Global cyber attacks continue to rise, with the average number of cyber attacks per organization per week reaching 1,876 in the fourth quarter of 2024. This is a staggering 75% year-over-year increase.

As the number of attacks rises, the costs of these attacks rise as well. Cybercrime losses are expected to continuously increase, reaching $15.63 trillion by 2029.

Understanding the evolving threat landscape can help you protect your organization from costly attacks and recovery. 

We’ve compiled a list of over 200 cybersecurity statistics that underscore the importance of a strong risk management program and security posture, particularly for small businesses and the health industry. Read to learn about cybercrime trends, recent attacks, and evolving threats. 

Cybercrime statistics 

Individuals and organizations are increasingly exposed to cybercrime. Take a look at these statistics to get a better sense of the global impact of cybercrime. 

1. An international team of researchers compiled the first ever ‘World Cybercrime Index’ in 2024, which ranks the most significant sources of cybercrime at a national level. Russia tops the list, followed by Ukraine, China, the USA, Nigeria, and Romania. (University of Oxford)

2. Russian-speaking cybercriminals dominate the global ransomware industry, with an estimated 75% of ransomware revenue going to actors linked to the Russian-language underground. (Global Initiative)

3. Three-quarters of consumers have had their personal information lost or stolen in some form of cybercrime. (Triple-I and HSB)

4. In 2024, the United States Internet Crime Complaint Center (IC3) received 859,532 complaints of suspected internet crime with reported losses exceeding $16 billion—a 33% increase in losses from 2023. (FBI)

5. The top three cyber crimes in the US, by number of complaints reported by victims in 2024 to IC3, were:

• phishing/spoofing
• extortion
• and personal data breaches. (FBI)

6. Phishing/spoofing was the top cyber crime reported to the IC3, making up 193,407 complaints. This was 23% of all complaints. (FBI)

7. Victims of investment fraud, specifically those involving cryptocurrency, reported the most losses to IC3—totaling over $6.5 billion. (FBI)

8. As a group, people over the age of 60 suffered the most losses at nearly $5 billion and submitted the greatest number of complaints to IC3 at 147,127 complaints. This is a 43% increase in losses and 46% increase in number of complaints compared to 2023. (FBI)

9. UK businesses who were victims of cyber crime experienced an average of 30 cyber crimes of any kind in the last 12 months (UK Government)

10. In the UK Government's study, the larger the business, the more likely they were to experience cyber crime:

• 18% of micro businesses
• 25% of small businesses
• 43% of medium businesses
• 52% of large businesses. (UK Government)

11. Investment fraud made up roughly 37% of all money lost in reported complaints in 2023, amounting to $4.57 billion. (Statista)

12. Personal data breaches was another fraud vector associated with significant losses in 2023, amounting to $744 million. (Statista)

13. The most common type of cyber crime reported to IC3 in 2023 was phishing and spoofing, affecting approximately 298 thousand individuals. (Statista)

14. Individuals over the age of 60 accounted for the highest number of recorded cyber crime victims in the United States in 2023, with more than 104,068 complaints. The second-most targeted were individuals between 30 and 39 years, with over 88 thousand complaints. (Statista)

15. Global cybercrime is predicted to cost the world over $10 trillion annually by 2025. (Cybersecurity Ventures)

16. If cybercrime were measured as a country, it would be the world’s third-largest economy. (Cybersecurity Ventures)

17. The estimated cost of cybercrime worldwide has increased for eleven consecutive years an is estimated to reach 15.63 trillion U.S. dollars and therefore a new peak in 2029.(Statista)

18. Cybercrime and other acts of sabotage have cost German companies around 267 billion euros ($298 billion) in the past year, up 29% on the year before. (Reuters)

19. Bitkom surveyed around 1,000 companies from all sectors and found that 90% expect more cyberattacks in the next 12 months, with the remaining 10% expecting the same level of attacks. (Reuters)

Cyber risk statistics

As threat actors become more sophisticated and organizations’ attack surfaces continue to increase, managing cyber risk poses a growing challenge for organizations. Read on to find out how organizations are thinking about cyber risk. 

