Cybersecurity Threat Statistics 2026: The Most Important Numbers You Need to Know

Cybersecurity threats continue to expand as businesses move more operations, customer data, and critical infrastructure online. From ransomware attacks that halt manufacturing lines to phishing campaigns that target financial institutions, cybercrime now affects nearly every industry. Organizations are investing heavily in security tools, employee training, and threat intelligence to reduce risk and improve resilience. The statistics in this report highlight the latest cyber threat trends, financial impacts, and attack patterns shaping the cybersecurity landscape.

Editor’s Choice

• Global cybercrime losses reported to authorities exceeded $16 billion in 2024, representing a 33% increase from the previous year.
• The global average cost of a data breach reached $4.44 million in 2025, down from $4.88 million in 2024 due to faster detection and response capabilities.
• Organizations using extensive security AI and automation reduced breach-related costs by approximately $1.9 million per incident.
• The average U.S. data breach cost climbed to $10.22 million in 2025, remaining the highest national average globally.
• Healthcare remained the costliest sector for breaches, with an average incident cost of $7.42 million in 2025.
• More ransomware victims refused to pay attackers in 2025, with 63% declining ransom demands, up from 59% in 2024.
• AI-assisted phishing and deepfake attacks became mainstream, with one-sixth of analyzed breaches involving attackers who used AI tools.

Recent Developments

• The global average breach cost declined in 2025 for the first time in five years after organizations expanded AI-powered security deployments.
• Security AI reduced average breach detection and containment times by 51 days compared with organizations that lacked advanced automation.
• IBM research found organizations using AI extensively incurred average breach costs of $3.62 million, versus $5.52 million for organizations without similar tools.
• Ransomware groups expanded rapidly during 2025, reaching 124 active groups, including 73 newly identified operations.
• Publicly disclosed ransomware attacks reached a record 7,458 incidents in 2025.
• Global ransomware payments fell to approximately $813 million in 2024, down from $1.25 billion in 2023.
• Shadow AI emerged as a growing enterprise risk, contributing to around 20% of analyzed breaches in IBM’s 2025 research.
• Breaches linked to unauthorized AI usage added an average of $670,000 in additional costs per incident.
• AI-generated phishing campaigns reduced attack preparation times from roughly 16 hours to just five minutes.

Top 10 Cybersecurity Threats of 2026

• AI-assisted autonomous attacks are expected to become one of the most serious cybersecurity threats in 2026, as attackers use automation to scale campaigns faster.
• Identity abuse and credential compromise remain major risks, showing that stolen passwords, weak authentication, and account takeovers will continue to threaten businesses.
• Supply chain attacks are a top concern because one compromised vendor or software provider can expose multiple connected organizations.
• Deepfake and synthetic identity fraud are emerging as major risks, especially for financial fraud, fake verification, and executive impersonation.
• Adversarial AI and data poisoning highlight the growing threat of attackers manipulating AI systems, training data, and decision-making models.
• AI-enhanced phishing and social engineering will make scam messages more convincing, personalized, and harder for users to detect.
• Ransomware 3.0 and intelligent extortion suggest that ransomware groups are becoming more advanced, using data theft, pressure tactics, and targeted negotiation.
• DDoS megascale operations show that large-scale traffic attacks could disrupt websites, cloud services, and critical digital platforms.
• IoT and edge vulnerabilities remain a key threat as more connected devices create new entry points for cybercriminals.
• Post-quantum cryptographic pressure signals that organizations must prepare for future risks to encryption and long-term data protection.

