Your business got hacked while you were reading this sentence. Somewhere, a ransomware attack just locked someone out of their files, a phishing email tricked another employee, and a data breach exposed thousands of records.
The numbers don’t lie, and honestly, they’re pretty scary. Cybersecurity statistics paint a picture that most companies would rather ignore, but that’s exactly why you need to see them.
This article breaks down the latest data breach statistics, cyber attack trends, and threat intelligence data that actually matter. You’ll see what Verizon Data Breach Report findings reveal, where your industry stands in terms of security incident response, and why cybersecurity spending statistics keep climbing year after year.
Look, these aren’t just numbers from research firms like Ponemon Institute or Gartner cybersecurity research. They’re warning signs that could save your organization millions (or at least help you sleep better at night).
General Cybersecurity Landscape
Attack Frequency & Volume
- Cyberattacks happen every 39 seconds on average, totaling approximately 2,244 attacks per day (University of Maryland)
- Over 4,000 cyberattacks occur daily worldwide (Fortinet)
- Weekly cyberattacks per organization more than doubled from 818 in Q2 2021 to 1,984 in Q2 2025 (Check Point Research)
- Weekly attacks increased 58% in just the last two years globally (World Economic Forum)
Financial Impact
- Global cybercrime costs are projected to reach $10.5 trillion annually in 2025 (Cybersecurity Ventures)
- Cybercrime could reach $15.63 trillion by 2029 (Cybersecurity Ventures)
- IMF estimates cybercrime will cost the world $23 trillion in 2027, a 175% increase from 2022 (IMF)
- Cybercrime represents what would be the world’s third-largest economy after the United States and China (KnowB4)
Industry Spending
- Global cybersecurity spending will grow 12.2% in 2025 and cross $377 billion by 2028 (IDC)
- Gartner forecasts a 15% rise in global cybersecurity spending in 2025 (Gartner)
- The cybersecurity market will expand to $212 billion by the end of 2025 (Gartner)
- US and Western Europe account for over 70% of global security spending (IDC)
- Security budgets now represent 13.2% of total IT spending, up from 8.6% in 2020 (IANS)
- Cybersecurity budgets grew by 8% in 2024, up from 6% in 2023 (IANS)
- 97% of businesses expect to increase their cybersecurity budgets in the next 12 months (Cisco)
- Worldwide spending on security and risk management projected to reach $215 billion in 2024 (Techopedia)
- 79% of organizations plan to increase cybersecurity spending in 2025 (UHY)
Organizational Readiness
- Only 3% of organizations globally have “Mature” level readiness to be resilient against cybersecurity risks (Cisco)
- 72% of business owners are concerned about future cybersecurity risks from hybrid or remote work (Various sources)
- 74% of businesses are confident in their ability to detect and respond to cyberattacks in real-time (Various sources)
- 73% of companies expect a cybersecurity incident to disrupt their business in the next 12-24 months (Cisco)
- 66% of organizations expect AI to impact cybersecurity in 2025 (World Economic Forum)
- Only 37% have processes to assess AI tool security before deployment (World Economic Forum)
Average Cost of Data Breaches by Industry
Data Breaches
Costs & Financial Impact
- Global average cost of a data breach dropped to $4.44 million in 2025, down 9% from $4.88 million in 2024 (IBM)
- United States has the highest average breach cost at $10.22 million in 2025, an all-time high for any region (IBM)
- Breach costs in the US surged 9% in 2025 (IBM)
- Middle East follows US with $7.29 million average breach cost (IBM)
- Average cost per compromised record is about $160 in 2025, down from $165 in 2024 (IBM)
- Healthcare data breaches remain most expensive at $7.42 million average cost (IBM)
- Healthcare breaches have been costliest for 14 consecutive years (IBM)
- Detection and escalation costs average $1.47 million per breach (IBM)
- 51% of breach costs are incurred in the first year following a data breach (IBM)
