Cybercrime losses now equate to 1.4% of global GDP. Human factors drive 65% of all breaches, while organizations face stricter regulatory timelines for reporting incidents.
Key Takeaways
- 1.4% of global GDP is the estimate of gross losses from cybercrime, based on a 2023 report by the International Monetary Fund (IMF) using historical ransomware growth and other sources.
- 65% of breaches involved the human element (e.g., phishing, credential theft), according to Verizon’s 2024 Data Breach Investigations Report (DBIR).
- 73% of organizations use a firewall for perimeter security, according to Verizon’s 2024 DBIR technology/controls coverage data.
- The average cost of a data breach is $4.45 million globally, according to IBM Cost of a Data Breach Report 2023.
- $74 million is the average total cost of a data breach for organizations in the United States in 2023, per IBM’s Cost of a Data Breach Report 2023 (US average).
- 28% of breaches are caused by human error in 2023, per IBM Cost of a Data Breach Report 2023 breakdown.
- The global enterprise risk management (ERM) market is expected to grow to $8.4 billion by 2030, per a 2022 report by IMARC Group.
- The global governance, risk, and compliance (GRC) market is forecast to reach $25.0 billion by 2032, according to a 2024 report by MarketsandMarkets.
- The global cybersecurity market is projected to reach $345.4 billion by 2026, per a 2023 forecast by MarketsandMarkets.
- 41% of breaches were discovered by third-party reporting rather than internal monitoring, per IBM’s 2023 Cost of a Data Breach report (discovery method breakdown).
- 48 hours is the maximum initial incident notification deadline for some operators under NIS2 (initial notification).
- 72 hours is the final incident notification timeline for significant incident details under certain NIS2 conditions (where specified).
- The Federal Reserve’s supervisory stress tests apply to large banks with at least $100 billion in assets (capital planning stress tests).
Cyber risk is rising fast as most breaches involve people, stolen credentials, and high financial damage.
Related reading
01 · Category
Industry Trends21 stats
01
1.4% of global GDP is the estimate of gross losses from cybercrime, based on a 2023 report by the International Monetary Fund (IMF) using historical ransomware growth and other sources.
02
65% of breaches involved the human element (e.g., phishing, credential theft), according to Verizon’s 2024 Data Breach Investigations Report (DBIR).
03
73% of organizations use a firewall for perimeter security, according to Verizon’s 2024 DBIR technology/controls coverage data.
04
37% of organizations experienced a security incident or data breach in the past 12 months, according to the 2024 Verizon DBIR results/industry survey.
05
22% of incidents involved distributed denial of service (DDoS) attacks, per Verizon DBIR 2024.
06
28% of breaches involved web applications, per Verizon DBIR 2024.
07
38% of breaches involved the exploitation of a vulnerability, per Verizon DBIR 2024.
08
13% of breaches involved scanning/enumeration prior to an attack, per Verizon DBIR 2024.
09
35% of breaches involved compromised credentials, per Verizon DBIR 2024.
10
54% of confirmed data breaches were financially motivated, per Verizon DBIR 2024.
11
Basel Committee’s Operational Risk losses data: the frequency/severity modelling approach is supported by the Loss Data Collection Exercise (LDCE) frameworks, with data submitted across 10+ banks participating.
12
65% of organizations cite improving governance and risk management as a key driver for GRC investments, per a 2023 Gartner research brief summarized publicly.
13
4,479 is the number of data breaches reported globally in 2023 by Risk Based Security (RBS), using its Data Breach QuickView.
14
8,428,272,268 records were exposed in 2023 according to Risk Based Security’s Data Breach QuickView.
15
2,000+ cyber vulnerabilities are disclosed in 2023 on average each month, per data from the NVD in 2023; total CVE counts exceed 20k.
16
The NIST National Vulnerability Database (NVD) published dashboards showing that CVE entries exceeded 22,000 in 2023.
17
1,000+ new CVEs are added daily on average to the NVD, based on NVD dashboard totals and daily ingestion patterns.
18
The EU’s NIS2 directive requires ‘essential’ and ‘important’ entities to take appropriate and proportionate measures to manage risks and incident reporting.
19
The European Union’s Digital Operational Resilience Act (DORA) establishes operational resilience requirements for financial entities, with risk management obligations for ICT third parties.
20
The Basel Committee’s operational risk standardized approach supports loss event data collection with event types spanning multiple categories used in OR modeling frameworks.
21
The Basel standardized approach for operational risk has 8 event types (Basel loss event categories).
Interpretation
Industry Trends Interpretation
Across these cyber and operational risk figures, the most striking trend is that human-driven breaches dominate, with 65% involving the human element while 37% of organizations reported an incident in the past 12 months, alongside a steady stream of risk inputs like 1,000 or more new CVEs added daily on average to the NVD.
02 · Category
Cost Analysis14 stats
01
The average cost of a data breach is $4.45 million globally, according to IBM Cost of a Data Breach Report 2023.
02
$74 million is the average total cost of a data breach for organizations in the United States in 2023, per IBM’s Cost of a Data Breach Report 2023 (US average).
03
28% of breaches are caused by human error in 2023, per IBM Cost of a Data Breach Report 2023 breakdown.
04
17% of breaches include malicious or criminal insiders, according to IBM’s 2023 Cost of a Data Breach Report.
