The global average cost of a data breach reached a record $4.99 million in 2026, a 12% year-over-year increase, according to IBM's latest Cost of a Data Breach Report. For U.S. organizations, that number was more than double at $11.5 million per breach, exceeding all other countries and regions.

How attackers get in is changing too. Exploitation of vulnerabilities has overtaken stolen credentials as the most common way breaches begin for the first time in nearly two decades, and one in four malicious breaches now involves AI.

This post compiles 110+ of the latest data breach statistics from IBM, Verizon, the Identity Theft Resource Center (ITRC), CrowdStrike, and the Ponemon Institute and DTEX. Use them to get a current picture of the threat landscape and what it means for your security program.

Key findings

The table below summarizes the most significant data breach statistics from the full list that follows.

Key data breach trends to watch in 2027

Looking across this year's statistics and reports from IBM, Verizon, and others, four trends stand out. Here's what they are and what they mean for organizations heading into 2027 and beyond:

1. The U.S. is bearing the brunt of breach activity and cost.

Nearly every measure of breach impact in this year's reports points to the U.S. and North America. North America was the most attacked region in IBM X-Force's incident response data for the first time in six years, accounting for 29% of incidents, up from 24% in 2024. U.S. data compromises are also on pace to nearly double over five years, from 1,859 in 2021 to roughly 3,600 in 2026, according to the ITRC.

Costs are climbing along with volume. U.S. organizations averaged a record $11.5 million per breach in IBM's 2026 Cost of a Data Breach Report, more than double the global average and higher than any other country or region studied. IBM attributes much of that gap to higher business costs and higher regulatory fines in the U.S. North American organizations also carry the highest annual insider risk costs, at $24 million, according to the Ponemon Institute and DTEX.

For U.S. organizations, global averages likely understate the real exposure. Breach costs and regulatory penalties are worth modeling against U.S. figures when setting security and compliance budgets.

2. Manufacturing remains the top target, and the impact is growing fast.

Manufacturing was the most targeted industry in X-Force's incident response data for the fifth year in a row, accounting for 27.7% of incidents. U.S. breach notices tell a similar story. Manufacturing compromises rose 17% in the first half of 2026 compared to the same period in 2025, and at 63% of its full-year 2025 total, the sector is on track for another record year.

The number of people affected has grown even faster. Manufacturers generated 74 million victim notices in the first half of 2026, roughly 37 times the sector's full-year 2025 total and the most dramatic proportional surge of any industry.

Several factors likely make manufacturers attractive targets. Many run operational technology that is difficult to patch, sit in the middle of complex supply chains, and face downtime costs high enough that attackers may expect them to pay. For manufacturers that support the Defense Industrial Base, these trends add weight to the CMMC and NIST SP 800-171 requirements that prime contractors are already flowing down to their suppliers.

3. AI is accelerating familiar attacks and creating new internal risks.

AI-related security incidents are rising. 21% of organizations reported an incident involving an AI model or application in IBM's 2026 report, up from 13% the year before, and these incidents cost $5.33 million on average. Security incidents involving shadow AI, where employees use unapproved AI tools, more than doubled to 43% of incidents.

How attackers use AI suggests the fundamentals still matter. Verizon found the median threat actor used AI across 15 attack techniques, yet less than 2.5% of AI-assisted malware observations involved uncommon techniques. In other words, AI is mostly helping attackers run well-known plays at greater speed and scale.

That makes speed a deciding factor on defense. Organizations that used security AI and automation extensively identified and contained breaches 65 days faster and saved $1.93 million per breach compared to those that didn't. With attackers using AI in one in four malicious breaches, matching that speed while bringing shadow AI under governance is likely where security teams will see the biggest return.

4. Supply chain risk has become a remediation problem.

Third-party and supply chain breaches are not new. What has changed is how much damage they do while known gaps stay open. X-Force reports that the number of major supply chain or third-party breaches has nearly quadrupled over five years. In the first half of 2026 alone, just 38 supply chain attacks generated 280.6 million U.S. victim notices across 206 entities, according to the ITRC.

The bigger issue is how slowly weaknesses get fixed. Verizon found that only 23% of third parties fully remediated missing or improperly secured MFA on cloud accounts, and it took almost eight months to resolve half of weak password and permission findings. SecurityScorecard reports that 60% of suppliers take eight days or more to remediate a high-severity issue, 46% of organizations need three to 14 days or more to determine whether a new critical vulnerability affects their vendors, and 64% say fewer than half of their vendors meet their cybersecurity requirements.

Those delays show up in breach costs. Supply chain compromise was tied for the longest breach lifecycle in IBM's study, at 258 days, and supply chain breaches were the factor that added the most to breach costs, at $227,250 on average. Point-in-time vendor assessments are unlikely to close that gap on their own. Continuous monitoring of vendor controls and clear remediation timelines in contracts give organizations a better chance of fixing third-party gaps before attackers find them.