20. 75% of C-suite executives consider cybersecurity a moderate or serious risk, making it the biggest overall concern among potential business risks. (PwC)

21. Although executives acknowledge the importance of measuring cyber risk, fewer than half do so effectively, with only 15% measuring the financial impact of cyber risks to a significant extent. (PwC)

22. As the complexity of IT environments continues to rise, organizations are integrating a greater number of cybersecurity solutions to manage risk. On average, enterprises already have 53 security solutions in use across their organization. 21% report more than 76 solutions in their cyber stack. (Pentera)

23. Organizations are most concerned with the following cyber threats over the next 12 months:

• Cloud-related threats (42%)
• Hack-and-leak operations (38%)
• Third-party breach (35%)
• Attacks on connected products (33%). (PwC)

24. These are also the top cyber threats they feel least prepared to address:

• Cloud-related threats (34%)
• Hack-and-leak operations (25%)
• Third-party breach (28%)
• Attacks on connected products (31%). (PwC)

25. 72% of leaders report an increase in organizational cyber risks, with ransomware remaining a top concern. (World Economic Forum)

26. Cyber-enabled fraud ranks as the second-highest organizational cyber risk for 2025, viewed by CEOs as a significant threat alongside ransomware and supply chain disruptions. (World Economic Forum)

27. 37% of US businesses state that managing third party vendor risk is the biggest data security challenge they currently face. (ISMS.online)

28. Two-thirds (64%) of respondents admit supply chain information security risks are becoming more common. (ISMS.online)

29. The vast majority (79%) of information security professionals we spoke to admit that theoretical risk has translated into at last one material supply chain security incident over the past 12 months. (ISMS.online)

30. Compliance with regulations and industry standards was the second top information security challenge cited by respondents (33%). (ISMS.online)

31. Business continuity (67%) and reputational damage (65%) concern organization leaders more than any other cyber risk. (World Economic Forum)

32. 43% of CISOs who reported a breach reported unplanned downtime as a result, making business continuity the biggest risk of a cyber attack. (Pentera)

33. Partner data (41%) is cited by more of our respondents than any other as being compromised in the past 12 months – highlighting the persistent risks posed by suppliers. (ISMS.online)

34. 78% of organization leaders agree that cyber and privacy regulations are effective in reducing their organizations’ cyber risks in 2025, up from 74% in 2023. (World Economic Forum)

Cybersecurity insider threat statistics 

The largest cybersecurity risk for most businesses is people, not technology. Learn about the cost and impact of insider threat and how organizations are responding. 

49. 74% of organizations say they are moderately to extremely vulnerable to insider threats. (Cybersecurity Insiders)

50. 83% of organizations reported insider attacks in 2024, an increase from 60% in 2023. (Gurucul)

51. 74% of organizations say insider attacks have become more frequent. (Cybersecurity Insiders)

52. The number of organizations experiencing six to 10 insider attacks in the year doubled from 13% in 2023 to 25% in 2024. (Gurucul)

53. More than half of organizations have experienced an insider threat in the last year. 8% of organizations have experienced more than 20 in the last year. (Cybersecurity Insiders)

54. 76% of organizations attribute growing business and IT complexity as the main drivers for increased insider risk. (Gurucul)

55. While 76% of organizations have detected increased insider threat activity over the past five years, less than 30% believe they are equipped with the right tools to handle them. (Securonix)

56. 52% of organizations reveal they do not have the tools to confidently handle insider threats today. (Gurucul)

57. 70% of organizations attribute either technical challenges or cost as the primary obstacles preventing them from implementing effective insider threat management. (Gurucul)

58. When cybersecurity professionals were asked to prioritize the most critical effects of insider attacks, the top three answers were:

• Loss of critical data (45%)
• Brand damage (43%)
• Operational disruption or outage (41%). (Cybersecurity Insiders)

59. 22% of cybersecurity professionals said non-compliance with regulations was one of the most critical effects of insider threat at their organization. (Cybersecurity Insiders)

60. 68% of cybersecurity professionals are concerned or very concerned about insider risk as their organizations return to the office or transition to hybrid work. (Cybersecurity Insiders)

61. 90% of cybersecurity professionals said it is equally or more challenging to detect and prevent insider attacks compared to external cyber attacks. (Securonix)

62. When asked what type of insider threat they’re most concerned about, 71% of cybersecurity professionals said compromised accounts/machines, followed by inadvertent data breaches/leaks (66%) and negligent data breaches (64%). (Cybersecurity Insiders)