Time to Detect & Contain
- Average time to identify and contain a breach fell to 241 days in 2025, a nine-year low (IBM)
- Average time to identify a breach is 181 days (IBM)
- Organizations using AI detected and contained breaches 108 days faster than others (IBM)
- Breaches taking longer than 200 days to identify and contain cost $5.01 million on average (IBM)
- Breaches identified in under 200 days vs over 200 days show a $1.2 million cost difference (IBM)
- Organizations with AI-driven detection averaged 249 days from identification to containment vs 321 days without (IBM)
Breach Statistics & Trends
- Over 3,100 data compromises reported in the US in 2025, affecting over 1.35 billion individuals (Statista)
- 2024 saw 3,158 data compromises with 1.3 billion victim notices, a 211% increase in notices (ITRC)
- 78% of breaches in first half of 2025 resulted from cyberattacks (ITRC)
- 50% of breaches in 2025 were identified by organization’s own security teams, up from 42% in 2024 (IBM)
- Over half (53%) of all breaches involve customer PII (IBM)
- 72% of data breaches involved data stored in the cloud (IBM)
- 30% of breaches involved data distributed across multiple environments with average cost of $5.05 million (IBM)
- 33% of compromised records involved company intellectual property (IBM)
Attack Vectors
- 51% of breaches came from malicious or criminal attacks (IBM)
- Stolen credentials were used in 53% of data breaches (Verizon)
- 70% of breaches were caused by external actors (Verizon)
- 29% of breaches were caused by internal actors (Verizon)
- Phishing was the initial attack vector in 16% of all data breaches (Verizon)
- Third-party vendor and supply chain compromise was second most prevalent and second costliest at $4.91 million (Secureframe)
- 40% of breaches involved data stored across various platforms (IBM)
Human Factor
- 88% of cybersecurity breaches are caused by human error (Stanford)
- 68% of breaches involved a human element in 2025 (Verizon)
- 95% of cybersecurity problems involve the human factor (Various sources)
- Employee errors cause 88% of all organizational data breaches (Stanford University)
- Miscellaneous errors or innocent mistakes accounted for 12% of breaches (Verizon)
AI Impact on Cybersecurity Defense & Attacks
Note: All data compiled from authoritative cybersecurity reports including IBM Cost of a Data Breach Report 2025, Verizon DBIR 2025, Sophos State of Ransomware 2025, Rapid7, McKinsey, and other leading industry sources. Statistics represent the most current available data as of 2025.
Ransomware
Attack Prevalence
- 59% of organizations were hit by ransomware in 2023 (Sophos)
- 23% of data breaches involved ransomware (Verizon)
- 32% of all breaches now involve ransomware or digital extortion (Verizon)
- Ransomware present in 44% of all confirmed breaches in 2025 (Verizon)
- Roughly 7 in 10 global cyberattacks were ransomware in 2023, with over 317 million attempts (Statista)
- 92% of industries recognize ransomware as a primary threat (Verizon)
- Ransomware cases increased by 73% in 2023 (SANS Institute)
Financial Impact
- Average cost of ransomware/extortion breach is $5.08 million in 2025 (IBM)
- Global cost of ransomware projected to reach $275 billion annually by 2031 (Various sources)
- Total amount received by ransomware actors was $1.1 billion in 2023, up 140% from $457 million (Statista)
- Ransomware payments reached $813.55 million in 2024 (Chainalysis)
- Average ransomware insurance claim rose 68% to $353,000 (Coalition)
- Median ransom demand in 2025 was $1.32 million, down from $2 million in 2024 (Sophos)
- Median ransom payment in 2025 was $1 million, a 50% decrease from $2 million in 2024 (Sophos)
- Median ransom payment fell to $115,000 in 2025, down from $150,000 in 2024 (Verizon)
- Average ransom demand in US is $2 million in 2025 (Sophos)
- Average ransom payout in Q2 2025 doubled from one quarter before (Coveware/Veeam)
Payment Trends
- 37% of victims chose to pay ransom in 2025, down from 41% in 2024 (Sophos)
- 63% of organizations refused to pay ransom in 2025, up from 59% in 2024 (Sophos)