Global Cybercrime Trends and Financial Impact

• Cybercrime complaints processed through official reporting channels approached 860,000 reports in 2024.
• Reported cybercrime losses surpassed $16 billion globally in 2024.
• FBI data showed cybercrime losses increased by roughly 33% year over year in 2024.
• Investment fraud remained one of the largest contributors to cybercrime-related financial losses.
• Phishing and business email scams continued to rank among the most expensive cybercrime categories.
• Academic research published in 2026 estimated worldwide cybercrime damages at approximately $500 billion annually, with a potential range between $100 billion and $1 trillion.
• Researchers estimated that a 20% increase in cybercrime activity could create an additional $100 billion in annual damages globally.
• Financial services organizations experienced average breach costs of $6.08 million in 2024, exceeding the global average by 22%.
• Industrial-sector breaches averaged $5.56 million per incident in 2024, reflecting an 18% annual increase.

Phishing and Social Engineering Attack Rates

• Phishing remained the leading initial attack vector, accounting for 18% of all breach entry points in India during 2025.
• Security teams required an average of 261 days to effectively identify and contain a phishing-related data breach.
• Approximately 16% of all analyzed data breaches involved attackers utilizing AI-enhanced techniques during 2025.
• AI-generated phishing and synthetic communications accounted for 37% of all observed AI-driven attack types in breach reports.
• Generative AI tools significantly reduced phishing campaign preparation time from 16 hours to just five minutes.
• Deepfake-enabled social engineering tactics represented 35% of the AI-driven attack activity tracked by researchers.
• Ransomware deployment relies heavily on human-centric entry, with 54% of infections directly initiated through phishing campaigns.
• Phishing-driven financial losses remain a top security concern, with total global costs projected to exceed $25 billion annually by 2026.
• Human-related errors and social engineering, primarily phishing, contribute to 60% of all major security breaches globally.

Cyber Risks Are Increasing Fastest Around AI, Fraud, and Supply Chains

• AI vulnerabilities are seen as the fastest-growing cyber risk, with 87% of respondents saying they increased in the past year.
• Cyber-enabled fraud and phishing ranked second, with 77% reporting an increase and only 2% seeing a decrease.
• Supply chain disruption remains a major concern, as 65% said this risk increased, while 32% viewed it as unchanged.
• Software vulnerability exploitation is still rising, with 58% reporting an increase and 39% saying the risk stayed neutral.
• Ransomware attacks continue to grow, with 54% of respondents saying the threat increased over the past year.
• Insider threats showed a more mixed trend, as only 32% reported an increase, while a large 61% said the risk stayed the same.
• Denial-of-service attacks had the lowest increase rate at 28%, but also the highest decrease rate at 18%.
• The data shows that organizations are most worried about emerging and scalable threats, especially AI risks, phishing, and supply chain attacks.
• Traditional cyber risks such as insider threats and denial-of-service attacks appear more stable compared with fast-rising external threats.
• Overall, the chart suggests that cyber risk perception is shifting toward AI-driven vulnerabilities, fraud tactics, and third-party ecosystem risks.

Ransomware Frequency and Payout Statistics

• Publicly disclosed ransomware attacks reached 7,458 incidents in 2025, the highest level on record.
• The number of active ransomware groups climbed to 124 in 2025.
• Seventy-three ransomware groups emerged during 2025 alone.
• Global ransomware payments dropped to $813 million in 2024, compared with $1.25 billion in 2023.
• Approximately 64% of ransomware victims refused to pay attackers in 2024.
• The share of victims refusing payment increased to 63% in 2025, according to IBM research.
• The median ransomware payment declined to $115,000 in 2024, down from $150,000 in 2023.
• Organizations involving law enforcement avoided ransomware payments in 63% of cases.
• The average recovery cost, excluding ransom payments, fell to $1.53 million in 2025.
• U.S. organizations recorded 1,536 disclosed ransomware incidents in 2025, the highest national total reported.