63. 69% of employees have bypassed their organization’s cybersecurity guidance in the past 12 months. (Gartner)

64. 74% of employees say they would be willing to bypass cybersecurity guidance if it helped them or their team achieve a business objective. (Gartner)

65. Over 90% of employees who admitted undertaking a range of unsecure actions during work activities knew that their actions would increase risk to the organization but did so anyway. (Gartner)

66. While 66% of organizations feel vulnerable to insider attacks, 41% of organizations have only partially implemented insider threat programs, pointing to a lack of comprehensive activity monitoring and advanced threat management. (Securonix)

67. Half of medium to large enterprises are expected to adopt formal programs to manage insider risk by 2025, up from 10% today. (Gartner)

68. 39% of organizations already have an insider threat program established. (Cybersecurity Insiders)

69. 46% of organizations are planning on establishing an insider threat program, but the time period ranges. 13% said within the next six months or year, respectively. 15% said within two years and 5% said in more than two years. (Cybersecurity Insiders)

70. 56% of insider-related incidents experienced by organizations in a 12-month study conducted by Ponemon Institute were due to negligence, and the average annual cost to remediate the incident was $6.6 million. (Proofpoint and Ponemon Institute)

71. On average, organizations are spending a total of $15.38 million on activities to resolve insider threats over a 12-month period. (Proofpoint and Ponemon Institute)

72. 53% of cybersecurity professionals say detecting insider attacks has become somewhat to significantly harder in the cloud. (Cybersecurity Insiders)

Cybersecurity attacks statistics 

Cyber attacks continue to dominate headlines. Learn what types of attacks your organization should expect and prepare for. 

73. 91 % of business and cyber leaders say they believe a far-reaching and catastrophic cyber event is “at least somewhat likely in the next two years” due to global geopolitical instability. (World Economic Forum)

74. For the fourth year in a row, cyber attacks were reported as the number one cause of outages across organizations. (Veeam)

75. Cyberattacks continue to rise, with 38% of surveyed organizations experiencing an increase compared to the previous year. (ISACA)

76. 43% of UK businesses reported a cyber incident or data breach in 2025, compared to 50% in 2024. (UK Government)

77. Around a third of charities (30%) report having experienced some form of cyber security breach or attack in the last 12 months. (UK Government)

78. The UK government's annual report found that large businesses were most likely to be hit (74%), followed by medium-sized (67%) small businesses (42%), and micro businesses (35%). (UK Government)

79. Over nine in 10 UK businesses (92%) that experienced an attack or breach said they were able to restore their operations within 24 hours of the incident. (UK Government)

80. On average, it's estimated that the single most disruptive breach from the last 12 months cost each UK business, of any size, approximately £1,600, up from £1,205 in last year's report. For medium and large businesses, this was more than double, at approximately £3,350. (UK Government)

81. The risk of extreme losses from cyber incidents is increasing, with the size of these extreme losses more than quadrupling since 2017 to $2.5 billion. Indirect losses like reputational damage or security upgrades are also substantially higher. (International Monetary Fund)

82. The financial sector has suffered more than 20,000 cyber attacks, causing $12 billion in losses, over the past twenty years. (International Monetary Fund)

83. 75% of software supply chains have experienced cyberattacks in the last 12 months. (Blackberry)

84. Almost three-quarters (74 percent) of attacks originated from members of the software supply chain that companies were unaware of or did not monitor before the breach. (Blackberry)

85. The consequences of supply chain attacks are significant, affecting businesses in multiple ways, including:

• Financial loss (64%)
• Data loss (59%)
• Reputational damage (58%)
• Operational impact (55%). (Blackberry)

86. Slightly more than half of organizations (51 percent) were able to recover from a software supply chain attack within a week. However, nearly 40 percent of companies took a month to recover. (Blackberry)

87. 10% of business leaders and 13% of cyber leaders feel that they are missing critical people and skills needed to respond to and recover from a cyberattack. (World Economic Forum)

88. More than two-thirds of organizations are vulnerable to sophisticated cyberattacks and breaches due to a lack of critical skills. (World Economic Forum)

89. Gartner predicts that by 2025, lack of talent or human failure will be responsible for over half of significant cyber incidents. (Gartner)

