Cybersecurity Statistics
Contact Us
Browse cybersecurity research, threat data, attack techniques, statistics, and compliance guides on CyberSanso. Free to use, updated regularly.
Cybersecurity Statistics 2026: Data Breach Costs, Ransomware, and Attack Trends
Cybersecurity statistics are only useful if they are accurate, sourced, and current. CyberSanso maintains this statistics hub as a running reference for security teams, executives, and researchers who need hard data for investment decisions, business cases, and risk assessments. Every figure on this page is sourced from primary research publications: IBM Cost of a Data Breach, Verizon Data Breach Investigations Report (DBIR), CrowdStrike Global Threat Report, FBI Internet Crime Complaint Center (IC3), ISC2 Cybersecurity Workforce Study, Sophos, Mandiant M-Trends, and Gartner.
The 2026 threat landscape is defined by three structural shifts. Vulnerability exploitation surpassed stolen credentials as the top initial access vector in the Verizon 2026 DBIR for the first time, now accounting for 31% of all breach entry points – up from 20% in 2025. Ransomware is present in 48% of all breach chains – up from 44% in 2025 – with active ransomware groups increasing 49% year-over-year per IBM X-Force 2026. Third-party and supply chain breaches surged to 48% of all incidents in the 2026 DBIR, nearly double the prior year’s share.
Where statistics from different authoritative sources conflict – which they frequently do due to differences in methodology, sample composition, and time periods – we note the discrepancy and explain the methodological reason rather than picking the number that sounds most dramatic.
Data Breach Cost Statistics 2026
The global average cost of a data breach fell for the first time in five years to $4.44 million in 2025, per IBM’s Cost of a Data Breach Report – though this headline figure masks significant divergence by geography and sector. US organizations bucked the global trend, recording a new record average of $10.22 million per breach – driven by regulatory penalties, litigation costs, and slower detection than global averages.
Breach costs by sector (IBM 2025): Healthcare leads for the 15th consecutive year at $7.42 million (down from $9.77 million in 2024 but still 2.5 times the global average). Financial services follows at $6.08 million. Technology sector: $5.57 million. Critical infrastructure: $4.82 million. Retail: $3.48 million.
Breach costs by attack vector (IBM 2025): Ransomware and extortion breaches average $5.08 million – above the global average. Phishing-initiated breaches: $4.8 million average. Supply chain and third-party breaches: $4.91 million average. Stolen credentials: $4.81 million per incident.
Detection and containment timelines (IBM 2025): The average organization takes 181 days to identify a breach and 60 days to contain it after identification – a total lifecycle of 241 days. With AI and automation deployed in the security program, detection time drops to 51 days. The median breach discovery time for the fastest-detecting organizations is 24 days (Verizon DBIR 2025).
Cost drivers that reduce breach costs: AI and automation in security tools reduces breach costs by 34% on average (IBM 2025). Incident response team presence and testing reduces costs by approximately $2 million versus organizations without dedicated IR teams. Law enforcement involvement saves ransomware victims approximately $1 million and helps 75% avoid ransom payment entirely (IBM/Verizon combined data).
- Global average breach cost: $4.44M (IBM 2025), US average: $10.22M
- Ransomware present in 48% of all breach chains (Verizon 2026 DBIR)
- 241-day average breach lifecycle; 51 days with AI-assisted detection
- Vulnerability exploitation is now the #1 initial access vector (31%)
Ransomware Statistics 2026
Ransomware has reached its highest prevalence on record. The Verizon 2026 DBIR finds ransomware present in 48% of all breach chains – meaning nearly half of all documented breaches involve ransomware somewhere in the attack sequence. Active ransomware groups increased 49% year-over-year per IBM X-Force 2026. Over 7,500 organizations appeared on dark web ransomware leak sites in 2025 – a 58% increase from 2024 – representing confirmed, publicly named victims; actual incident volume is substantially higher.
Financial impact: The average ransomware breach costs $5.08 million (IBM 2025), above the overall breach average. Total global ransomware damages are estimated at $57 billion annually (Cybersecurity Ventures), including ransom payments, downtime losses, recovery costs, and regulatory exposure. Global ransomware damages cost approximately $156 million per day. By 2031, annual damages are projected to reach $265 billion.