Malware Proliferation and Trends

• Security researchers detected more than 560,000 new malware samples daily during 2025, highlighting the scale of automated malware generation.
• The total number of known malware programs exceeded 1.5 billion samples worldwide in 2025.
• Malware accounted for approximately 58% of all cyberattacks observed against organizations globally during 2024.
• Cryptojacking incidents increased by 22% year over year in 2025 as attackers targeted cloud infrastructure and enterprise servers.
• Malware-free attacks represented 79% of detected intrusions in 2025, demonstrating attackers’ growing use of legitimate tools instead of traditional malware.
• Remote access trojans (RATs) ranked among the fastest-growing malware categories, increasing by 46% in 2025.
• Mobile malware attacks surpassed 33 million blocked attempts globally during 2024.
• Banking trojan activity increased by 29% year over year in 2025 as cybercriminals focused on financial institutions.
• Fileless malware attacks were responsible for nearly three-quarters of successful endpoint compromises in enterprise environments.
• Infostealer malware infections became one of the leading causes of credential theft, contributing to millions of compromised accounts in 2025.

Geographical Distribution of Cyberattacks

• The United States was the most frequently attacked country, accounting for 39% of global cyberattacks.
• China ranked second with 14% of cyberattacks, showing a large gap compared with the United States.
• India held the third position, receiving 9% of cyberattacks worldwide.
• Germany accounted for 6% of cyberattacks, making it the most targeted country in the listed European markets.
• The United Kingdom ranked fifth, with 5% of cyberattacks reported.
• The top five countries together represented 73% of total cyberattacks, showing a strong concentration of attacks in major economies.
• The United States alone faced more attacks than China, India, Germany, and the United Kingdom combined.
• The data shows that cybercriminals are heavily targeting countries with large digital economies, critical infrastructure, and high-value business networks.
• Asia had two major countries in the ranking, with China at 14% and India at 9%.
• Europe also showed notable exposure, with Germany and the United Kingdom together accounting for 11% of cyberattacks.

Business Email Compromise (BEC) Statistics

• Business email compromise remained among the costliest cybercrimes, generating more than $2.9 billion in reported losses during 2024.
• BEC scams accounted for over 21,000 complaints filed with authorities during 2024.
• Organizations experienced an average BEC-related loss exceeding $137,000 per incident in 2025.
• Nearly 70% of BEC attacks involved executive impersonation or spoofed business identities.
• Attackers increasingly use AI-generated messages, making fraudulent emails more convincing and harder to detect.
• More than 50% of BEC campaigns targeted finance departments and accounts payable teams in 2025.
• Organizations with multifactor authentication reduced successful BEC attacks by more than 99% compared with password-only environments.
• Vendor invoice fraud represented one of the fastest-growing BEC techniques, increasing by 30% year over year.
• Around 40% of organizations reported at least one BEC attempt each month during 2025.
• Financial services, manufacturing, and healthcare remained the most frequently targeted sectors for BEC attacks.

Cloud Security and Environment Intrusions

• Approximately 82% of data breaches involved information stored in cloud environments during 2025.
• Misconfigured cloud resources contributed to nearly 15% of cloud-related security incidents worldwide.
• Cloud environment compromises required an average of 241 days to identify and contain in 2025.
• Public cloud spending exceeded $720 billion globally in 2025, expanding the attack surface available to cybercriminals.
• Nearly 39% of organizations experienced a cloud data breach during the previous 12 months.
• Human error remained a leading cloud security challenge, cited by 68% of surveyed organizations.
• More than 60% of organizations reported exposing sensitive cloud data due to configuration mistakes.
• Identity-based attacks represented the primary cloud intrusion method in over 80% of investigated incidents.
• Cloud security spending increased by more than 20% year over year in 2025 as organizations responded to rising threats.
• Organizations implementing zero-trust cloud controls reduced breach costs by an average of $1 million or more.

Insider Threat Incidents Are Mostly Caused by Human Error

• Negligent or mistaken insiders account for the largest share of insider threat incidents at 55%.
• This shows that most insider risks are not always intentional, but often linked to employee mistakes, poor security habits, or accidental data exposure.
• Malicious insiders make up 25% of incidents, highlighting the continued risk of employees or contractors intentionally abusing access.
• Credential theft represents 20% of insider threat incidents, showing how stolen logins remain a major security weakness.
• The data suggests that organizations should prioritize employee training, access controls, and behavior monitoring to reduce insider risks.
• Since negligent behavior drives more than half of all insider incidents, cybersecurity strategies must focus strongly on human error prevention.
• Malicious insider activity still represents one in four incidents, making privilege management and user activity tracking essential.
• Credential theft at 20% shows the importance of multi-factor authentication, password hygiene, and phishing protection.
• Overall, insider threats are a mix of mistakes, intentional misuse, and stolen credentials, requiring a layered security approach.