90. 53% of enterprises report decreasing or stagnating IT security budgets for 2024. This is a major departure from the 2023 outlook in which 92% of enterprises projected an increase in their IT security budgets. (Pentera)

91. When asked about how much they spend on their security in 2023, respondents reported an average budget of $1.27M for IT security. (Pentera)

92. More than a third (39%) said financial allocations for securing supply chain and third-party vendor connections are set to increase by up to 25% in the coming year. (ISMS.online)

93. Ransomware attacks hit an all-time high in March 2023, with 459 recorded attacks.This represents a 91% month-over-month increase and a 62% year-over-year increase. (NCC Group)

94. In a 12-month study by Microsoft, 76% of organizations which suffered ransomware attacks lacked an effective response plan, preventing proper organizational crisis readiness and negatively impacting time to respond and recover. (Microsoft Digital Defense Report)

95. IC3 received more than 4,800 complaints in 2024 from organizations belonging to a critical infrastructure sector that were affected by a cyber threat. The most reported cyber threat among these organizations was ransomware. (FBI)

96. In Q1 2024, the manufacturing sector was most impacted globally by ransomware attacks, accounting for 29% of published attacks and having almost double the amount of reported attacks YoY. (Checkpoint Research)

97. 35% of US businesses have experienced a deepfake security incident in the last 12 months, ranking the second most common cybersecurity incident in the country. (ISMS.online)

98. In 2024, there was a sharp increase in phishing and social engineering attacks, with 42% of organizations reporting such incidents. (World Economic Forum)

99. Phishing messages were the cause of most cyber-attacks against UK businesses at 85%. (UK Government)

100. Phishing remains the primary method used by attackers to gain initial access to networks, with over 2.6 billion interactions detected by Comcast Business. (Comcast)

Cybersecurity breaches statistics 

As cyber attacks rise, so do the number of attacks resulting in data being lost or compromised. Find out what the leading causes of data breaches are. 

101. In Pentera’s State Of Pentesting 2024 Survey Report, 51% of enterprises reported a breach in the past 24 months. (Pentera)

102. 93% of CISOs who reported a breach cited an impact on the confidentiality, integrity, and/or availability of their IT environment, while only 7% reported no significant impact as a result of the breach. (Pentera)

103. 70% of UK businesses have received fines for data breaches in excess of £100,00 in the last 12 months. (ISMS.online)

104. The proportion of businesses that have experienced a data breach of more than USD $1M has increased significantly, from 27% in 2023 to 36% in 2024. (PwC)

105. As company size increases, so does the average cost of their most damaging breach. Companies with more than $10 billion report breaches of $7.2 million while those companies with less than $1 billion report $1.9 million in damages.  (PwC)

106. The average cost of a data breach reached an all-time high of $4.88 million in 2025, a 10% increase from 2023. (IBM)

107. Data breaches involving stolen or compromised credentials took the longest to identify and contain of any attack vector at 292 days. (IBM)

108. As of 2024, the average cost of a data breach in the United States amounted to 9.36 million U.S. dollars. (Statista)

109. The global average cost per data breach was 4.88 million U.S. dollars in 2024, an increase from 4.45 million U.S. dollars in the previous year. (Statista)

110. According to the Cybernews Business Digital Index, most trusted companies from various sectors in the US have low cybersecurity standards. 94% of businesses from the analyzed list scored D or worse for their cybersecurity efforts and aall analyzed companies had experienced a data breach. One in four had been breached within the past 30 days. (Cybernews)

111. In an analysis of approximately 24,000 security incidents, more than 5,000 of which were confirmed data breaches, nearly three out of four breaches (73%) were attributed to external sources. (Verizon)

112. ​​External actors are consistently more likely to cause data breaches than internal actors, with 80% of breaches being caused by external actors in an analysis by Verizon. (Verizon)

113. 54% of organizations reported experiencing a data breach caused by one of their third parties in the last 12 months. (RiskRecon and Ponemon Institute)

Healthcare cybersecurity statistics 

Healthcare is one of the most targeted industries by threat actors. Take a look at some of the most prevalent threats against this sector below. 