05
The median time to identify a breach is 207 days, according to IBM’s Cost of a Data Breach Report 2023.
06
The median time to contain a breach is 73 days, per IBM’s Cost of a Data Breach Report 2023.
07
Enterprise companies spend 50% more on security incidents than small businesses on average, per IBM’s Cost of a Data Breach Report 2023.
08
$1.76 million is the average breach cost for organizations using security with strong encryption, per IBM’s 2023 Cost of a Data Breach Report.
09
Organizations with a mature incident response plan save $1.23 million compared with those without one, per IBM Cost of a Data Breach 2023.
10
$1.46 million is the average cost of breaches involving stolen credentials, per IBM’s 2023 report.
11
Organizations that can identify breaches sooner reduce total breach cost by an average of $20,000per day saved, per IBM’s analysis summarized in its 2023 report.
12
Companies face administrative fines up to €10 million or 2% of annual worldwide turnover under NIS2 (higher for certain breaches).
13
Companies face administrative fines up to €20 million or 4% of annual worldwide turnover under NIS2 for certain infringements.
14
GDPR fines can be up to €20 million or 4% of total worldwide annual turnover, whichever is higher.
Interpretation
Cost Analysis Interpretation
With the global average data breach cost at $4.45 million and the biggest drag coming from 207 days to identify and 73 days to contain, these figures show that shaving response time and strengthening controls like encryption can materially reduce losses that are then magnified by potential NIS2 and GDPR fines up to 2% to 4% of worldwide turnover.
03 · Category
Market Size12 stats
01
The global enterprise risk management (ERM) market is expected to grow to $8.4 billion by 2030, per a 2022 report by IMARC Group.
02
The global governance, risk, and compliance (GRC) market is forecast to reach $25.0 billion by 2032, according to a 2024 report by MarketsandMarkets.
03
The global cybersecurity market is projected to reach $345.4 billion by 2026, per a 2023 forecast by MarketsandMarkets.
04
The global risk analytics market size is expected to grow to $30.8 billion by 2030, per a 2024 report by Grand View Research.
05
The global third-party risk management market is projected to reach $10.3 billion by 2030, per a 2023 report by MarketsandMarkets.
06
The global fraud detection and prevention market is projected to reach $37.4 billion by 2030, per a 2024 report by Grand View Research.
07
The global identity and access management market is expected to reach $29.0 billion by 2027, per a 2022 report by MarketsandMarkets.
08
The global cyber insurance market is forecast to reach $20.0 billion by 2026, according to a 2022 report by Fortune Business Insights.
09
The U.S. Dodd-Frank/financial services stress testing industry supports annual regulatory capital planning processes that evaluate trillions in exposures; e.g., the Fed’s annual CCAR process includes assessments of banks with assets over $100B.
10
In the U.S., banks subject to CCAR have at least $100 billion in total consolidated assets (threshold for formal stress tests under the Federal Reserve’s rules).
11
Global cyber insurance premiums are forecast to reach $22.2 billion in 2023, per a report by Swiss Re Sigma (published in 2022/2023 context).
12
The Swiss Re Institute estimates that global reinsurance and insurance exposure to cyber risks is growing at double-digit rates (indexed to 2020 base).
Interpretation
Market Size Interpretation
Across ERM, GRC, cyber, and related risk markets, investment is accelerating rapidly, with global cybersecurity projected to hit $345.4 billion by 2026 and cyber insurance reaching $20.0 billion by 2026, while the reinsurance and insurance exposure to cyber risks is growing at double-digit rates relative to 2020.
More related reading
04 · Category
Performance Metrics5 stats
01
41% of breaches were discovered by third-party reporting rather than internal monitoring, per IBM’s 2023 Cost of a Data Breach report (discovery method breakdown).
02
48 hours is the maximum initial incident notification deadline for some operators under NIS2 (initial notification).
03
72 hours is the final incident notification timeline for significant incident details under certain NIS2 conditions (where specified).
04
GDPR breach notification to supervisory authorities must occur within 72 hours of becoming aware of the breach, where feasible.
05
DORA requires incident reporting timelines, including 1 hour and 4 hours for initial categories (as specified by RTS).
Interpretation
Performance Metrics Interpretation
Across major European and global frameworks, notification expectations are getting faster and stricter, with 41% of breaches emerging through third-party reporting and NIS2 and GDPR aligning on 72 hours for key notifications while DORA pushes even tighter 1 hour and 4 hour initial reporting windows.
05 · Category
User Adoption1 stats
01
The Federal Reserve’s supervisory stress tests apply to large banks with at least $100 billion in assets (capital planning stress tests).
Interpretation
User Adoption Interpretation
The Federal Reserve’s capital planning stress tests cover only the biggest banks with at least $100 billion in assets, showing the supervision is tightly focused on large institutions rather than the broader banking sector.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Thomas Lindqvist. (2026, February 13). Risk Management Industry Statistics. Gitnux. https://gitnux.org/risk-management-industry-statistics
MLA
Thomas Lindqvist. "Risk Management Industry Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/risk-management-industry-statistics.
Chicago
Thomas Lindqvist. 2026. "Risk Management Industry Statistics." Gitnux. https://gitnux.org/risk-management-industry-statistics.
Sources & references
24 datasets cited across this report · attribution is report-level
+10 additional datasets cited (not shown individually)