Zero-Day Vulnerability and Exploit Data

• Researchers identified 90 actively exploited zero-day vulnerabilities in 2025, representing a 15% increase from the previous year.
• Enterprise technologies accounted for 48% of all tracked zero-day exploitation throughout 2025.
• Security and networking devices remained primary targets, comprising over 60% of enterprise-specific zero-day exploitation in 2024.
• Nation-state groups were linked to at least 10 attributed zero-day attacks in 2025, doubling the activity recorded in 2024.
• Operating systems were the most exploited product category in 2025, representing 44% of all recorded zero-day activity.
• Browser-based exploitation continued to decline, accounting for less than 10% of tracked zero-day exploits during 2025.
• Approximately 29% of known exploited vulnerabilities in 2025 were weaponized on or before the day of CVE publication.
• Vulnerability exploitation served as the initial access method for 20% of data breaches reported in 2025.
• Organizations utilizing continuous vulnerability management programs reported a reduction in exploit-related incidents by over 40%.

Supply Chain and Third-Party Attack Metrics

• Supply chain attacks increased by approximately 15% globally during 2025.
• More than 70% of organizations experienced a significant disruption caused by a third-party cybersecurity incident.
• Third-party involvement appeared in 30% of the analyzed data breaches during 2025.
• Organizations with third-party breach involvement incurred average costs of $5.08 million per incident.
• Open-source software repositories faced over 245,000 malicious package uploads in 2024 and 2025 combined.
• Software supply chain attacks increased by over 200% compared with pre-2020 levels.
• Around 98% of organizations maintained relationships with vendors that had experienced a breach during the previous two years.
• Vendor access abuse and credential compromise remained the leading causes of third-party intrusions.
• The average organization now relies on more than 250 third-party vendors with access to sensitive systems or data.
• Third-party risk management programs reduced supply chain breach costs by approximately $370,000 per incident.

Data Breach Costs by Industry

• Healthcare had the highest average data breach cost at $9.80 million, making it the most expensive industry for breach recovery.
• The average breach cost in healthcare increased by 10.6% year over year, showing rising pressure on patient data security.
• Financial services ranked second, with an average breach cost of $6.08 million.
• Breach costs in financial services rose only 2.3%, making it the slowest-growing cost increase among industries with positive growth.
• Manufacturing recorded an average breach cost of $5.56 million, with a sharp 18.0% year-over-year increase.
• Retail had the lowest average breach cost among the listed sectors at $3.48 million.
• Despite having the lowest breach cost, retail saw an 18.0% increase, matching manufacturing for the highest annual growth rate.
• Education reported an average breach cost of $3.65 million, slightly higher than retail.
• Education was the only industry with a decline, as breach costs fell by 10.6% year over year.
• The data shows that healthcare, financial services, and manufacturing remain the most financially exposed sectors for data breaches.

Small Business Cybersecurity Vulnerability Data

• Approximately 43% of cyberattacks target small businesses, making them one of the most frequently targeted organization types.
• Nearly 60% of small businesses that suffer a major cyberattack close within six months of the incident.
• Around 51% of small businesses reported experiencing at least one cyberattack during the previous year.
• Fewer than 20% of small businesses have a dedicated cybersecurity specialist on staff.
• Phishing remained the most common attack method against small organizations, accounting for more than one-third of reported incidents in 2025.
• About 47% of small businesses reported difficulty maintaining adequate cybersecurity budgets.
• More than 40% of ransomware victims in 2025 were organizations with fewer than 250 employees.
• Small businesses using multifactor authentication reduced account compromise incidents by more than 90%.
• Only 32% of small organizations conducted regular cybersecurity awareness training for employees in 2025.
• Recovery costs following a significant cyber incident often exceeded $120,000 for small businesses, creating substantial financial pressure.