114. In 2024, healthcare data breaches reached an all-time high, with 276,775,457 records compromised – a 64.1% increase from the previous year’s record and equivalent to 81.38% of the United States population. (Cybernews)

115. 79% of the 100 largest US hospitals and health systems scored D or worse for their cybersecurity efforts, according to the data presented by Cybernews Business Digital Index. (Cybernews)

116. 30% of the 100 largest US hospitals and health systems have critical vulnerabilities, and 65% have had recent data breaches. (Cybernews)

117. 92% of US healthcare organizations surveyed experienced at least one cyber attack in the past 12 month, with almost 70% reporting disruption to patient care due to cyber attacks. (Proofpoint and Ponemon Institute)

118. 68% of respondents said their organizations had an attack against their supply chains in the past two years and 82% said it disrupted patient care, an increase from 77% in 2023. (Proofpoint and Ponemon Institute)

119. The global average cost of a damaging cyber-attack was reported to be $4.4 million, while in the healthcare sector that cost was 25% higher at $5.3 million. (PwC)

120. Nearly half (47%) of all healthcare organization’s respondents reported a data breach of $1M or greater. (PwC)

121. 54% of healthcare IT and security practitioners believe their organizations are vulnerable or highly vulnerable to a ransomware attack. (Proofpoint and Ponemon Institute)

122. 92% of organizations suffered a data loss incident at least twice in the past two years. Around half impacted patient care, and of those, 50% experienced increased mortality rates and 37% saw poorer outcomes due to delays to procedures or tests. (Proofpoint and Ponemon Institute)

123. On average, surveyed organizations experienced 20 data loss and exfiltration incidents in the past two years with employees the root cause. The top three reasons were:

• Not following security policies (31%)
• Accidental data loss (26%)
• Staff sending sensitive information to unintended recipients (21%). (Proofpoint and Ponemon Institute)

124. Email compromise (37%) and ransomware (34%) were the two most common incident types targeting the healthcare industry in 2023 according to Kroll researchers. (Kroll)

125. 64% of healthcare organizations are concerned about medical device security, but only 51% include them in their cybersecurity strategy. (Proofpoint and Ponemon Institute)

126. 53% of healthcare IT and security practitioners said a lack of in-house expertise is a challenge and 46% said they lack sufficient staffing, both of which negatively affect their cybersecurity posture. (Proofpoint and Ponemon Institute)

127. Healthcare is the most likely industry to self-report as having very mature security. Only 3% of healthcare respondents said that they do not trust their organization’s ability to defend against most cyberattacks. (Kroll)

128. 49% of healthcare respondents rated their overall cybersecurity as very mature, more than any other sector and 16 percentage points higher than the survey average. (Kroll)

129. Despite having above-average confidence, 26% of healthcare businesses rank as having low cyber maturity, and healthcare performs badly in comparison to other sectors that scored highly for self-reported security. This reflects a worrying disconnect between how mature organizations believe they are and how mature they really are. (Kroll)

130. When responding to a cyberattack, lost productivity is the highest cost incurred by health care organizations, averaging $1.1 million. (Proofpoint and Ponemon Institute)

131. When asked about top cybersecurity investment priorities over the next 12 months, 42% of business leaders said ongoing improvements in risk posture based on cyber roadmap. (PwC)

Small business cybersecurity statistics

Small businesses are also a common target for threat actors. Find out about common cybersecurity trends, attitudes, and behaviors for this type of business below. 

132. Over 80% of US small businesses have suffered a data or security breach. (Identity Theft Resource Center)

133. Organizations with fewer than 500 employees that suffered a data or security breach in the past year increased 8% year over year and average financial losses also more than doubled annually to $500,000. (Identity Theft Resource Center)

134. Despite the increase in frequency and costs of breaches, 80% of small businesses are taking steps to prevent future breaches, including:

• providing staff training (88%)
• investing in security tools (65%)
• and increasing their security budget (67%).(Identity Theft Resource Center)

135. 60% of small businesses say they are concerned about cybersecurity threats. (U.S. Chamber of Commerce)

136. 27% of small businesses say they are one disaster or threat away from shutting down their business. (U.S. Chamber of Commerce)

137. According to 71% of cyber leaders at the Annual Meeting on Cybersecurity 2024, small organizations have already reached a critical tipping point where they can no longer effectively secure themselves against the escalating complexity of cyber risks. (World Economic Forum)

