Cybersecurity Statistics 2026: Breach and Cost Data

Cybersecurity statistics for 2026 come with a sourcing problem the SERP never discloses: the two reports everyone cites were published fourteen months apart, cover different windows, and one of them is routinely relabeled with a year it does not carry. This page fixes that. Every figure below names its source, its publication date, and its data-collection window — and the numbers that failed our verification are printed in their own table, with the reasons we refused them.

The headline data is genuinely new. Verizon’s 2026 Data Breach Investigations Report, published May 19, 2026, recorded vulnerability exploitation overtaking stolen credentials as the number-one breach entry point for the first time in the report’s 19-year history. IBM’s latest Cost of a Data Breach Report — explicitly titled the 2025 edition, because no 2026 edition exists as of this writing — measured the first global breach-cost decline in five years, even as the US average hit a record $10.22 million.

This guide reconciles the two annuals into a single spine: how attackers get in (the DBIR’s mechanics data), what it costs once they are in (IBM’s economics data), the AI-related-incident cut that neither report existed to measure two years ago, a verified-versus-recycled trust table, and the zombie statistics we traced back to their original publication dates. Strictly defensive, strictly statistics.

Nearly every credible number in the “cybersecurity statistics” genre descends from two annuals. Verizon’s Data Breach Investigations Report measures breach mechanics — how attackers actually get in — from one of the largest incident datasets published anywhere: the 2026 edition analyzed more than 31,000 security incidents and 22,000+ confirmed data breaches across 145 countries, nearly double the prior edition’s 12,195 confirmed breaches. IBM’s Cost of a Data Breach Report, conducted by Ponemon Institute across 600 organizations, measures breach economics — what the intrusion costs once it has happened. The two are rarely read together, which is the gap this page closes.

The dates matter more than the titles. The 2026 DBIR’s incident data covers November 1, 2024 through October 31, 2025 — the title year never matches the collection window, a pattern every DBIR edition follows and one that routinely trips up sites labeling it “2026 data.” IBM’s situation is stranger: its most recent report is explicitly titled “Cost of a Data Breach Report 2025,” was published July 30, 2025, and remains the latest edition as of this post’s July 2026 publication. Any page citing “IBM’s 2026 breach-cost report” is citing a report that does not exist.

The single most significant finding in the 2026 DBIR is a changing-of-the-guard statistic: vulnerability exploitation now starts 31% of breaches, overtaking stolen credentials as the top initial-access vector for the first time in the report’s 19-year history. Credential abuse fell to 13% — meaning unpatched software now opens well over twice as many doors as stolen passwords. For a decade, the defensive consensus was “credentials are the crown jewels.” The current data says the crown jewels are your patch queue.

The patching side of that equation is deteriorating. The DBIR’s analysis puts it plainly: “Our new median time is 43 days, almost two weeks longer than last year’s 32 days” — a 34% increase in median time-to-patch, as reported in SecurityWeek’s coverage of the report. Worse, only 26% of vulnerabilities on CISA’s Known Exploited Vulnerabilities catalogue — the list of flaws confirmed to be under active attack — were fully remediated during the reporting window, down from 38% the prior year. Attackers are speeding up while remediation slows down; the report’s own language warns that “the rapid weaponization of known vulnerabilities by AI can create a capacity crisis for security teams.”

The supply chain amplifies everything. Third-party involvement appeared in 48% of breaches — a 60% year-over-year jump. And follow-through is poor even after problems are found: only 23% of third-party organizations fully remediated missing or improperly secured MFA after being flagged. Nearly half of the breach problem now lives in vendors, partners, and platforms a security team does not directly control.

The ransomware numbers show a market that is maturing on the defender side even as attack volume grows. Ransomware was present in 48% of confirmed breaches, up from 44% — in the report’s own words, “Ransomware grew again to 48% of all breaches, up from 44% from the previous year.” But the economics are shifting: the median ransom payment stayed below $140,000, and only about 31% of victims paid at all — meaning 69% refused. The DBIR also draws a direct causal line worth internalizing: 50% of ransomware victims had a credential-theft or infostealer event within the 95 days before the ransomware hit. Ransomware is rarely the first compromise; it is the monetization step of an intrusion that started weeks earlier.

Two human-side numbers round out the anatomy. The human element was present in 62% of breaches — up slightly from 60%, and a figure worth holding onto for Section 06, where it retires a much-recycled “95%” claim. And mobile social engineering succeeds 40% more often than equivalent email-based phishing, per SecurityWeek’s coverage — the attack surface has followed attention onto the phone, the same shift documented in our coverage of AI-driven email-compromise attacks.

Edition disclosure first, numbers second: everything in this section comes from IBM’s Cost of a Data Breach Report 2025 — published July 30, 2025, conducted by Ponemon Institute across 600 organizations, covering breaches from March 2024 through February 2025, and still the latest edition as of this post’s July 2026 publication. With that stated plainly, the headline is a genuine inflection: the global average breach cost fell to $4.44 million, down 9% from $4.88 million — the first year-over-year decline in five years.

The decline was not evenly distributed. The US average moved the opposite direction, hitting $10.22 million — a record high and 2.3x the global average. And the cost drop arrived in the same edition as a speed record: the global breach lifecycle — time to identify plus time to contain — averaged 241 days, a nine-year low, split roughly 181 days to identify and 60 days to contain. Faster containment and cheaper breaches moving together is the pattern the report’s framing emphasizes; the expensive part of a breach is the months nobody knows it is happening.