- 64% of organizations that experienced ransomware didn’t pay the ransom in 2025 (Verizon)
- 53% of organizations that paid ransoms negotiated a lower amount than initial demand (Sophos)
- 29% of ransom-paying organizations paid exactly the amount first demanded (Sophos)
- 18% of ransom-paying organizations ended up paying more than the original demand (Sophos)
- US organizations pay 91% of ransom demanded on average, vs 85% global average (Sophos)
- 47% of companies have a policy to pay ransoms associated with cybersecurity threats (Various sources)
Attack Characteristics
- 70% of ransomware attacks led to data encryption in 2024, down from 76% in 2023 (Various sources)
- 32% of attacks involving encryption also included data theft (Various sources)
- 54% of all ransomware infections begin with a phishing email (Verizon)
- Involving law enforcement in ransomware incidents can reduce breach costs by nearly $1 million (IBM)
- Organizations with over $5 billion in revenue experience a 67% ransomware attack rate (Various sources)
- 68% of healthcare officials claim to witness an average of two attacks per year (Various sources)
Recent Trends
- 92 disclosed ransomware attacks in January 2025, a 21% increase over 2024 (BlackFog)
- 32 different ransomware groups were behind attacks in January 2025 (BlackFog)
- FBI was aware of around 900 entities impacted by Play ransomware group as of May 2025 (Fortinet)
- Number of reported ransomware incidents in US increased 149% year-over-year in first five weeks of 2025 (Cyble)
- 65 ransomware groups were actively attacking in Q2 2025 (Rapid7)
- 96 unique ransomware groups operated in first half of 2025, a 41.18% increase over 68 in 1H 2024 (Rapid7)
Top Ransomware Groups Activity (Q2 2025)
Phishing
Attack Volume
- Estimated 3.4 billion phishing emails sent daily, accounting for 1.2% of global email traffic (Various sources)
- Anti-Phishing Working Group (APWG) recorded 1,003,924 phishing attacks in Q1 2025 (APWG)
- Phishing attacks increased 150% year-over-year from 2019 to 2022 (Various sources)
- Google blocks approximately 100 million phishing emails daily (Google)
- Internet Crime Complaint Center received 300,487 phishing reports in 2024, up 10x since 2018 (IC3)
- Phishing attacks increased 13% year-over-year in 2024 (Various sources)
- 91% of cyberattacks begin with a phishing email (Various sources)
- 45.56% of all emails sent globally were spam in Q1 2022 (Various sources)
Financial Impact
- Average cost of a phishing breach in 2024 was $4.88 million, up 9.7% from 2023 (IBM)
- Phishing attacks cost businesses $200,000 on average (Various sources)
- Phishing attacks cost large organizations $15 million annually, or more than $1,500 per employee (Various sources)
- Individual victims in US reported $245 million in phishing losses in 2021 (Various sources)
- Average phishing breach costs $4.8 million (Verizon)
- Globally, average cost of phishing-related breach is $4.88 million in 2025 (DeepStrike)
Attack Success & Methods
- 36% of all data breaches involve phishing (Verizon)
- Phishing accounted for 22.5% of all internet crimes in 2024 with $70 million in losses (FBI IC3)
- Phishing was most common method for delivering ransomware, responsible for 45% of attacks (Various sources)
- 83% of companies experienced phishing attacks in 2021 (Various sources)
- 91% of phishing attempts are delivered via email (IdentityTheft.org)
- Phishing makes up 57% of all social engineering incidents (Verizon)
- 54.9% of phishing emails contained a phishing hyperlink payload (KnowBe4)
- 20% of phishing relied solely on social engineering (KnowBe4)
- 57.9% of phishing emails were sent from compromised accounts (KnowBe4)
Business Email Compromise (BEC)
- FBI reported $2.77 billion in losses due to BEC in 2024 (FBI IC3)
- Verizon DBIR puts BEC losses at $6.3 billion in total reported losses (Verizon)
- BEC accounted for 27% of all incident response engagements (Verizon)
- Average requested wire transfer in Q4 2024 was $128,980 (APWG)
- BEC attacks resulted in $1.8 billion in losses in 2020 (Various sources)