138. Small business owners vastly underestimate the cost of recovery following an attack. While 81% believe an attack on their business would cost less than $5K in damages and recovery costs, the average cyber claim for a small business costs $18,000-21,000. (Nationwide)

139. 90% of small and medium-sized enterprises (SMEs) that experienced a serious incident said the cyberattack cost them more than they thought it would. (Cowbell)

140. Cyber attacks cost US small businesses over $8,000 annually. (Hiscox)

141. US small businesses paid over $16,000 in ransoms over the past 12 months. For businesses who paid ransoms, only half (50%) recovered all their data and half (50%) were forced to rebuild systems. Over a quarter of businesses (27%) who paid ransoms were attacked again and 27% went on to be asked for more money by the attacker. (Hiscox)

142. Small business owners also underestimate duration of recovery following an attack. 22% believe they’d be back up and running in a month or less, but the time for recovery can be as long as 75 days. (Nationwide)

143. 81% of the SMEs that experienced a cyber incident say they saw a widespread drop in customer trust. (Cowbell)

144. Nearly a quarter (23%) of small business owners report their business has been a victim to a cyberattack and the vast majority say it jeopardized their company finances and had a moderate or major impact on their customers’ trust. (Nationwide)

145. Businesses with revenues of $100,000 to $500,000 can now expect as many cyber attacks as those earning $1 million to $9 million annually. (Hiscox)

146. Only 55% of SME leaders feel highly confident they’re prepared for a cyberattack. (Cowbell)

147. Two-thirds of small business owners (66%) are confident in their business’s ability to recover from an attack. (Nationwide)

148. SMEs with a cybersecurity strategy were nearly 2x more likely to recover quickly from a cyberattack compared to those without a cybersecurity strategy. (Cowbell)

149. Small business owners are getting smarter, but so are cybercriminals. Although 63% of small businesses in the US are cyber intermediates and 4% are cyber experts when it comes to defending against and avoiding cyber incidents, almost half (41%) have experienced a cyber attack during the past year. (Hiscox)

150. Smaller organizations with fewer than 1,000 employees were less likely to report incidents where they were negatively affected by a cyber incident originating from their suppliers, service providers or business partners (25%) than larger organizations with more than 1,000 employees (39%). (World Economic Forum)

151. 41% of small businesses surveyed do not use data backup recovery and restoration systems. (Hiscox)

152. Half of the smallest organizations by revenue say they either do not have or are unsure as to whether they have the skills they need to meet their cyber objectives. (World Economic Forum)

Cyber resilience statistics 

Cyber resilience refers to an organization’s ability to anticipate, withstand, recover from, and adapt to attacks and adverse conditions that impact their cyber resources. Read how business leaders are thinking about and building cyber resilience. 

166. The number of organizations that maintain minimum viable cyber resilience is down 30% in 2024. (World Economic Forum)

167. Cyber resilience has risen to the top agenda item for most cyber risk owners (49%), shooting up from 36% last year. (e2e-assure)

168. More than twice as many SMEs as the largest organizations say they lack the cyber resilience to meet their critical operational requirements. (World Economic Forum)

169. 52% of public organizations state that a lack of resources and skills is their biggest challenge when designing for cyber resilience. (World Economic Forum)

170. 32% of business and tech executives said regulatory requirements for operational resilience will have the greatest impact on their organizations’ future revenue growth. (PwC)

171. 95% of business executives and 93% of cyber executives agree that cyber resilience is integrated into their organization’s enterprise risk-management strategies. (World Economic Forum)

172. More than one-third of companies haven’t instituted risk management efforts, and only one-in-four have made cyber-resilience improvements in 2024. (PwC)

173. 76% of business leaders and 70% of cyber leaders agree that having more effective enforcement of regulatory requirements across their sector would increase their organization’s cyber resilience. (World Economic Forum)

174. Nearly half (42%) of the businesses that fell victim to cyber attacks in 2023 implemented additional cybersecurity and audit requirements because of the attacks they faced. (Hiscox)

175. 56% of organization leaders are confident that their organization is cyber resilient. (World Economic Forum)

176. Almost 4 in 5 (78%) IT and security decision-makers said they have confidence in their company’s cyber resilience strategy and its ability to address today’s escalating cyber challenges and threats. (Cohesity)