These findings show how quickly the breach landscape is shifting and how costly a breach has become. Our Cybersecurity Checklist can help you identify and close gaps before they turn into costly breaches.

Must-know 2026 data breach statistics

The numbers below capture the overall volume, scale, and direction of data breaches heading into 2027.

1. The global average cost of a data breach reached a record $4.99 million, an estimated $1,100 per hour cost and a 12% increase over the prior year. (IBM, 2026)

2. The estimated annual cost of cybercrime worldwide continues to increase each year, and is expected to reach 15.63 trillion by 2029. (Statista, 2026)

3. The U.S. recorded 1,803 data compromises in the first half of 2026, including 1,394 confirmed data breaches, up 3.3% from the same period in 2025. At that pace, 2026 would set a new annual record of roughly 3,600 compromises, surpassing 2025's all-time high of 3,321. (ITRC, H1 2026)

4. Mega-breaches have returned. U.S. victim notices reached 471.2 million in the first half of 2026, nearly 60% more than the full-year 2025 total (297.5 million). A single breach of Instructure's Canvas platform accounted for more than half the total. (ITRC, H1 2026)

5. Publicly traded companies accounted for just 10% of U.S. compromises in H1 2026 but 83% of victim notices, reflecting the scale of consumer data large public companies hold and the impact of breaches targeting them specifically. (ITRC, H1 2026)

6. Ransomware was present in 48% of all breaches, up from 44% the previous year. (Verizon, 2026)

7. The top impacts of cyber incidents on victim organizations are:

• Credential harvesting (26%)
• Data leaks (19%)
• Reconnaissance (17%)
• Illicit financial gain (14%)
• Data theft (14%)
• Brand reputation damage (5%)
• Data destruction (2%)
• Digital currency mining (1%) (IBM X-Force, 2026)

8. One in four malicious breaches was AI-enabled, a 56% increase over the previous year. (IBM, 2026)

9. Attacks by AI-enabled adversaries increased 89% year over year in 2025. (CrowdStrike, 2026)

10. For the fifth year in a row, the top most targeted industries were manufacturing (27.7%) and finance and insurance (27%). (IBM X-Force, 2026)

The financial impact of data breaches

Data breaches carry a hefty price tag, from detection and response to lost business and regulatory fines. This section covers what breaches cost organizations in 2026.

11. The global average cost of a data breach rose to a record $4.99 million in 2026, reversing the prior year's drop to $4.44 million. (IBM, 2026)

12. U.S. organizations averaged a record $11.5 million per breach, up from $10.22 million and more than double the global average. This was the highest average breach cost of any country or region in the study. (IBM, 2026)

13. The average cost of a data breach breaks down into four categories:

• Detection and escalation: $1.64 million
• Lost business: $1.54 million
• Post-breach response, including regulatory fines, legal expenses, and credit monitoring: $1.36 million
• Notification: $450,000 (IBM, 2026)

14. Detection and escalation and lost business costs each rose 11.5% and together made up 63% of this year’s record average breach cost ($3.18 million of the $4.99 million total), while post-breach response rose the most at 15%. (IBM, 2026)

15. Breaches with lifecycles longer than 200 days cost an average of $5.65 million, compared to $4.32 million for breaches contained within 200 days. (IBM, 2026)

16. Customer PII was the most commonly stolen or compromised data type in 52% of breaches, but intellectual property was the costliest to lose at $196 per record. (IBM, 2026)

17. Here's how often each data type was compromised and what it cost per record:

• Customer PII: 52% of breaches, $192 per record
• Employee PII: 35% of breaches, $188 per record
• Anonymized customer data: 34% of breaches, $130 per record
• Intellectual property: 32% of breaches, $196 per record (IBM, 2026)

18. Breaches involving data stored across public clouds were among the costliest, at $5.38 million, compared to $4.56 million for breaches of on-premises data. (IBM, 2026)

19. Malicious breaches that were AI-driven cost an average of $6.04 million, compared to $5.03 million for malicious breaches that weren't, a difference of about $1 million. (IBM, 2026)

20. The costliest security incidents involving an organization's AI models or applications were:

• Model inversion: $6.07 million
• Prompt injection: $5.89 million
• Cloud security misconfigurations affecting AI workloads: $5.25 million
• Malicious model: $4.94 million
• Model evasion: $4.72 million (IBM, 2026)

21. Security incidents involving shadow AI cost an average of $5.39 million, up from $4.63 million the previous year. (IBM, 2026)

22. Supply chain breaches, in which a compromised business partner became the attack vector, was the factor that increased breach costs the most, adding over $220,000. (IBM, 2026)

23. The top factors that raised the average breach cost were:

• Supply chain breach: +$227,250
• Security system complexity: +$208,265
• Lack of visibility into applications (shadow IT): +$201,165
• Mismanaged secrets and keys: +$198,933
• Inability to prioritize threats: +$188,172
• Security skills shortage: +$179,635 (IBM, 2026)

24. A DevSecOps approach was the factor that reduced breach costs the most. The top factors that lowered the average breach cost were:

• DevSecOps approach: -$253,805
• Identity and access management (IAM): -$225,622
• Key lifecycle management tools: -$214,923
• Encryption: -$213,478
• Offensive security testing (red teaming, pen testing, or vulnerability testing): -$211,339
• Security orchestration, automation, and response (SOAR) tools: -$210,771
• Employee training: -$196,259 (IBM, 2026)

25. Organizations that made extensive use of security AI and automation had an average breach cost of $4 million, compared to $5.93 million for organizations that didn't use these tools, a savings of $1.93 million. (IBM, 2026)

26. Noncompliance with regulations added $201,112 to the average breach cost, likely reflecting regulatory fines that follow a breach. (IBM, 2026)

27. In about one in five security incidents involving shadow AI (21%), organizations reported paying a regulatory fine. (IBM, 2026)

28. The median ransom payment fell to $139,875, down from $150,000 the previous year, and 69% of ransomware victims did not pay a ransom at all. (Verizon, 2026)

29. The largest single financial theft ever reported took place in February 2025, when North Korea-nexus adversary PRESSURE CHOLLIMA stole $1.46 billion in cryptocurrency through trojanized software delivered via a supply chain compromise. (CrowdStrike, 2026)

30. Organizations now face average annual insider risk costs of $19.5 million, up from $17.4 million in 2024. (Ponemon Institute and DTEX, 2026)

Data breach statistics by industry and geography

Not all industries and regions are affected equally by data breaches. This section covers the sectors and regions hit hardest.

31. The industries with the highest average breach costs were:

• Healthcare: $6.64 million
• Financial: $6.29 million
• Industrial: $5.50 million
• Technology: $5.50 million
• Entertainment: $5.38 million
• Pharmaceuticals: $5.25 million
• Energy: $5.24 million (IBM, 2026)

32. Healthcare had the highest average breach cost of any industry for the 13th consecutive year, but it was the only industry where costs fell, down 10.5% from $7.42 million last year. (IBM, 2026)

33. Financial had the second highest average breach cost of any industry at $6.29 million, a 13.1% increase from last year. (IBM, 2026)

34. Communications saw the largest jump in average breach costs of any industry, up 20% to $4.71 million, followed by entertainment, up 18% to $5.38 million. (IBM, 2026)

35. Manufacturing was the most targeted industry for the fifth year in a row, accounting for 27.7% of the incidents X-Force responded to. (IBM X-Force, 2026)

36. The top 5 compromised industries based on U.S. breach notices in the first half of 2026 were:

• Financial services: 387 compromises
• Healthcare: 281 compromises
• Professional services: 269 compromises
• Manufacturing: 189 compromises
• Technology: 99 compromises (ITRC, H1 2026)

37. Manufacturing compromises rose 17% compared to the first half of 2025 (189 vs. 161) and, at 63% of FY 2025’s total, is on track for another record year in event frequency. The sector's 74 million victim notices in H1 2026 were roughly 37 times its full-year 2025 total. (ITRC, H1 2026)

38. Manufacturing has already had 74 million victim notices in H1 2026, roughly 37 times its full-year 2025 total, making it the most dramatic proportional victim surge of any sector. (ITRC, H1 2026)

39. Malicious or criminal attacks caused 61% of breaches in retail and transportation, the highest share of any industry. (IBM, 2026)

40. 62% of AI-driven attacks targeted critical infrastructure sectors, with financial services and energy organizations experiencing the highest concentration. (IBM, 2026)

41. North America was the most attacked region for the first time in six years, accounting for 29% of the incidents X-Force responded to, up from 24% in 2024. (IBM X-Force, 2026)

42. Average breach costs rose in every country and region IBM studied. The five costliest were (IBM, 2026):

43. South Africa saw the largest percentage increase in average breach costs (22%), followed by Germany (18%) and Benelux (16%). (IBM, 2026)

44. China-nexus targeted intrusion activity increased 38% in 2025, including an 85% increase in attacks on logistics, 30% on telecommunications, and 20% on financial services. (CrowdStrike, 2026)

45. About 96% of ransomware victims with known organization size were small and medium-sized businesses (SMBs), defined as organizations with fewer than 1,000 employees. (Verizon, 2026)

46. Among SMB breaches, compromised credentials (38%) and unpatched vulnerabilities in edge devices (29%) were frequent contributors to victimization. (Verizon, 2026)

47. North American organizations had the highest annual insider risk costs, at $24 million, compared to $18.6 million in Europe, $17.5 million in Asia-Pacific, and $17.4 million in the Middle East. (Ponemon Institute and DTEX, 2026)

48. Health and pharmaceutical organizations faced the highest annual insider risk costs of any industry at $28.8 million, followed by technology and software ($24.2 million) and financial services ($23.1 million). (Ponemon Institute and DTEX, 2026)

Understanding the threat: Top attack vectors

This section covers the tactics and techniques attackers favor today and how they are shifting.