- Average cost of BEC attack globally is $4.67 million (TechMagic)
- BEC attacks resulted in $2.9 billion in losses in US in 2023 alone (TechMagic)
- 13% increase in BEC attacks observed in February 2025 alone (TechMagic)
- 73% of BEC attacks originated from free webmail services (TechMagic)
AI-Powered Phishing
- Phishing attacks increased 4,151% since advent of generative AI (Hoxhunt)
- McKinsey reports 1,200% increase in phishing attacks since rise of generative AI in late 2022 (McKinsey)
- More than 95% of respondents believe dynamic content through LLMs makes detecting phishing more challenging (LastPass)
- AI now generates 40% of phishing emails targeting businesses (VIPRE Security Group)
- 86% of organizations have encountered at least one AI-related phishing incident (Various sources)
Mobile & Device Statistics
- Phishing attacks targeting mobile devices increased 25-40% compared to desktops in 2024 (Various sources)
- Users are 25-40% more likely to fall for phishing on mobile devices than desktops (Various sources)
Regional Data Breach Costs Comparison
Artificial Intelligence in Cybersecurity
AI as Threat
- 29% of security leaders cited AI, LLMs, and privacy issues as their number one concern, surpassing ransomware (Arctic Wolf)
- 78% of CISOs admit AI-powered cyber threats are having significant impact on their organization (Darktrace)
- 74% of IT security pros say AI-powered attacks pose significant threat to operations (Various sources)
- 93% of security leaders anticipate their organizations will face daily AI attacks by 2025 (Netacea)
- 16% of all breaches in 2025 involved attackers using AI (IBM)
- Among data breaches with AI attacks, 37% used phishing and 35% used deepfake attacks (IBM)
- Nearly 50% of respondents highlighted advance of adversarial capabilities as greatest concern regarding GenAI impact (Statista)
- 60% of respondents fear organizations are inadequately prepared to defend against AI-powered attacks (Darktrace)
AI Security Challenges
- 63% of breached organizations had no AI governance policy or were still developing one (IBM)
- 99% of organizations have sensitive data dangerously exposed to AI tools (Varonis)
- 98% of companies have unverified AI apps in their systems (Edgescan)
- 80% of data experts agree AI is making data security more challenging (Immuta)
- 77% of organizations find themselves unprepared to defend against AI threats (Wifitalents)
- Only 15% of stakeholders feel non-AI cybersecurity tools can detect and stop AI-generated threats (Darktrace)
- 83% of executives cite workforce limitations as barrier to securing AI systems (Accenture)
- Only 20% of organizations feel confident in their ability to secure generative AI models (Various sources)
AI for Defense
- 67% of organizations currently use AI as part of their cybersecurity strategy, with 31% relying on it extensively (IBM)
- 70% of cybersecurity professionals say AI proves highly effective for detecting threats previously unnoticed (Ponemon Institute)
- AI speeds detection and response times from days to minutes and hours to seconds (Various sources)
- AI improves threat detection by 60% (Various sources)
- 64% of organizations deploy AI for threat detection (Various sources)
- Organizations with AI security systems contained breaches 108 days faster with $1.76 million cost savings (IBM)
- Security AI reduced breach costs by 34% in 2025, saving $1.9M on average (IBM)
- Organizations with fully deployed AI threat detection contained breaches within 214 days vs 322 days for legacy systems (Ponemon Institute)
- IBM’s Threat Detection monitors over 150 billion security events daily using AI (IBM)
- 95% of security professionals anticipate AI cybersecurity tools will strengthen security efforts (Darktrace)
- 69% of enterprises believe AI is necessary for cybersecurity as threats increase (Various sources)
- 82% of IT decision-makers planned to invest in AI-driven cybersecurity (Blackberry)
AI Market Growth
- AI cybersecurity market will grow from $22.4 billion in 2023 to $60.6 billion by 2028 (MarketsandMarkets)
- AI cybersecurity market forecasted to reach $134 billion by 2030 (Statista)