Human Error and Security Awareness Statistics

• 68% of investigated data breaches in 2025 were attributed to human actions.
• 70% of employees demonstrated reduced phishing susceptibility after completing mature security awareness training.
• 74% of organizations identified human error as their top cybersecurity concern throughout 2025.
• 33% of employees explicitly admitted to bypassing security policies to enhance their productivity.
• Organizations conducting quarterly training experienced a 50% lower phishing click rate compared to those using only annual sessions.
• Data shows that 85% of all cybersecurity breaches involve a human element at some point in the chain.
• Businesses with continuous training programs reported a 40% reduction in total breach costs.
• Studies indicate that 60% of successful data breaches originate from insider negligence rather than malicious intent.
• Approximately 90% of all phishing attempts succeed because of human interaction with malicious links.
• Companies with formal security awareness initiatives observed a 45% improvement in the speed of incident containment.

Detection and Response Time Metrics

• The global average breach lifecycle for identifying and containing a security incident is 241 days.
• Organizations utilizing extensive security AI and automation reduced their breach containment time by an average of 80 days.
• Data breaches resolved in less than 200 days cost organizations $1.02 million less on average compared to longer lifecycles.
• Adopting Zero Trust architectures has been shown to improve incident response efficiency by 39% and threat detection speed by 40%.
• Security orchestration and automation platforms can reduce mean time to respond and alert investigations by up to 70%.
• Insider threats often require an average of 81 days to contain once security teams identify unusual behavior.
• Organizations that detected breaches internally significantly reduced total response costs compared to those alerted by external third parties.
• A faster breach containment timeline is consistently correlated with a 23% lower financial loss across major industries.
• High-performing security operations centers that leverage automation resolve critical threats significantly faster than manual-only teams.
• Deploying cloud-focused incident response programs provides a measurable reduction in investigation times for complex cloud intrusions.

Impact of Artificial Intelligence on Cyber Threats

• One-sixth of the analyzed cyber incidents in 2025 involved attackers using AI during some stage of the attack lifecycle.
• AI-generated phishing accounted for approximately 37% of observed AI-enabled attack activity.
• Deepfake-enabled fraud represented around 35% of AI-assisted attacks tracked during 2025.
• Generative AI reduced phishing campaign creation times from roughly 16 hours to five minutes.
• Shadow AI contributed to approximately 20% of the investigated security breaches in 2025.
• Organizations affected by unauthorized AI use incurred an average additional breach cost of $670,000.
• Security teams increasingly adopted AI-powered threat detection, reducing breach lifecycles by 51 days on average.
• Organizations extensively deploying security AI reported average breach costs of $3.62 million, compared with $5.52 million for organizations with limited AI use.
• AI-assisted malware development accelerated the creation of customized attack tools targeting specific industries.
• More than 70% of security leaders expected generative AI to significantly influence both cyber defense and cybercrime over the next two years.

Cybersecurity Workforce and Skills Gap Statistics

• The global cybersecurity workforce gap exceeded 4.8 million professionals in 2024 and remained elevated entering 2026.
• The worldwide cybersecurity workforce grew to approximately 5.5 million professionals, yet demand continued to outpace supply.
• About 67% of organizations reported moderate-to-critical cybersecurity staffing shortages.
• Nearly 92% of security leaders stated that workforce shortages increased organizational cyber risk.
• More than 60% of organizations struggled to recruit experienced cloud security specialists.
• Security teams experiencing staffing shortages reported higher burnout rates and longer response times.
• Women represented roughly 25% of the global cybersecurity workforce in recent workforce studies.
• Entry-level cybersecurity hiring increased during 2025 as organizations sought to address long-term talent shortages.
• Organizations investing in workforce development programs reported stronger security outcomes than those relying primarily on external hiring.
• Cybersecurity remains one of the fastest-growing technology employment sectors globally.