49. Exploitation of vulnerabilities is now the most common initial access vector for breaches, rising to 31% from 20% the previous year. (Verizon, 2026)

50. X-Force saw the same shift. Incidents caused by exploitation of public-facing applications rose 44% and accounted for 40% of cases, while use of valid credentials, the top vector for the previous two years, fell to 32%. (IBM X-Force, 2026)

51. 56% of the nearly 40,000 vulnerabilities tracked by X-Force did not require authentication for an attacker to successfully exploit. (IBM X-Force, 2026)

52. Zero-day vulnerabilities exploited before public disclosure increased 42% year over year. (CrowdStrike, 2026)

53. Zero-day attacks reported in U.S. breach notices doubled, from seven in H1 2025 to 14 in H1 2026, nearly matching the full-year 2025 total of 17. (ITRC, H1 2026)

54. Of the vulnerabilities China-nexus adversaries exploited in 2025, 67% were remote code execution flaws that provided immediate system access, and 40% targeted internet-facing edge devices. (CrowdStrike, 2026)

55. Credential abuse, the previous top initial access vector, fell to 13% of breaches. Verizon notes this is partly because it began tracking pretexting separately; without that change, credential abuse would have been 16%. (Verizon, 2026)

56. Counting all instances of credential abuse at any point in a breach, not just the first action, credential abuse still appears in 39% of breaches, more than any other vector. (Verizon, 2026)

57. Valid account abuse accounted for 35% of cloud incidents, and cloud-conscious intrusions rose 37% in 2025, including a 266% increase among state-nexus threat actors. (CrowdStrike, 2026)

58. Phishing was the top initial attack vector in IBM's study for the fourth year in a row, followed by supply chain compromise. Abuse of valid accounts, drive-by compromise, and social engineering tied for third. (IBM, 2026)

59. The top 10 attack patterns X-Force observed were:

• Exploiting incorrectly configured access controls (15.4%)
• Scanning for vulnerable software (12.4%)
• Brute forcing passwords (12.4%)
• Querying systems for information (11.2%)
• Code injection (10%)
• Privilege escalation (9.9%)
• Session hijacking (8.9%)
• Retrieving embedded sensitive data (7.1%)
• Using malicious files (6.8%)
• Exploiting trusted identifiers (5.9%) (IBM X-Force, 2026)

60. External actors were responsible for 88% of breaches, while internal actors appeared in 12%, down from 18% the previous year. State-affiliated actors appeared in close to 15% of breaches. (Verizon, 2026)

61. Malicious or criminal attacks caused 55% of breaches, up from 51%, while human error caused 23% and IT failures caused 22%. (IBM, 2026)

62. In nearly 10% of breaches, attackers copied data onto removable media. These breaches took the longest to identify and contain, at 258 days, tied with supply chain compromises. (IBM, 2026)

63. Deploying malware was the most common action attackers took once inside, seen in 41% of X-Force incident response cases. Of those malware cases:

• 18% deployed ransomware
• 18% deployed webshells
• 10% deployed infostealers
• 10% deployed backdoors (IBM X-Force, 2026)

64. 82% of CrowdStrike's detections in 2025 were malware-free, up from 51% in 2020, as attackers increasingly operate through valid credentials, trusted identity flows, and legitimate tools. (CrowdStrike, 2026)

65. 39% of breached organizations reported a ransomware attack, up from 34% the prior year and 24% in 2023, a 62.5% rise over that period. (IBM, 2026)

66. Ransomware incidents in U.S. breach notices held roughly steady in H1 2026 (76 vs. 73 in H1 2025), after falling in each of the two previous years. (ITRC, H1 2026)

67. Ransomware actors are increasingly using reputation as a pressure point. The most common extortion tactics were threatening:

• Brand reputation through public shaming and media leaks (41%)
• Employee personal data (35%)
• Intellectual property (31%)
• Customer data (30%)
• Operational systems through encryption or OT disruption (23%)
• Internal communications such as emails and Slack messages (19%) (IBM, 2026)

68. Threatening brand reputation (41%) has overtaken disrupting operations through encryption (23%) as ransomware attackers' most common extortion tactic.(IBM, 2026)

69. Among ransomware victims with a prior infostealer or credential leak, 50% had that event occur within 95 days before the ransomware attack. (Verizon, 2026)

70. The average eCrime breakout time, the time it takes an attacker to move laterally from initial access, fell to 29 minutes in 2025. The fastest observed breakout took just 27 seconds. (CrowdStrike, 2026)

71. Average breakout time has dropped roughly 70% since 2021, from 98 minutes to 29 minutes. (CrowdStrike, 2026)

The human factor: Social engineering breach statistics

This section covers how attackers use deception and manipulation to get in, and how those tactics are shifting toward voice and mobile channels.

