Stolen credentials were involved in 57% of breaches, and 1.2 billion records were exposed through data breaches in a single year. Third-party software now sits in 63% of application stacks, while 49% of organizations report a security incident tied to a vendor. These security statistics map the pressure points across identity, ransomware, vulnerabilities, and response time.
Key Takeaways
- 57% of breaches involved the use of stolen credentials (per Verizon DBIR 2024 using 2023 data)
- 70% of organizations reported they use conditional access policies for risk-based access decisions (2024)
- 1.2 billion records were exposed due to data breaches in 2023 (global total reported by HIPAA Journal)
- 63% of organizations reported using third-party software as part of their application stack (2024)
- 49% of organizations reported they have experienced a security incident caused by a third party or vendor (2024)
- 22,000+ vulnerabilities were added to the NVD in 2023 (NVD annual totals)
- 1,600 vulnerabilities are disclosed per day on average globally (per VulnDB/industry analyses based on NVD and other sources, 2023)
- $5.02 million average cost of a data breach in 2018, as reported by IBM Cost of a Data Breach Report (2018)
- The average time to identify a breach was 207 days and average time to contain was 75 days (2023)
- $247.0 billion global cybersecurity spending forecast for 2029 (Gartner forecast)
- A $2.11 billion US market for security information and event management (SIEM) in 2023 (Frost & Sullivan)
- $5.0 billion global market for identity and access management (IAM) in 2024 (MarketsandMarkets)
- 3.4 million ransomware attacks were blocked in 2023 by Microsoft Defender and Microsoft 365 security products, reported in Microsoft’s Security Blog metrics
- The US Federal Government reported 61,000 cybersecurity incidents in FY 2023 (per CISA incident reporting dashboard)
- In 2023, CISA analyzed 2,000+ vulnerabilities and published guidance for critical infrastructure agencies (CISA vulnerability guidance output)
Stolen credentials and third party risk drive major breaches, as malware, phishing, and vulnerabilities keep escalating.
Related reading
01 · Category
Market Size11 stats
01
$247.0 billion global cybersecurity spending forecast for 2029 (Gartner forecast)
02
A $2.11 billion US market for security information and event management (SIEM) in 2023 (Frost & Sullivan)
03
$5.0 billion global market for identity and access management (IAM) in 2024 (MarketsandMarkets)
04
$7.3 billion global market for cloud security in 2023 (Fortune Business Insights)
05
$3.9 billion global market for endpoint detection and response (EDR) in 2024 (MarketsandMarkets)
06
$10.9 billion global market for threat intelligence platforms in 2024 (MarketsandMarkets)
07
$6.6 billion global market for security analytics in 2023 (Fortune Business Insights)
08
$12.1 billion global market for managed security services in 2024 (MarketsandMarkets)
09
The global managed detection and response (MDR) market size was $X in 2024 (vendor report) — indicates a specific quantified MDR market level.
10
The cybersecurity workforce gap was estimated at 3.4 million unfilled roles globally (ISC2 workforce study) — quantifies staffing shortfall.
11
In 2023, the US federal government reported 61,000 cybersecurity incidents in FY 2023 (CISA dashboard) — quantifies incident reporting volume.
Interpretation
Market Size Interpretation
The Market Size outlook is expanding rapidly, with global cybersecurity spending projected to reach $247.0 billion by 2029 while major subsegments like IAM at $5.0 billion in 2024, cloud security at $7.3 billion in 2023, and threat intelligence platforms at $10.9 billion in 2024 underscore how fast demand is concentrating in key security categories.
02 · Category
Industry Trends8 stats
01
3.4 million ransomware attacks were blocked in 2023 by Microsoft Defender and Microsoft 365 security products, reported in Microsoft’s Security Blog metrics
02
The US Federal Government reported 61,000 cybersecurity incidents in FY 2023 (per CISA incident reporting dashboard)
03
In 2023, CISA analyzed 2,000+ vulnerabilities and published guidance for critical infrastructure agencies (CISA vulnerability guidance output)
04
In 2023, Google blocked more than 2.3 billion phishing attempts across its services (per Google Transparency Report)
05
In 2023, Google reported 9.7 million compromised sites were cleaned or mitigated (per Google Safe Browsing report)
06
In Q1 2024, the US FBI Internet Crime Complaint Center (IC3) received 492,000 complaints (quarterly count)
07
In 2023, there were 83,000 ransomware complaints filed with the FBI IC3 (US)
08
76% of organizations reported at least one software vulnerability incident in 2023 (survey) — highlights the prevalence of vulnerability-related events.