Why Cybersecurity Breach Incidents Go Unreported

• Fear of reputational damage is the leading reason cybersecurity breaches go unreported, accounting for around 44% of cases.
• About 41% of organizations avoid reporting breaches because they believe internal teams can manage the incident privately.
• Unclear or unsafe reporting procedures contribute to nearly 37% of unreported cybersecurity incidents.
• The data shows that many organizations prioritize brand protection and internal control over public disclosure after a breach.
• A smaller but serious share, around 8%, said incidents were intentionally hidden due to job security concerns.
• The findings suggest that underreporting is often driven by fear, process gaps, and internal pressure rather than a lack of breach awareness.
• Organizations may reduce underreporting by building clear, safe, and confidential incident reporting procedures.
• The high share of reputation-related concerns highlights the need for stronger breach transparency policies and crisis communication planning.

Government and Nation-State Sponsored Attack Data

• Over 60% of nation-state campaigns are primarily driven by intelligence gathering rather than immediate financial gain.
• Total recovery costs per cybersecurity breach reached an average of $2.73 million by the year 2024.
• Annual ransomware payments hit a record-breaking $1.1 billion in 2023 as attackers targeted diverse organizations.
• Government cybersecurity budget allocations for specific security projects in major economies grew significantly, reaching 790 crore in 2026 projections.
• State-backed cyber programs from countries like the PRC, Russia, and Iran continue to represent the greatest strategic threats globally.
• Critical infrastructure sectors, including energy and telecommunications, experienced a marked rise in coercive cyber-attack attempts throughout 2025.
• Investment in AI-driven cybersecurity missions saw massive funding increases, with some national allocations reaching 1000 crore for 2026 development.
• Sophisticated threat actors now frequently utilize a wider ecosystem of commercial surveillance vendors to mask their offensive operations.
• Public-sector organizations remain highly susceptible to advanced persistent threats due to their role in holding essential national data.
• Cybersecurity governance adoption has been statistically linked to a significant increase in risk-taking capacity and improved corporate reputation for organizations.

IoT and Connected Device Vulnerability Statistics

• The number of connected IoT devices worldwide reached 21.9 billion in 2026.
• Connected IoT devices face approximately 820,000 malicious attack attempts every single day.
• Global IoT malware attacks surged by 124% year-over-year in 2025 due to rapid adoption.
• Routers serve as the primary gateway for 75% of all observed IoT-related cyberattacks.
• Industrial IoT security incidents increased by 75% over the past two years in critical sectors.
• 83% of medical imaging devices currently run on unsupported or outdated operating systems.
• Manufacturing and transportation sectors combined represented 40% of all IoT malware incidents in 2025.
• 77% of hospital systems contain known and exploited vulnerabilities within their connected networks.
• The average cost of a single IoT security incident is estimated at $330,000 per event.
• 67% of organizations continue to identify security as the primary barrier to expanding their IoT deployments.

Frequently Asked Questions (FAQs)

Conclusion

Cybersecurity threats continued to evolve rapidly, with ransomware, phishing, cloud intrusions, and AI-assisted attacks driving much of the risk landscape. While organizations improved detection times and reduced some breach costs through automation and AI-powered defenses, attackers also adopted the same technologies to increase scale and sophistication.

Several trends stand out. First, human error remains one of the largest contributors to breaches despite growing security awareness investments. Second, cloud environments, third-party ecosystems, and connected devices continue to expand the attack surface. Third, the cybersecurity workforce shortage remains a major challenge as organizations struggle to hire enough skilled professionals.

Looking ahead, companies that combine employee education, AI-driven security operations, zero-trust architectures, and proactive risk management will be better positioned to defend against emerging threats. As cybercrime costs continue to rise globally, cybersecurity is increasingly becoming a business resilience priority rather than simply an IT function.