 2024 to a forecast $4.1 billion by 2030, reflecting broad growth across the security ecosystem.
Cost Analysis
1$1.95 million was the median cost of a data breach involving malicious or criminal conduct in 2023[22]
Verified
Cost Analysis Interpretation
In the cost analysis of breaches tied to malicious or criminal conduct, the median impact in 2023 was $1.95 million, underscoring how significant these incidents are financially.
Governance & Controls
1NIST SP 800-63B recommends that verifiers use MFA to mitigate account takeover and credential misuse, including phishing-resistant options[23]
Directional
2NIST SP 800-171 requires access control policies and procedures and mandates audit logs for controlled access to protect against unauthorized use[24]
Directional
Governance & Controls Interpretation
Under Governance and Controls, the guidance trends toward stronger misuse prevention by requiring verifiers to use MFA, including phishing resistant options as emphasized in NIST SP 800-63B, alongside access control policies with mandatory audit logs for controlled access under NIST SP 800-171.
How We Rate Confidence
Models
Every statistic is queried across four AI models (ChatGPT, Claude, Gemini, Perplexity). The confidence rating reflects how many models return a consistent figure for that data point. Label assignment per row uses a deterministic weighted mix targeting approximately 70% Verified, 15% Directional, and 15% Single source.
Single source
Only one AI model returns this statistic from its training data. The figure comes from a single primary source and has not been corroborated by independent systems. Use with caution; cross-reference before citing.
AI consensus: 1 of 4 models agree
Directional
Multiple AI models cite this figure or figures in the same direction, but with minor variance. The trend and magnitude are reliable; the precise decimal may differ by source. Suitable for directional analysis.
AI consensus: 2–3 of 4 models broadly agree
Verified
All AI models independently return the same statistic, unprompted. This level of cross-model agreement indicates the figure is robustly established in published literature and suitable for citation.
AI consensus: 4 of 4 models fully agree
Models
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
James Okoro. (2026, February 13). Misusing Statistics. Gitnux. https://gitnux.org/misusing-statistics
MLA
James Okoro. "Misusing Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/misusing-statistics.
Chicago
James Okoro. 2026. "Misusing Statistics." Gitnux. https://gitnux.org/misusing-statistics.
References
- 1ibm.com/reports/data-breach
- 22ibm.com/security/data-breach
- 2sailpoint.com/resources/reports/2024-identity-security-risk-trends/
- 3gartner.com/en/newsroom/press-releases/2024-02-06-gartner-identifies-the-top-trends-in-security-operations-for-2024
- 17gartner.com/en/newsroom/press-releases/2024-04-17-gartner-says-worldwide-end-user-spending-on-security-services-will-reach-
- 18gartner.com/en/newsroom/press-releases/2024-04-17-gartner-says-worldwide-end-user-spending-on-security-products-and-services-will-reach-
- 4checkpoint.com/resources/reports/ransomware-report-2024/
- 5verizon.com/business/resources/reports/dbir/
- 6ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
- 8ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf
- 7enisa.europa.eu/publications/enisa-threat-landscape-2024
- 9cvedetails.com/vulnerability/2022-OpenSSL-Directory-Traversal-CVE-2022-0778.html
- 10transparencyreport.google.com/safe-browsing/overview
- 11marketsandmarkets.com/Market-Reports/casb-market-143105861.html
- 16marketsandmarkets.com/Market-Reports/cloud-security-market-169140690.html
- 21marketsandmarkets.com/Market-Reports/privileged-access-management-market-154786704.html
- 12fortunebusinessinsights.com/soar-market-106107
- 13fortunebusinessinsights.com/security-information-event-management-market-103375
- 14fortunebusinessinsights.com/identity-access-management-market-102801
- 15fortunebusinessinsights.com/edr-market-102909
- 19imarcgroup.com/unified-endpoint-management-uro-market
- 20gminsights.com/industry-analysis/cloud-security-posture-management-market
- 23pages.nist.gov/800-63-3/sp800-63b.html
- 24csrc.nist.gov/pubs/sp/800/171/r2/final