72. The human element was present in 62% of breaches, up slightly from 60% the previous year. (Verizon, 2026)

73. Social engineering was the third most common breach pattern, representing 16% of all breaches. (Verizon, 2026)

74. Phishing remained the initial access vector in 16% of breaches, while pretexting reached 6% and has become a more common entry point for ransomware and extortion attacks. (Verizon, 2026)

75. Phishing, smishing, and business email compromise (BEC) remained the most common known attack vector in U.S. breach notices in H1 2026, with 157 incidents. That's down 38% from 253 in H1 2025, a drop that may partly reflect the growing share of notices that don't disclose an attack vector at all. (ITRC, H1 2026)

76. Voice and SMS phishing was used in 17% of attacks and led to the highest average breach cost of any initial attack vector, at $5.29 million. (IBM, 2026)

77. Social engineering such as IT or help desk impersonation and MFA fatigue was used in 13% of attacks, with an average breach cost of $5.23 million. (IBM, 2026)

78. In phishing simulations, the median click rate for mobile-centric vectors such as voice calls and text messages was 40% higher than for email. (Verizon, 2026)

79. In one intrusion observed by CrowdStrike, a voice phishing actor convinced a law firm employee to grant remote access and attempted to exfiltrate data within four minutes. (CrowdStrike, 2026)

80. Deepfakes led the AI-driven attacks IBM studied. The most common types of AI-driven attacks were:

• Deepfake or impersonation attacks (45%)
• AI-enabled malware (19%)
• AI-generated phishing or other communications (17%)
• Other (19%) (IBM, 2026)

81. Phishing accounted for 44% of the AI-assisted initial access techniques Verizon observed threat actors researching or using, followed by exploitation of vulnerabilities at 32%. (Verizon, 2026)

82. Credential theft by "outsmarted" insiders, employees reasonably outmaneuvered by an attacker, carried the highest per-incident cost of any insider risk type at $842,462. (Ponemon Institute and DTEX, 2026)

The impact of insider threats

This section covers the cost and frequency of insider incidents, from honest mistakes to malicious insiders, and the growing role shadow AI plays in both.

83. Insider negligence is the fastest-growing insider risk category, with associated losses rising 17% year over year to $10.3 million annually. (Ponemon Institute and DTEX, 2026)

84. Negligent insiders caused most insider incidents, but every type carried a multimillion-dollar annual cost:

• Negligent or mistaken insiders: 53% of incidents, $10.3 million annually
• Malicious or criminal insiders: 27% of incidents, $4.7 million annually
• Outsmarted insiders (credential theft): 20% of incidents, $4.5 million annually (Ponemon Institute and DTEX, 2026)

85. Organizations experienced an average of 25 insider incidents per year across the 354 organizations studied, including 13.8 negligent insider incidents costing approximately $747,107 each. (Ponemon Institute and DTEX, 2026)

86. Insider wrongdoing incidents in U.S. breach notices jumped to 21 in the first half of 2026, more than seven times the full-year 2025 total of three. ITRC points to tech-sector layoffs and North Korean operatives posing as remote IT workers as two fast-growing drivers. (ITRC, H1 2026)

87. Shadow AI, personal webmail, and file sharing sites were the top three causes of negligent insider incidents observed by DTEX investigators. (Ponemon Institute and DTEX, 2026)

88. Shadow AI is now the third most common non-malicious insider action detected in Verizon's data loss prevention (DLP) dataset, a fourfold increase from the previous year. (Verizon, 2026)

89. Misdelivery, misconfiguration, and loss were the most common employee errors behind breaches in Verizon's Miscellaneous Errors pattern. (Verizon, 2026)

90. Customer service (51%), IT (49%), and HR (46%) are seen as the roles that pose the greatest insider risk. (Ponemon Institute and DTEX, 2026)

91. Containment is the largest insider risk cost driver at $247,587 per incident, far exceeding escalation costs of $39,728. (Ponemon Institute and DTEX, 2026)

92. The average time to contain an insider incident dropped from 81 days to 67 days, the fastest recorded since the study began. (Ponemon Institute and DTEX, 2026)

93. Insider incidents contained in under 30 days cost $14.2 million annually on average, compared to $21.9 million when containment took more than 90 days. (Ponemon Institute and DTEX, 2026)

94. 63% of organizations now operate an insider risk management program, and 82% have or plan to have one. (Ponemon Institute and DTEX, 2026)

95. Organizations with an established insider risk management program prevent an average of seven insider incidents per year, saving roughly $8.2 million in avoided costs. (Ponemon Institute and DTEX, 2026)

96. The share of IT security budgets allocated to insider risk management more than doubled, from 8.2% in 2023 to 19% in 2025. Still, 45% of organizations say these budgets are insufficient, and 70% expect them to increase in 2026. (Ponemon Institute and DTEX, 2026)

Third-party data breach statistics

A breach outside your walls can still become your breach. This section covers the ripple effect of third-party and supply chain compromises.