177. Organizations are likely overestimating their cyber resilience capabilities and maturity, leading to significant business continuity disruptions. When asked what their organization’s ‘targeted optimum recovery time objectives (RTO) to minimize business impact in the event of a cyberattack or incident of compromise’ was, 98% of respondents said their target was within one day, despite only 2% saying they could recover data and restore business processes within this same period. (Cohesity)

178. 44% of leaders report that their organizations either are not cyber resilient or that they are concerned about their organization’s ability to be cyber resilient. (World Economic Forum)

179. 54 % of business and 61% of cyber leaders believe their third-party organizations are slightly or far less resilient than their own organizations. (World Economic Forum)

180. Small to medium-sized enterprises were more likely to consider their third parties to be equal in their cyber-resilience capabilities (38%) than larger organizations (23%). (World Economic Forum)

181. 71% of manufacturing and 69% of transportation respondents report cyber resilience as the primary responsibility of cybersecurity teams, not an enterprise-wide priority. (LevelBlue)

182. Digital transformation proves to be an ongoing barrier to cybersecurity resilience for manufacturing (73%) and transportation (70%) organizations, with both industries struggling to find the external guidance they need. (LevelBlue)

183. 67% of manufacturing and transportation respondents indicate that cybersecurity resilience initiatives are not sufficiently factored into the organization’s budget. In fact, 78% of manufacturing organizations and 73% of transportation organizations report budgets are reactive rather than proactive. (LevelBlue)

184. A third of all cyber leaders still ranked gaining leadership support as the most challenging aspect of managing cyber resilience. (World Economic Forum)

185. Leading organizations more strongly agree that greater digital resilience leads to more innovation (41%), less business disruption (39%), and avoiding compliance penalties (39%). (Splunk)

186. 35% of small organizations believe their cyber resilience is inadequate, a proportion that has increased sevenfold since 2022. (World Economic Forum)

Cybersecurity awareness statistics 

Knowing what risks you and your organization face and acting responsibly to avoid them can help improve cyber resilience. Take a look at the cybersecurity awareness statistics below to see how individuals and organizations are thinking about cybersecurity and taking action. 

187. During the past 12 months, cyber security remained a high priority for around seven in ten businesses (72%) and charities (68%), in line with the previous two years. (UK Government)

188. Awareness of UK government initiatives around cybersecurity has seen a steady decline in recent years and remains fairly limited, particularly among micro businesses. Here's how it broke down by campaign:

• Cyber Aware campaign: 24% businesses and 26% charities
• 10 Steps guidance: 12% businesses and 15% charities
• Cyber Essentials: 12% businesses and 15% charities (UK Government).

189. Security awareness is often perceived by organizations as a part-time task, with 70% of security awareness practitioners disclosing that they dedicated half or less of their working time to it in 2023. (SANS Institute)

190. Only 14% of security awareness practitioners said that they dedicate 90% or more of their working time to security awareness. (SANS Institute)

191. 75% of respondents said they did have a security awareness budget. However, only 25% knew what their budget was. (SANS Institute)

192. More than 39% of organization leaders agree that “cybersecurity is a key business enabler.” (World Economic Forum)

193. More than half (56%) of cyber leaders meet with business leaders monthly, or more frequently, to discuss cyber-focused topics. (World Economic Forum)

194. 69% of organizations say the top executives have a clear view of how cyber security is being managed. (Hiscox)

195. 66% of manufacturing and transportation respondents believe cybersecurity is an afterthought in their organizations with another 65% of manufacturing and 56% of transportation respondents confirming efforts are often siloed.

196. Only 48% of manufacturing and 53% of transportation executives say cybersecurity is included in broader corporate strategy discussions. (LevelBlue)

197. 59% of small businesses surveyed don’t use security awareness training. (Hiscox)

198. 65% percent of IT professionals said that their cybersecurity awareness training programs need expansion. (ThriveDX)

199. When asked how they had responded to cyber attacks, 39% of experts said they stepped-up employee training (39%). (Hiscox)

200. When employees were questioned about the potential consequences of falling victim to a cyber attack, over half (59%) indicated that they would either receive training and face disciplinary action if they caused another breach (32%) or be required to attend mandatory training (27%). (e2e-assure)

201. Less than a quarter (24%) of employees described themselves as ‘very engaged’ in the training process. (e2e-assure)

202. 76% of workers said concerns to personal online safety would likely engage them with training, as well as if it was more clearly communicated (75%) or involved real life scenarios that workers could apply (also 75%). (e2e-assure)