- Value of global market for AI in cybersecurity expected to increase from $15 billion in 2021 to $135 billion in 2030 (Various sources)
- AI/ML tool usage skyrocketed 594.82%, rising from 521 million transactions in April 2023 to 3.1 billion monthly by January 2024 (Zscaler)
- Enterprises are blocking 18.5% of all AI/ML transactions, a 577% increase over nine months (Zscaler)
Deepfakes
- 47% of organizations have experienced deepfake attacks (iProov)
- 63% of cybersecurity leaders are concerned about AI and potential creation of deepfakes (Various sources)
- Only 71% of people globally know what a deepfake is (Various sources)
- Only 0.1% can consistently identify deepfakes (Various sources)
- 53% of financial professionals had experienced attempted deepfake scams as of 2024 (Various sources)
- 19% more deepfake incidents in first quarter of 2025 than in all of 2024 (Various sources)
- 77% of voters encountered AI deepfake content related to political candidates before 2024 US election (Various sources)
- Deepfakes responsible for 6.5% of all fraud attacks, a 2,137% increase from 2022 (Various sources)
Detection & Response Time Metrics
IoT (Internet of Things) Security
Device Growth & Market
- Global IoT ecosystem has surpassed 35 billion connected devices as of 2025 (CompareSSL)
- Estimated 18 billion IoT devices as of 2025 (Asimily)
- Projections suggest IoT will reach over 50 billion devices by 2030 (CompareSSL)
- IoT market reached estimated value of $714 billion in 2025, up from $595 billion in 2023 (IoT Breakthrough)
- 27 billion IoT devices now in use globally (Asimily)
Security Risks & Attacks
- One in three data breaches now involves an IoT device (Verizon)
- Average device risk score across top ten affected countries climbed from 6.53 in 2024 to 9.1 in 2025, a 33% rise (Forescout)
- More than 50% of IoT devices contain critical vulnerabilities that can be exploited right now (Asimily)
- 60% of IoT breaches come from unpatched firmware and outdated software (IoT Security Foundation)
- One in five IoT devices still uses default passwords (IoT World Congress)
- IoT security failures cost businesses average of $330,000 per incident (NIST)
- Average cost of IIoT breach in manufacturing reached $4.97 million in 2024 (DeviceAuthority)
- 78% of consumers say they’d stop using a company’s services after major IoT-related breach (IoT Security Foundation)
- Cyberattacks on industrial IoT increased 75% in past two years (Verizon)
- Cyberattacks on IoT networks lead to average of 6.5 hours of downtime per incident (CISA)
- Healthcare IoT device attacks increased 123% year over year (Statista)
- Average smart home could be at risk of more than 12,000 hacker attacks in one week (Purplesec)
- 58% of IoT attacks occurred with intent of mining cryptocurrency (Purplesec)
Botnet Activity
- Over 2.6 million IoT devices compromised in botnet attacks in first half of 2025 (CompareSSL)
- Mirai variants accounted for 61% of all IoT-based botnet activity (CompareSSL)
- BadBox 2.0 disclosed in July 2025 as largest known botnet of internet-connected TVs (Google/Human Security)
- “LapDogs” cyber-espionage campaign hijacked over 1,000 SOHO routers and IoT devices in 2025 (IoT Breakthrough)
IoT Security Market
- IoT Security Market estimated at $8.81 billion in 2025, expected to reach $37.41 billion by 2030 (Mordor Intelligence)
- By 2026, global spending on IoT security expected to exceed $32 billion (CompareSSL)
Regulations
- 48 countries have implemented national IoT security frameworks or laws as of mid-2025, up from 34 in 2023 (CompareSSL)
- 72 countries actively considering legislation or guidelines for IoT device manufacturers (CompareSSL)
- UK’s Product Security and Telecommunications Infrastructure Act took effect April 29, 2024 (Various sources)
Cybersecurity Workforce & Skills Gap Statistics
Data Sources: Statistics compiled from IBM Cost of a Data Breach Report 2025, Verizon DBIR 2025, CompTIA Cyberseek, Mastercard Global SMB Study, Arctic Wolf 2025 Trends Report, Monster, Ponemon Institute, and other leading cybersecurity research organizations.