97. Breaches with third-party involvement increased 60% year over year, reaching 48% of all breaches. (Verizon, 2026)

98. The number of major supply chain or third-party breaches has nearly quadrupled over five years. (IBM X-Force, 2026)

99. Supply chain attacks generated 280.6 million U.S. victim notices in the first half of 2026 from just 38 initial attacks affecting 206 entities, making supply chain the most consequential attack vector for total victim impact. (ITRC, H1 2026)

100. Supply chain compromise was the second most common initial attack vector in IBM's study, used in 15% of breaches, with an average cost of $4.96 million and a 258-day lifecycle. (IBM, 2026)

101. Only 23% of third-party organizations fully remediated missing or improperly secured multifactor authentication (MFA) on their cloud accounts. (Verizon, 2026)

102. For weak passwords and permission misconfigurations at third parties, it took almost eight months to resolve half of all findings. (Verizon, 2026)

103. 46% of organizations remain in the dark for 3 to 14 days or more when trying to determine whether a newly announced critical vulnerability (e.g., zero-day) affects any of their third-party vendors (SecurityScorecard, 2026).

104. 64% say that less than half of their vendors comply with their cybersecurity requirements and internal rules. (SecurityScorecard, 2026)

105. The most common causes of breaches involving AI models or applications were weaknesses in surrounding systems: compromised connected apps, APIs, or plug-ins (27%) and cloud security misconfigurations (27%). (IBM, 2026)

106. 78% of companies say that less than half of their total supply chain is currently overseen by their internal cybersecurity program, and about one-third (35%) say that only 1% to 10% is covered. (SecurityScorecard, 2026)

107. While 94% of organizations said they’re very or somewhat confident that their third-party risk practices meet emerging supply chain cybersecurity regulations, 22% ranked recent high-profile breaches as the most influential factor on their level of concern. (SecurityScorecard, 2026)

108. 55% of organizations still depend on manual methods like phone calls, meetings, or emails to collaborate with vendors during a breach, which slows down response times. (SecurityScorecard, 2026)

109. Organizations report that it takes 60% of suppliers 8 days or more to remediate a high-severity issue. Nearly half that total take more than two weeks and up to 2 full months. (SecurityScorecard, 2026)

Data breach response statistics

A fast, effective response can significantly reduce the cost and impact of a breach. This section covers how long response takes, who detects breaches, how much organizations disclose, and where they plan to invest next.

110. The mean time to identify and contain a breach rose to 247 days (183 days to identify and 64 days to contain), up from 241 days and the first increase after five consecutive years of improvement. (IBM, 2026)

112. Breaches involving data stored across multiple environments took the longest to identify and contain for the second straight year, at 256 days, though that's an improvement from 277 days the year before. (IBM, 2026)

113. Internal teams detected the most breaches, but breaches detected by an MSSP were the least costly. Here's who identified breaches and what they cost on average:

• Internal IT or security team: 38% of breaches, $5.01 million
• Managed security service provider (MSSP): 31% of breaches, $4.86 million
• Disclosed by the attacker: 17% of breaches, $5.12 million
• Third party: 14% of breaches, $4.98 million (IBM, 2026)

114. When internal teams identified a breach, it was identified and contained in 209 days on average, 15% faster than the global average. When a third party identified it, the lifecycle stretched to 281 days. (IBM, 2026)

115. 42% of breached organizations reported fully recovering from their breach, up from 35% last year and 12% in 2024. Fewer than one in 20 recovered in less than 50 days. (IBM, 2026)

116. Only 26% of critical vulnerabilities listed in CISA's Known Exploited Vulnerabilities (KEV) catalog were fully remediated by organizations in 2025, down from 38% the previous year. (Verizon, 2026)

117. The median time to fully remediate a KEV vulnerability rose to 43 days, almost two weeks longer than the previous year's 32 days, while organizations had 50% more critical vulnerabilities to patch. (Verizon, 2026)

118. Only 24% of U.S. breach notices in H1 2026 included details on how the breach occurred, the lowest rate ever recorded, down from 30% in 2025 and 93% in 2021. (ITRC, H1 2026)

119. 85% of organizations plan to increase security spending after becoming aware of advanced frontier AI cyber capabilities, compared to 64% that planned to increase spending after experiencing a breach. (IBM, 2026)

120. The top areas where breached organizations plan to increase security investment are:

• Hiring skilled specialists (45%, up from 27%)
• Incident response plans and testing (43%)
• Identity and access management (41%)
• Threat detection and response technologies such as SIEM, SOAR, and EDR (34%)
• AI security and governance tools (34%)
• Managed security services (33%) (IBM, 2026)

121. 74% of organizations have rethought if and where they deploy AI agents in their security operations because of frontier AI threats. (IBM, 2026)

New challenges: AI and emerging threats

AI is changing both sides of the breach equation. This section covers how attackers use AI, how AI systems themselves are being targeted, and where governance is falling behind.