203. Training that takes place online at a pre-arranged time that is suitable for the worker, is also popular (72%). (e2e-assure)

204. Workers would also be more likely to engage if training was short but regular (53%) over long but less regular (23%). (e2e-assure)

205. 40% of ‘resilient’ respondents (surveyed CISOs and cyber security decision makers who described themselves as resilient) have invested in training, versus 22% ‘not resilient.' (e2e-assure)

206. 38% of ‘resilient’ respondents provide clear communication and policies, versus 22% ‘not resilient.’ (e2e-assure)

207. The majority (73%) of cyber risk owners agree that most cyber attacks come from a lack of employee diligence. (e2e-assure)

208. As a result of employee awareness efforts, 19% of organizations reported better awareness and 14% greater vigilance. (ThriveDX)

209. 45% of organizations are focusing on enhancing their training programs to better prepare employees for the evolving threat landscape. (Keeper Security)

210. The most mature security awareness programs on average have at least 4.18 Full Time Employees (FTEs) dedicated to or helping manage the program. (SANS Institute)

211. 89% of respondents highlight social engineering attacks as their primary, human-related concern. (SANS Institute)

How to protect against cyber attacks

Below are best practices that can help you protect your organization against cyber attacks. 

1. Meet security and compliance standards and regulations

Adhering to regulatory guidelines and industry standards like SOC 2 and HIPAA can not only help you avoid fines and penalties — it can also help you establish strong internal security controls and sustainable security processes that reduce the likelihood of cyber attacks.

Compliance activities, like risk assessments and security awareness training for example, help keep organizations aware of critical business risks, identify redundancies in their software and procedures, and ensure their staff is properly trained to protect sensitive information. 

2. Identify and prioritize risks

There are many methods for identifying and prioritizing risks. One of the most popular is developing key risk indicators (KRIs).

KRIs are a way to proactively track the most important types of risks that could put your business’s primary objectives and priorities in jeopardy. By establishing KRIs and setting tolerance values to track against each risk, KRIs can serve as early warning signs of upcoming crises and provide your organization enough time to mitigate that risk’s potential impact or prevent it from occurring. You can use our free template to get started.

Another popular method is using a risk matrix. To create a risk matrix, you have to compare the likelihood of a potential risk against the impact that your business would face if that risk occurs. For example, a high-priority risk would be an incoming hurricane that’s expected to cause power outages and disrupt business operations.

No matter what method you choose, prioritizing the risks that pose the greatest threat to your organization can enable you to focus your team’s time and resources to minimize their impact.

3. Create a risk management plan 

Once you’ve identified the biggest risks facing your business, you can create a plan for how to manage them. 

A risk management plan should document your organization’s process for regularly identifying, analyzing, and mitigating risks. It should also list clear roles and responsibilities for team members to track potential risks and address them if they were to happen.  

Download our free risk management resources kit to get the essential tools you’ll need to identify, prioritize, and mitigate risk, including policy templates, worksheets, and more.

How Secureframe can help your organization’s cybersecurity efforts

Defending your organization from cyber attacks while navigating an increasingly complex threat and compliance landscape is difficult — so don’t do it alone. 

Secureframe can simplify and streamline your cybersecurity efforts. We can help you automate risk assessments, reduce your third-party risk, simplify policy management, speed up cloud remediation, and conduct continuous monitoring to look for gaps in controls so you can maintain continuous compliance. We can also make training your workforce on the latest security and privacy best practices easy and automatic. 

Plus, our in-house compliance team can give personalized advice based on your company’s unique risks and industry requirements to keep you secure and compliant, even as you scale.

When asked how Secureframe helped them improve, 81% of UserEvidence survey respondents say they reduced the risk of data breaches, with 39% saying they cut that risk by at least half.

To learn more about how Secureframe can help you develop a robust cybersecurity program and reduce the risk of cyber attacks, request a demo today.

About the UserEvidence Survey

The data about Secureframe users was obtained through an online survey conducted by UserEvidence in February 2024. The survey included responses from 44 Secureframe users (the majority of whom were manager-level or above) across the information technology, consumer discretionary, industrials, financial, and healthcare industries.