Industry-Specific Statistics
Healthcare
- Healthcare industry is third-most attacked worldwide (VikingCloud)
- Ransomware attacks in healthcare growing by at least 25% (VikingCloud)
- 92% of US healthcare organizations experienced cyberattack in past year (Bright Defense)
- 17% of all attacks in 2024 were in healthcare (Huntress)
- Healthcare accounts for 10.6% of ransomware victims in Q2 2025 (Rapid7)
- Over 70% of US hospitals surveyed by HHS follow NIST cybersecurity protocols (VikingCloud)
- Costs incurred by data breaches in healthcare falling by 10.6% yearly (VikingCloud)
- 30% of most data breaches occur in large hospitals (Various sources)
Financial Services
- Financial services experienced 737 reported compromises in 2024, making it top-attacked industry (ITRC)
- Financial sector accounts for 35% of DOS attacks (Verizon)
- 74% of attacks in finance and insurance target customer personal details (Various sources)
- Social engineering accounted for 23% of breaches in finance (Verizon)
Manufacturing
- Manufacturing companies face average breach cost of $5.56 million per breach (IBM)
- Social engineering accounted for 22% of breaches in manufacturing (Verizon)
Education
- Education sector experienced 1,780 security incidents in 2024 with 1,537 confirmed data disclosures (Verizon)
- External actors behind 68% of education sector breaches (Verizon)
- Personal data compromised in 83% of education breaches (Verizon)
Government
- 11% of all reported attacks in 2024 were in government (Huntress)
Retail & Hospitality
- Accommodation and food services sector faced 220 security incidents in 2024, including 106 confirmed breaches (Verizon)
- 92% of accommodation breaches caused by system intrusions, social engineering, or web applications (Verizon)
Technology
- Technology accounts for 10.0% of ransomware victims in Q2 2025 (Rapid7)
Services
- Services industry was most targeted with 44.4% of ransomware posts in Q2 2025 (Rapid7)
Small Business vs Enterprise Security Comparison
Regional Statistics
United States
- United States accounts for 47% of ransomware attacks in 2023 (Various sources)
- US accounts for 66.0% of ransomware targets in Q2 2025 (Rapid7)
- California ranks second in healthcare data breaches with 22.6% of reported cases (Verizon)
Global Distribution
- UK accounts for 6.7% of ransomware targets in Q2 2025 (Rapid7)
- Canada accounts for 6.6% of ransomware targets (Rapid7)
- Germany accounts for 4.2% of ransomware targets (Rapid7)
- Italy accounts for 3.2% of ransomware targets (Rapid7)
- Netherlands targeted with highest volume of phishing attacks in 2022 at 17.7% (DMARC)
- 29.82% of spam emails sent from Russia in 2022 (Various sources)
- Mainland China is second most common source of malicious spam at 14% (Various sources)
- United States is third source of malicious spam at 10.71% (Various sources)
Most Targeted Attack Vectors & Entry Points
Workforce & Skills Gap
Talent Shortage
- 3.5 million unfilled cybersecurity jobs in 2023 (Cybersecurity Ventures)
- Over 514,000 cybersecurity-related job postings between May 2024 and April 2025, up from 470,000 prior year (CompTIA Cyberseek)
- Cybersecurity job growth anticipated to be 35% over next decade (Monster)
- 68% of organizations say staffing issues are top threat to achieving cybersecurity objectives (Arctic Wolf)
- 46% of companies had more than 10 unfilled cybersecurity roles in 2024 (Cisco)
- Security skills shortage increases breach costs by $173,400 on average (IBM)
- 50% of organizations using AI to compensate for cybersecurity skills gap (Ponemon Institute)
- Only 11% of organizations prioritizing increasing cybersecurity staff despite “insufficient personnel” being greatest inhibitor (Darktrace)
Compensation & Demographics
- Cybersecurity Security Specialists earn average of $102,677 (Monster)