Payment trends: 64% of organizations now refuse to pay ransom demands (Verizon DBIR 2025) – a record high. For those that do pay, the median payment dropped to $115,000 despite median demands of $1.32 million – suggesting effective negotiation. Average payments fell 50% from $2 million to $1 million (Sophos 2025). Total cryptocurrency payments to ransomware operators reached $813 million in 2024, down 35% from 2023. However, 80% of organizations that pay ransom are attacked again within 12 months (Fortinet).
Targeting patterns: Manufacturing accounts for over 25% of all cyberattacks globally – up from 8% in 2019. Healthcare, government, financial services, and manufacturing bear the highest ransomware attack volumes. 88% of small business breaches involve ransomware (Verizon DBIR 2025), and 60% of small businesses fail within six months of a significant breach (NCSA).
Phishing, Credentials, and Human Element Statistics
The human element remains the dominant factor in cybersecurity incidents despite decades of security awareness investment. The Verizon 2026 DBIR confirms that 60% of breaches involved a human element, whether through phishing clicks, credential reuse, misconfiguration, or social engineering – down from 68% in 2025 but still representing the majority of all incidents. Stanford University research places the figure even higher at 88% when accounting for indirect human error (misconfigurations, inadequate patch management, and similar failures).
Phishing statistics: Phishing accounts for 16% of initial vectors in confirmed data breaches (IBM CODB 2025) and generates $4.8 million average breach cost per incident. AI-generated phishing emails now achieve click rates significantly higher than human-crafted messages, and mobile devices show 18 times higher click rates than desktop devices for phishing content (Verizon 2026 DBIR). Phishing victims fall for attacks in under 60 seconds on average: 21 seconds to click a malicious link and 28 additional seconds to enter credentials (aggregate research data).
Credential theft statistics: Stolen or compromised credentials appear in 29% of breaches (Verizon DBIR 2025) at an average cost of $4.81 million per incident. The credential theft landscape is driven by infostealer malware, which collects saved browser credentials and session tokens from infected endpoints and sells them on dark web markets. Identity-based attacks and malware-free intrusions (using stolen credentials without deploying malware) accounted for 79% of CrowdStrike detections in 2024.
Supply chain and third-party breach statistics: Third-party and supply chain breaches jumped 60% year-over-year in the 2026 DBIR, now present in 48% of all incidents – nearly double the prior year’s share. Supply chain breaches cost an average of $4.91 million per incident (IBM CODB 2025), above the global breach average. The Clop ransomware group’s MOVEit campaign – which compromised over 2,700 organizations in a single supply chain exploitation – remains the reference case for understanding the amplified blast radius of supply-chain vulnerabilities.
Cybersecurity Workforce and Spending Statistics
The cybersecurity industry faces simultaneous pressures from a persistent skills gap and rapidly accelerating threat sophistication. ISC2’s 2024 Workforce Study documented 4.8 million unfilled cybersecurity positions globally – a 19% year-over-year increase. The active workforce grew to 5.5 million professionals, meaning demand is outpacing supply growth. The most acute shortages are in AI security, cloud security, and DevSecOps specializations. Organizations with significant skills shortages pay $5.22 million per breach on average – a 17.6% premium over the $4.44 million global average (IBM 2025).
Cybersecurity spending: Global cybersecurity spending reached approximately $215 billion in 2024 (Gartner), growing at 15% annually. Security services (consulting, incident response, managed security services) represent the largest spending category, followed by endpoint security, network security, and identity and access management. Organizations with incident response teams and programs save nearly $2 million per breach compared to those without (IBM 2025). AI-powered security tools reduced breach costs by 34% for organizations that deployed them – the highest ROI impact of any security investment category tracked by IBM’s 2025 report.
Small business cybersecurity statistics: 43% of all cyberattacks target small businesses (NCSA). Small businesses average $3.31 million in breach costs (IBM 2025). 60% of small businesses close within six months of a significant breach. 88% of SMB breaches involve ransomware (Verizon DBIR 2025). The perception that small businesses are too small to target is demonstrably false – their typically weaker security posture makes them preferred targets for opportunistic attackers and entry points for supply chain attacks on larger upstream customers.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.
Suspendisse ut ultricies augue. Sed at leo vitae tempus. Quisque a vel nulla vestibulum eleifend at id augue. Nullam volutpat justo eget justo finibus mattis. Nam, massa sit amet euismod fermentum.