122. 21% of organizations reported a security incident involving an AI model or application, up from 13% the previous year, a 61% increase. These incidents cost an average of $5.33 million, compared to $4.70 million for incidents that didn't involve AI. (IBM, 2026)

123. Of organizations that experienced an AI-related breach, 92% lacked proper AI access controls, and only 40% of all organizations reported using access controls on AI models and data. (IBM, 2026)

124. The median threat actor researched or used AI assistance across 15 different attack techniques, with some using it for as many as 40 or 50. (Verizon, 2026)

125. Most AI-assisted malware development involved well-known techniques. Less than 2.5% of AI-assisted malware observations involved less-common techniques with one or fewer known malware examples. (Verizon, 2026)

126. Security incidents involving shadow AI, where workers use unapproved AI tools, more than doubled, rising to 43% of incidents from 20% the previous year. (IBM, 2026)

127. 45% of employees are now regular users of AI on their corporate devices, authorized or not, up from 15% the previous year. (Verizon, 2026)

128. 67% of users access AI services on corporate devices using non-corporate accounts. (Verizon, 2026)

129. Source code was the most common data type employees submitted to external generative AI tools, followed by images and other structured data. (Verizon, 2026)

130. 68% of breached organizations lacked policies to manage AI or detect shadow AI, up from 63% the prior year. Only 19% reported coordination between their AI governance and security teams. (IBM, 2026)

131. 73% of organizations worry that unauthorized AI use is creating invisible data exfiltration paths, but just 18% have fully integrated AI governance into their insider risk programs. (Ponemon Institute and DTEX, 2026)

132. 44% of organizations report minimal or no visibility into AI agent activity, and only 19% classify AI agents as equivalent to human insiders. (Ponemon Institute and DTEX, 2026)

133. 92% of organizations say generative AI has fundamentally changed how employees access and share information, yet only 13% have formally integrated AI into their business strategies. (Ponemon Institute and DTEX, 2026)

Building a strong defense: Proven mitigation tactics

Awareness has to turn into action. This section covers the controls and investments that measurably reduce breach costs and frequency.

134. Organizations with extensive use of security AI and automation identified and contained breaches in 215 days, 65 days faster than organizations that didn't use these tools (280 days). (IBM, 2026)

135. Only 36% of breached organizations use security AI and automation extensively, up from 32%. The remaining 64% report limited or no use. (IBM, 2026)

136. Half of breached organizations have deployed AI agents in their security operations. Of those, 56% use them for threat hunting and 54% for automated response and containment, but only 18% apply them to vulnerability scanning and management. (IBM, 2026)

137. Only 37% of breached organizations encrypted sensitive data both at rest and in motion at the time of the breach. 53% did not, and 10% weren't sure. (IBM, 2026)

138. Only 46% of organizations secure non-human identities (NHIs), such as service accounts and API keys, in AI workflows. Of those that do, 55% use machine identity inventory and lifecycle management and 39% use secrets management systems. (IBM, 2026)

139. Only 26% of organizations have a post-quantum cryptography project, and 61% lack controls to monitor and secure cryptographic assets such as keys, certificates, and algorithms. (IBM, 2026)

140. 83% of organizations run training and awareness programs to reduce insider risk, making it the most widely used insider risk control. (Ponemon Institute and DTEX, 2026)

141. The security controls that deliver the highest insider risk cost savings are:

• Privileged access management: $6.1 million
• User behavior analytics: $5.1 million
• User training and awareness: $4.8 million
• Security information and event management (SIEM): $4.6 million
• Incident response management: $4.1 million (Ponemon Institute and DTEX, 2026)

142. 42% of organizations now use AI to detect or prevent insider risks. (Ponemon Institute and DTEX, 2026)

Download the Cybersecurity Awareness Kit

With breach costs at a record high and supply chain and AI-driven attacks on the rise, security gaps can't be left to chance. This free kit brings together five resources to help you act on the trends in this post, including a:

• 2026 Cybersecurity Checklist
• cybersecurity risk assessment template
• incident response plan template
• vendor risk management checklist, and
• six tabletop exercise scenarios.

Top 5 takeaways for organizations heading into 2027

With these statistics in mind, here are five practical takeaways for organizations navigating the current threat landscape.

1. Implement security AI and automation

AI and automation technologies continue to cut breach costs and response times, and the gap is widening. Organizations that use them extensively saved $1.93 million per breach in 2026, while attackers used AI in one in four malicious breaches.

Attackers use AI to generate deepfake impersonations, write malware, and research vulnerabilities at scale. Security teams can respond in kind with AI-powered tools for continuous threat detection, automated triage, and faster response. These tools can:

• Analyze large volumes of data to flag anomalous activity before it becomes a breach
• Use real-time threat intelligence to block malicious URLs and files that evade traditional filters
• Reduce false positives, prioritize alerts, and orchestrate containment actions for overburdened teams
• Support layered defenses such as endpoint detection and response (EDR), MFA, and passkeys that reduce the impact of phishing and credential theft

The biggest untapped opportunity may be vulnerability management. Only 18% of breached organizations use AI agents there, even as exploitation becomes the top way breaches begin.