- Women make up only 24% of cybersecurity workforce (Cybernews)
Training & Awareness
- 84% of US-based organizations conducting regular security awareness training has helped reduce phishing rates (Various sources)
- Phishing success rates can be reduced by up to 86% with right training programs (TechMagic)
- 67% of small and medium businesses say they lack in-house expertise to deal with data breach (Various sources)
- Only 14% of SMEs have cyber security plan in place (Various sources)
Small & Medium Business (SMB) Statistics
- 43% of all cyberattacks are aimed at small businesses (Various sources)
- 90% of all data breaches occur in small businesses (Various sources)
- Nearly one in five SMBs that suffered cyberattack filed for bankruptcy or closed (Mastercard)
- 80% of SMBs that suffered attacks had to spend time rebuilding trust with partners and clients (Mastercard)
- 43% of UK businesses experienced cybersecurity breach or attack in past year (UK Government)
- SMBs are being targeted nearly four times more than large organizations (Verizon)
- Average business interruption cost for SMEs hit by BEC is $487,000 (TechMagic)
Emerging Threats & Trends
Zero-Day Vulnerabilities
- 97 zero-day vulnerabilities exploited in 2023, with 48 linked to spyware vendors and 12 to China (Google Project Zero)
- 75 zero-day vulnerabilities identified in 2024 (Google Threat Intelligence Group)
Insider Threats
- 48% of businesses experienced frequent insider attacks in 2024 (Cybersecurity Insiders)
- Over 30,000 insider threat cases reported (ASEE)
- Ponemon Institute estimates average annual cost of insider threats at $17.4M (Ponemon Institute)
Social Engineering
- Social engineering present in 13 of 16 victim industries analyzed (Verizon)
- Over 4,000 incidents of social engineering attacks in 2025, with 85% having confirmed data disclosure (Verizon)
- 28% of confirmed data breaches involved social engineering (Verizon)
- Social engineering represents most prevalent form of cyberattack, reported by 56% of organizations (Ponemon Institute)
- 95% of social engineering attack motivation is financially driven (Various sources)
Cloud Security
- Cloud security breaches surged 35% compared to 2023 (Cloud Essentials)
- 78% of organizations reporting at least one cloud security incident (Cloud Essentials)
- Average cost of cloud breach reached $5.1 million (Cloud Essentials)
- 33% of cloud-related security incidents involve phishing with adversary-in-the-middle attacks (IBM X-Force)
Supply Chain
- Third-party involvement in breaches doubled compared to last year (Verizon)
- 11.4% of phishing attacks occurred within supply chain (KnowBe4)
Credential Theft
- Over 24 billion passwords exposed by hackers in 2022 (Norton)
- 64% of passwords contain only 8-11 characters (Norton)
- 88% of breaches within system intrusion pattern involved stolen credentials (Verizon)
- Only 46% of employees use different passwords for important accounts (Various sources)
Regulatory & Compliance
Breach Disclosure
- 52% of respondents confirmed breach in past year, up from 48% (Arctic Wolf)
- 97% of known breaches were disclosed (Arctic Wolf)
- Breach notification costs dropped nearly 10% in 2025, from $430k in 2024 to $390k (Secureframe)
Remote Work Impact
- Data breaches cost average of $131,000 more when remote work was factor (IBM)
- When remote work is factor, average cost per breach is $173,074 higher (IBM)
- 91% of cybersecurity professionals reported increase in cyberattacks due to remote working (Zipdo)
Zero Trust & Security Controls
- Organizations with zero-trust approach saw average breach costs $1.76 million less (Varonis)
- Organizations extensively using AI and automation reduced breach costs from $5.52M to $3.62M (IBM)
