Cybersecurity risk is still rising in 2026, but the pattern is shifting. The latest data shows that ransomware remains widespread, software and third-party exposure are growing, AI is creating new governance gaps, and organizations are spending more to keep up.
Below are the most important cybersecurity statistics for marketers, analysts, IT teams, and business leaders who want a current snapshot of the market.
Top cybersecurity statistics
- The global average cost of a data breach was $4.44 million in 2025.
- The average U.S. data breach cost reached a record $10.22 million in 2025.
- Healthcare had the highest average breach cost at $7.42 million.
- The global average breach lifecycle fell to 241 days.
- Ransomware was present in 44% of breaches reviewed in Verizon’s 2025 DBIR.
- 64% of ransomware victims in the DBIR dataset did not pay the ransom.
- Ransomware-related breaches hit 88% of SMB breaches in Verizon’s 2025 findings.
- The human element was involved in roughly 60% of breaches.
- Third-party involvement appeared in 30% of breaches, up from 15% a year earlier.
- Exploitation of vulnerabilities reached 20% as an initial access vector in breaches.
- Only about 54% of perimeter-device vulnerabilities were fully remediated in the past year in Verizon’s data.
- The median time to fully remediate those edge-device vulnerabilities was 32 days.
- The FBI’s IC3 received 859,532 internet crime complaints in 2024.
- Reported IC3 losses exceeded $16.6 billion in 2024.
- Phishing and spoofing were the most reported cyber crimes by complaint volume in the FBI’s 2024 report.
- IC3 logged 263,455 cyber threat complaints and $1.571 billion in related losses in 2024.
- Two out of three organizations reported moderate-to-critical cyber skills gaps in WEF’s 2025 outlook.
- Only 14% of organizations said they had the people and skills they need today.
- 66% of organizations expected AI to have the biggest impact on cybersecurity in the year ahead.
- Only 37% had processes in place in 2025 to assess the security of AI tools before deployment.
- That figure improved to 64% in the 2026 WEF survey.
- 87% of respondents in WEF’s 2026 survey said AI-related vulnerabilities were the fastest-growing cyber risk in 2025.
- Worldwide end-user spending on information security is projected to reach $239.8 billion in 2026.
- Mandiant found exploits were the initial infection vector in 33% of investigations in 2024.
- The global median dwell time in Mandiant’s 2025 report was 11 days.
Cyber attack and breach statistics
The latest breach research shows that ransomware, human error, third-party exposure, and vulnerability exploitation still define the modern threat landscape. Verizon’s 2025 DBIR is especially useful here because it blends global incident data across industries and attack patterns.
One of the clearest takeaways is that ransomware has become a routine part of breach activity rather than a niche event. At the same time, software exposure and partner ecosystems are expanding the attack surface for organizations of every size.
Key breach drivers in Verizon’s 2025 DBIR
| Label | Bar | Value | ||
|---|---|---|---|---|
| Human element involved |
| 60% | ||
| Ransomware present |
| 44% | ||
| Third-party involvement |
| 30% | ||
| Exploitation as initial access |
| 20% | ||
| Espionage-motivated breaches |
| 17% |
Max = 60%. Widths: Human element involved 100.00%, Ransomware present 73.33%, Third-party involvement 50.00%, Exploitation as initial access 33.33%, Espionage-motivated breaches 28.33%.
These numbers matter because they show cybersecurity teams cannot focus on only one layer of defense. User awareness, patching, identity controls, vendor oversight, and ransomware resilience all have to work together.
Cybersecurity cost statistics
Cybersecurity is expensive even when a breach is contained quickly. IBM’s 2025 Cost of a Data Breach data shows that the global average cost came down, but only because organizations detected and contained incidents faster. In the United States, costs still hit a record high.
Healthcare remains the costliest major sector, which reinforces how expensive security failures can be in highly regulated, data-rich environments.
Average breach cost benchmarks
| Label | Bar | Value | ||
|---|---|---|---|---|
| Global average breach cost |
| $4.44M | ||
| Ransomware or extortion incident cost |
| $5.08M | ||
| Healthcare breach cost |
| $7.42M | ||
| U.S. average breach cost |
| $10.22M |
Max = $10.22M. Widths: Global average breach cost 43.44%, Ransomware or extortion incident cost 49.71%, Healthcare breach cost 72.60%, U.S. average breach cost 100.00%.
One useful benchmark for decision-makers is the breach lifecycle. IBM reported a 241-day global average to identify and contain a breach, while healthcare breaches took 279 days on average, showing how long incident impact can linger beyond the initial intrusion.
AI, phishing, and cyber workforce statistics
AI is now part of both the problem and the defense strategy. World Economic Forum and IBM findings show that many organizations understand the risk, but a large share still lack the policies, controls, and talent required to manage it well.