2. Invest in other proven mitigation tactics

Beyond AI, a handful of foundational practices consistently reduce breach risk:

• Close the patching gap. Exploitation of vulnerabilities is now the most common initial access vector, yet organizations fully remediated only 26% of known exploited vulnerabilities in 2025. Prioritize the CISA KEV catalog and internet-facing edge devices, and use vulnerability scanning to track remediation.
• Adopt DevSecOps practices. Building security into development helps teams find and fix vulnerabilities early. That's why organizations are increasingly implementing secure by design principles and requiring the same from third-party tools.
• Govern AI with established frameworks. To reduce the risk of breaches involving shadow AI and attacks on AI systems, use AI frameworks like NIST AI RMF and ISO 42001 to establish AI governance, access controls, and oversight.
• Encrypt sensitive data. Only 37% of breached organizations encrypt sensitive data both at rest and in transit, which makes encryption one of the clearest gaps to close.
• Partner with an MSSP when in-house capacity is limited. Managed Security Service Providers (MSSPs) provide proactive threat defense, specialized expertise, compliance support, and continuous monitoring, which can shorten the time to identify and contain incidents. In IBM's 2026 study, breaches identified by an MSSP cost $4.86 million on average, the lowest of any detection source.

3. Enhance incident response planning

Breach lifecycles grew longer in 2026, and breaches that took more than 200 days to contain cost $1.33 million more on average. Treating breaches as a matter of when, not if, is the first step. To be prepared, organizations need to:

• Develop a comprehensive incident response plan. Your plan should outline specific procedures for detecting, responding to, and recovering from security incidents, including communication channels, roles, and guidelines for notifying stakeholders and regulators. Use an incident response plan template to simplify the process.
• Plan for extortion, not just encryption. Ransomware actors increasingly pressure victims through brand reputation, employee data, and intellectual property. Response plans should cover public leak scenarios, not only system recovery.
• Update the plan with stakeholders. Work with stakeholders inside your organization and across your ecosystem to update plans as threats specific to your industry evolve.
• Conduct regular drills and simulations. Regular tabletop exercises help your incident response team and relevant staff learn their roles before a real breach. Use after-action reviews to refine the plan and close gaps.

4. Act now to mitigate insider threats

Insider risk costs rose to $19.5 million per organization annually, and negligence, not malice, is the fastest-growing driver. To reduce these risks, organizations should:

• Strengthen security training programs. Regular, engaging security awareness training helps employees understand the risks and their responsibilities. Include guidance on approved AI tools, since shadow AI is now a top cause of negligent incidents, and cover voice and text-based social engineering, which succeeds more often than email phishing.
• Implement strict access controls. Enforce least privilege, granting employees access only to the information and resources their jobs require. Regular access reviews prevent privilege creep. Privileged access management delivered the highest insider risk cost savings of any control in 2026.
• Secure onboarding and offboarding processes. Make sure employees have the access they need from day one and that access is promptly revoked upon termination or role change.

5. Prioritize third-party risk management

Nearly half of breaches now involve a third party, and the share grew 60% in a single year. Organizations need to:

• Conduct thorough due diligence. Before onboarding new vendors, assess their security practices through detailed security questionnaires, including their data handling practices, compliance status, and incident response capabilities.
• Implement continuous monitoring. Establish ongoing monitoring of third-party compliance with security standards and contractual obligations, including regular assessments and reviews of vendors' incident response plans.
• Create a vendor management policy. Develop a vendor management policy that sets standards and expectations for all third-party providers, including requirements for transparency, reporting, and cooperation in the event of a breach.

For defense contractors, supply chain security is also a contractual matter: prime contractors increasingly flow down CMMC requirements to their subcontractors. A structured supply chain risk management process helps organizations in any industry decide which vendor relationships introduce acceptable risk.

By addressing these risks proactively, organizations can improve their resilience against data breaches, limit potential damage, and recover faster when an incident occurs.

Protect against data breaches with Secureframe's security automation and AI

Security automation and AI are changing how organizations defend against data breaches. Secureframe gives organizations the visibility and efficiency they need to understand their risk profile, build an effective security posture, and improve resilience.

Secureframe's GRC automation platform helps organizations with:

• Continuous monitoring: Secureframe continuously monitors your security posture, flags misconfigurations and failing controls, and offers tailored remediation guidance so your organization stays secure as it scales and new threats emerge.
• AI capabilities: Use AI to assess and treat risk, remediate vulnerabilities, and automate manual processes prone to human error.
• Vendor risk management: Secureframe simplifies third-party risk management by automating vendor assessments and monitoring vendor compliance status, helping protect your organization from costly third-party breaches.
• Personnel management and training: Automate employee onboarding and offboarding to keep access secure at every step. Our platform also includes training so employees understand information security best practices and can recognize and respond to potential threats.

To learn more about Secureframe's capabilities, schedule a demo with a product expert.

This post was originally published in March 2024 and has been updated for accuracy and comprehensiveness.