Two cost levers stand out in coverage of the report, both worth a sourcing note: they are corroborated via secondary coverage of the IBM 2025 report rather than a directly linkable primary page, so treat them as IBM-attributed and directional. First, organizations making extensive use of security AI and automation shortened their breach lifecycle by roughly a further 80 days on average. Second, organizations that detected the breach themselves — rather than being told by the attacker or a third party — saved on the order of $900,000 per breach. Detection capability, not response heroics, is where the money is.

The most uncomfortable number in the edition is about what happens after: only 49% of breached organizations planned to increase security investment following their breach, down from 63% in the prior edition. Read against a record US cost figure, that is a measurable signal of breach fatigue — organizations absorbing eight-figure incidents without changing the budget line that produced them. Healthcare illustrates the compounding risk: costliest sector for the 15th consecutive year at $7.42 million average (down from $9.77 million), with the longest identify-and-contain cycle at 279 days.

For the first time, both annuals carry a measurable AI-incident cut — and the numbers describe the same gap from two directions. On the economics side, IBM’s 2025 edition found that 13% of organizations reported a breach of an AI model or AI application, with another 8% unsure whether AI was the compromise vector. Of the organizations that suffered an AI-related breach, 97% lacked proper AI access controls. The downstream damage was concrete: 60% of AI-related incidents resulted in data compromise, and 31% caused operational disruption. We covered the agentic-systems slice of this same finding in our AI agent breach-rate analysis.

The governance side is where the gap widens into a chasm: 63% of breached organizations either lack AI governance policies entirely or are still developing them, and among organizations that do have policies, only 34% perform regular audits for unsanctioned AI use. The cost premium is already measurable — breaches with a high level of shadow-AI involvement averaged $4.63 million, about $670,000 more than breaches without significant shadow-AI exposure, and shadow AI was implicated in roughly one in five breaches in the study, per analysis of the report cross-checked against IBM’s own release.

The DBIR’s employee-side data completes the picture — and here a precision note matters, because two different shadow-AI metrics circulate from the same report and are routinely merged into one false number. The first metric is adoption: 45% of employees are now regular users of unapproved “shadow AI” tools, up from roughly 15% the prior edition — a tripling of the user base. The second, separate metric is incidents: secondary coverage of the same report describes a fourfold increase in shadow-AI incidents as an insider-action category, now the third most common non-malicious insider action in the DBIR dataset. Adoption tripled; the incident count grew fourfold; they measure different things and should never be quoted as a single figure.

Visibility makes the problem structural: 67% of employees who use AI services at work do so on corporate devices but through non-corporate accounts — traffic security teams cannot see, let alone govern. And attackers are not waiting for governance to catch up. The DBIR found the median malicious actor used AI assistance across 15 distinct MITRE ATT&CK techniques during an attack chain, with extreme cases querying AI for 40 to 50 techniques — a co-developer across the full attack lifecycle. For a concrete, dated case study of what an AI-provider compromise looks like from the inside, see our analysis of the enterprise AI security incidents disclosed earlier this year.

The forward projection writes itself, with one caveat. IBM’s data window closed in February 2025 and the DBIR’s in October 2025 — which means neither annual has yet measured a full year of the 45%-adoption era it describes. If the access-control gap (97%) and the governance gap (63%) persist into the next editions, the 13% AI-breach rate is best read as a floor, not a peak. That is a projection, not a measurement — but it is the direction every number on this page points.

This is the table we could not find on any competing “cybersecurity statistics 2026” page. Most roundups cite the same headline numbers with no publication date, no data window, and no edition year — which is how a 2016 projection and a 2014 measurement still headline pages a decade later. Every major statistic used in this post is listed below with its true source, its true edition, and its data-collection window, so you can cite any row — or check our work.

The pattern the table exposes is specific to this genre: security statistics do not die, they get relabeled. A projection made in 2016 becomes “2026 data” by surviving long enough. A 2025-titled report becomes “IBM’s 2026 report” because the roundup was written in 2026. The fix costs one sentence per statistic — name the report, name the edition, name the window — and it is the entire editorial method of this page. If a security vendor, a conference deck, or a budget memo hands you a number without those three fields, the number is unverified by definition.

Every statistics page silently omits numbers it does not trust. We think the omissions are the story. The three claims below rank on the first page of search results for cybersecurity statistics, and each one failed verification in a specific, checkable way — either the number is a decade old, its own publisher has superseded it, or it is a real figure wearing a fabricated year. If you have cited one of these, this is the section to bookmark.

The “95% human error” retirement deserves the full receipt, because it is the most durable zombie in the genre. The figure traces to IBM’s 2014 Cyber Security Intelligence Index — a twelve-year-old measurement — and got a second life when the World Economic Forum’s 2022 Global Risks Report recirculated it. The current, annually re-measured equivalent is the DBIR’s human element figure: 62% in the 2026 edition, up slightly from 60%. That is still a majority — the human layer matters — but it is 33 percentage points below the recycled claim, and the gap changes the defensive conclusion: a 95% figure says train harder; a 62% figure alongside a 31% vulnerability-entry rate says patch faster.

Read together, the two annuals produce an unusually clear priority list — each move below is anchored to a specific measured gap, not a vendor pitch. The through-line: the 2026 breach problem is a discipline problem (patching, MFA follow-through, access controls) more than a tooling problem.

Defense is also a measurement discipline. The organizations that spot intrusions internally are the ones instrumenting their systems well enough to notice anomalies — the same telemetry foundations our analytics engagements build for marketing and product data, applied to a different threat model. And if the AI-governance rows above describe your organization — adoption running ahead of access controls — that inventory-and-controls work is the operational core of our AI transformation engagements: governance first, tooling second. For the adjacent fraud surfaces this post deliberately does not cover, our deepfake and fraud-detection statistics companion page applies the same named-and-dated sourcing standard, and the payment fraud and chargeback prevention playbook covers the transaction layer.