Attack Methods & Vectors
Most Common Attack Types
- Ransomware appeared in 23% of data breaches (Verizon)
- Privilege misuse occurred in 12% of data breaches (Verizon)
- Vulnerability exploitation appeared in 8% of data breaches (Verizon)
- Physical actions occurred in fewer than 5% of breaches (Verizon)
- Web application breaches account for 25% of all breaches (Verizon)
Attack Duration & Persistence
- Hackers typically retain access for nearly six months once they infiltrate a system (IBM)
- Companies identifying breaches 23 days faster than a few years ago (Various sources)
- 70% of organizations experienced at least one significant cyberattack in 2024 (Arctic Wolf)
- Likelihood that cybercrime entity is detected and prosecuted in US remains around 0.05% (World Economic Forum)
Specific Vulnerabilities
- One-third of full-stack applications contained critical or severe vulnerabilities (Edgescan)
- Over 45% of large enterprises leave unresolved vulnerabilities for more than a year (Edgescan)
Future Projections
- Ransomware or phishing attack projected to occur every 11 seconds by 2025 (Various sources)
- Ransomware attack projected to occur every two seconds by 2031 (Various sources)
- Global spending on security projected to reach $424.97 billion in 2030 (Fortune Business Insights)
- Cybersecurity spending projected to exceed $1.75 trillion cumulatively between 2021-2025 (Cybersecurity Ventures)
- 25% of companies using generative AI will launch agentic AI pilots in 2025, rising to 50% by 2027 (Deloitte)
- By 2026, 70% of boards will include at least one member with expertise in cybersecurity (Gartner)
- For every employee in 2025, there are up to 200 attack vectors cybercriminals could exploit (JumpCloud)
- Users and devices on pace to create 79 zettabytes of information in 2025 (JumpCloud)
This comprehensive list compiles cybersecurity statistics from leading industry reports and research organizations including IBM, Verizon, Gartner, Sophos, World Economic Forum, Fortinet, and numerous other authoritative sources. Data represents the most current available information as of 2025.
Conclusion
These cybersecurity statistics aren’t meant to scare you. Well, maybe a little.
The reality is that cyber attack trends show no signs of slowing down, and the cost of data breach statistics keeps climbing. Organizations that ignore threat intelligence data do so at their own peril.
What IBM Security and Check Point Research keep telling us is simple: invest now or pay later. Network security metrics prove that companies with strong security posture assessment fare better when (not if) attacks happen.
The malware infection rates and DDoS attack frequency we’ve covered should inform your security investment trends for next year. Your CFO might not love hearing about increased cybersecurity spending statistics, but show them the ransomware reports and watch their tune change.
Bottom line? Cyber crime reports from Cisco Security and Forrester security analysis confirm what security teams already know. The threat landscape overview isn’t getting friendlier, and your attack surface analysis better be comprehensive.
Start tracking these security incident statistics internally. Measure your own endpoint security data against industry benchmarks. Because the next breach notification report could have your company’s name on it.
Bogdan Sandu is a front-end developer at TMS Outsource with 8+ years of experience in web technologies. He writes about developer tools, software platforms, and web workflows based on daily hands-on use.
Latest posts by Bogdan Sandu (see all)
- Notepad++ Android Options: Apps That Come Close - October 21, 2026
- Data Management Services: A Practical Guide for Growing Companies - October 21, 2026
- MongoDB Cheat Sheet - October 20, 2026