That creates a dangerous mismatch: AI adoption is moving quickly, while governance, secure deployment, and cyber staffing are moving much more slowly.
Cyber risk and readiness statistics
| Label | Bar | Value | ||
|---|---|---|---|---|
| AI vulnerabilities seen as fastest-growing cyber risk |
| 87% | ||
| Increase in cyber-enabled fraud and phishing |
| 77% | ||
| Organizations with moderate-to-critical skills gaps |
| 66% | ||
| Organizations with AI security assessment processes in 2026 |
| 64% | ||
| Organizations confident they have the people and skills they need |
| 14% |
Max = 87%. Widths: AI vulnerabilities seen as fastest-growing cyber risk 100.00%, Increase in cyber-enabled fraud and phishing 88.51%, Organizations with moderate-to-critical skills gaps 75.86%, Organizations with AI security assessment processes in 2026 73.56%, Organizations confident they have the people and skills they need 16.09%.
IBM’s breach research adds another warning sign. Among organizations that reported an AI-related security incident, 97% said they lacked proper AI access controls, and 63% lacked AI governance policies or were still developing them.
Cybersecurity spending and operations statistics
Despite budget scrutiny across tech, cybersecurity spending continues to rise. Gartner projects worldwide end-user information security spending to reach $213.0 billion in 2025 and $239.8 billion in 2026, with software and services leading the market.
Operational data also shows why spending is not slowing down. Attackers are still breaking in through exploits, response speed remains critical, and cloud, identity, and AI-related exposure continue to expand.
Worldwide information security spending
| Label | Bar | Value | ||
|---|---|---|---|---|
| 2024 spending |
| $193.41B | ||
| 2025 spending |
| $213.03B | ||
| 2026 spending |
| $239.76B |
Max = $239.76B. Widths: 2024 spending 80.67%, 2025 spending 88.85%, 2026 spending 100.00%.
Mandiant’s 2025 report found that exploits were the initial infection vector in 33% of investigations, while the global median dwell time rose slightly to 11 days. Microsoft’s 2025 Digital Defense Report also said AI-driven phishing is now three times more effective than traditional campaigns, and destructive cloud campaigns were up 87%.
IBM’s 2026 X-Force Threat Index points in the same direction. It reported a 44% year-over-year increase in exploitation of public-facing applications, a 49% increase in active ransomware groups, and more than 300,000 exposed ChatGPT credentials observed in 2025.
Final takeaway
The most important cybersecurity statistic in 2026 may be this: the risk surface is widening faster than most organizations are strengthening governance, staffing, and patching discipline. Ransomware remains common, breach costs remain high, AI risks are rising, and security spending is still climbing because the pressure has not eased.
For most organizations, the data points to the same priorities: tighten identity controls, reduce software exposure, improve vendor oversight, accelerate detection and response, and put real governance around AI before adoption moves any further ahead of security.
Sources
All statistics above come from the primary or official sources listed below.
- IBM, Cost of a Data Breach Report 2025: https://www.ibm.com/reports/data-breach
- Verizon, 2025 Data Breach Investigations Report Executive Summary PDF: https://www.verizon.com/business/resources/reports/2025-dbir-executive-summary.pdf
- Verizon, 2025 DBIR landing page: https://www.verizon.com/business/resources/reports/dbir/
- FBI, FBI Releases Annual Internet Crime Report: https://www.fbi.gov/news/press-releases/fbi-releases-annual-internet-crime-report
- IC3, 2024 IC3 Annual Report PDF: https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
- World Economic Forum, Global Cybersecurity Outlook 2025 digest: https://www.weforum.org/publications/global-cybersecurity-outlook-2025/digest/
- World Economic Forum, Global Cybersecurity Outlook 2026 digest: https://www.weforum.org/publications/global-cybersecurity-outlook-2026/digest/
- World Economic Forum, Global Cybersecurity Outlook 2026 PDF: https://reports.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2026.pdf
- Gartner, Worldwide end-user spending on information security forecast: https://www.gartner.com/en/newsroom/press-releases/2025-07-29-gartner-forecasts-worldwide-end-user-spending-on-information-security-to-total-213-billion-us-dollars-in-2025
- Google Cloud Mandiant, M-Trends 2025 Report PDF: https://services.google.com/fh/files/misc/m-trends-2025-en.pdf
- Microsoft, Microsoft Digital Defense Report 2025: https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025
- IBM Newsroom, 2026 X-Force Threat Index: https://newsroom.ibm.com/2026-02-25-ibm-2026-x-force-threat-index-ai-driven-attacks-are-escalating-as-basic-security-gaps-leave-enterprises-exposed