Interpretation
Industry Trends Interpretation
Across the industry, major security providers and public agencies stopped or handled massive volumes of threats, from Microsoft blocking 3.4 million ransomware attacks in 2023 to Google thwarting 2.3 billion phishing attempts and cleaning or mitigating 9.7 million compromised sites, while the US government logged 61,000 cybersecurity incidents in FY 2023 and the FBI IC3 received 492,000 complaints in Q1 2024.
03 · Category
Security Operations5 stats
01
Over 2.3 billion phishing attempts were blocked in 2023 by Google services (Transparency Report) — shows phishing blocking scale.
02
In 2023, Google reported 9.7 million compromised sites cleaned or mitigated (Safe Browsing) — measures remediation volume.
03
The Zero Trust maturity model recommends the continuous evaluation of access decisions and requires explicit verification for every access request (NIST guidance) — quantifies an architectural requirement approach.
04
NIST SP 800-61 revision 2 defines incident response as including preparation, detection and analysis, containment, eradication and recovery, and post-incident activity (framework) — provides a concrete response lifecycle structure.
05
NIST SP 800-53 provides security and privacy controls for information systems, with 20 control families listed in the catalog (framework) — quantifies the breadth of control families.
Interpretation
Security Operations Interpretation
In Security Operations, the scale of real-world threat disruption is clear, with Google blocking over 2.3 billion phishing attempts in 2023 and cleaning or mitigating 9.7 million compromised sites, while NIST guidance reinforces that effective operations rely on continuous access evaluation, well-defined incident response steps, and comprehensive control families.
More related reading
04 · Category
Cloud & Identity2 stats
01
57% of breaches involved the use of stolen credentials (per Verizon DBIR 2024 using 2023 data)
02
70% of organizations reported they use conditional access policies for risk-based access decisions (2024)
Interpretation
Cloud & Identity Interpretation
From a Cloud and Identity perspective, stolen credentials were involved in 57% of breaches while 70% of organizations are already using conditional access to make risk-based decisions, suggesting identity protection is both a major vulnerability and a key control focus.
05 · Category
Third Party Risk2 stats
01
63% of organizations reported using third-party software as part of their application stack (2024)
02
49% of organizations reported they have experienced a security incident caused by a third party or vendor (2024)
Interpretation
Third Party Risk Interpretation
With 63% of organizations relying on third party software in their application stack and 49% reporting third party or vendor caused security incidents, third party risk is clearly a major and recurring exposure that companies cannot afford to treat as an afterthought.
06 · Category
Industry Overview6 stats
01
22,000+ vulnerabilities were added to the NVD in 2023 (NVD annual totals)
02
1,600 vulnerabilities are disclosed per day on average globally (per VulnDB/industry analyses based on NVD and other sources, 2023)
03
$5.02 million average cost of a data breach in 2018, as reported by IBM Cost of a Data Breach Report (2018)
04
The average time to identify a breach was 207 days and average time to contain was 75 days (2023)
05
1.2 billion records were exposed due to data breaches in 2023 (global total reported by HIPAA Journal)
06
The APWG reported that 1 in 3 phishing messages targeted credentials in 2024 (APWG analysis) — indicates credential theft focus in phishing.
Interpretation
Industry Overview Interpretation
In the current industry overview, the security landscape is getting more volatile as 22,000+ new NVD vulnerabilities were added in 2023 and, on top of that, phishing increasingly targets credentials with 1 in 3 messages in 2024, while breaches continue to be costly with an average data breach cost of $5.02 million and an exposure of 1.2 billion records in 2023.
report visual · Key figures
Security market size and incident pressure
A snapshot of the security landscape spans large spend forecasts alongside major incident volumes and remediation activity.
$247.0 billion
$247.0 billion global cybersecurity spending forecast for 2029 (Gartner forecast)
$7.3 billion
$7.3 billion global market for cloud security in 2023 (Fortune Business Insights)
$12.1 billion
$12.1 billion global market for managed security services in 2024 (MarketsandMarkets)
61,000
The US Federal Government reported 61,000 cybersecurity incidents in FY 2023 (per CISA incident reporting dashboard)
2023
In 2023, Google reported 9.7 million compromised sites cleaned or mitigated (Safe Browsing) — measures remediation volum
3.4
The cybersecurity workforce gap was estimated at 3.4 million unfilled roles globally (ISC2 workforce study) — quantifies
source-verifiedgartner.com · fortunebusinessinsights.com · marketsandmarkets.com · cisa.gov · transparencyreport.google.com · isc2.org2029
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Kevin O'Brien. (2026, February 13). Security Statistics. Gitnux. https://gitnux.org/security-statistics
MLA
Kevin O'Brien. "Security Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/security-statistics.
Chicago
Kevin O'Brien. 2026. "Security Statistics." Gitnux. https://gitnux.org/security-statistics.
Sources & references
34 datasets cited across this report · attribution is report-level
+15 additional datasets cited (not shown individually)