--- title: "Cybersecurity Statistics 2026: Spending, Workforce and Attack Data" date: 2025-12-10 author: "Supriya Gharat" featured_image: "https://xtendedview.com/wp-content/uploads/2026/10/cybersecurity-statistics-spending-workforce-attack-data.jpg" categories: - name: "Cybersecurity" url: "/category/cybersecurity.md" tags: - name: "Statistics" url: "/tag/statistics.md" --- # Cybersecurity Statistics 2026: Spending, Workforce and Attack Data Worldwide spending on information security is expected to reach **$244 billion** in 2026, with a constant currency growth of **11.6%**, per Gartner. The [CVE Program](https://www.cve.org/about/Metrics) published **48,244** CVE Records in 2025, up from **40,077** in 2024. In the US, CyberSeek counted **514,359** online job openings for cybersecurity-related positions in 2025. Taken together, these cybersecurity statistics show security budgets and vulnerability counts both rising while hiring demand stays large. IBM’s 2026 Cost of a Data Breach Report puts the global breach average at **$4.99 million**. The figures below cover what organizations spend on security, who does the work, and how much attack activity they face. Forecasts, surveys and network telemetry are labeled as such, and none of them measures how well a single product or control protects a network. ## Key Takeaways - Security software accounts for **$121,154 million** of the **$239,759 million** total in Gartner’s July 2025 forecast for 2026, or **50.5%** of all end-user security spending. - Published CVE Records rose **20.4%** in 2025, while Gartner’s July 2025 forecast put security spending growth in 2025 at **10.1%**. - In the 2026 Verizon DBIR, exploitation of vulnerabilities accounted for **31%** of breaches, while only **26%** of critical vulnerabilities were fully remediated in 2025. - Claimed attacks rose **50%** in 2025 even as total on-chain ransomware payments fell by approximately **8%**, and the share of ransoms paid potentially reached an all-time low at **28%**, per Chainalysis. - In ISC2’s 2025 workforce study, **59%** of respondents cited critical or significant skill needs (a **15%** increase from 2024). - Employment of information security analysts is projected to grow **21%** from 2025 to 2035, with a median annual wage of **$129,180** in May 2025, per the US Bureau of Labor Statistics. - In IBM’s 2026 study, one in four malicious breaches were AI-enabled, and these breaches cost an average of **$6 million**. ## Editor’s Choice - Worldwide information security spending, 2026 forecast: **$244 billion**. - Published CVE Records, 2025: **48,244**. - Online cybersecurity job openings in the US, 2025: **514,359**. - Global average cost of a data breach, 2026 report: **$4.99 million**. - On-chain ransomware payments, 2025: more than **$820 million**. - Network-layer DDoS attacks mitigated by Cloudflare, first half of 2026: **23.2 million**. ## Cybersecurity Spending Statistics - Gartner projected worldwide end-user spending on information security to reach **$213 billion** in 2025, up from **$193 billion** in 2024. - In that July 2025 forecast, spending is estimated to increase **12.5%** in 2026 to total **$240 billion**. - Gartner’s February 2026 forecast analysis puts spending on information security at **$244 billion** in 2026. - Security software is the fastest growing segment because more companies continue to move from on-premises to cloud-based systems, Gartner said. - Security software spending is forecast to rise from **$94,960 million** in 2024 to **$121,154 million** in 2026, a **27.6%** increase over two years and **50.5%** of the 2026 total. - Gartner’s July 2025 forecast for 2025 is a **10.1%** rise over 2024 spending. - Rising threats and the expanding use of AI and generative AI (GenAI), by both internal users of AI and attackers, will remain key growth drivers, according to Gartner. | Segment | 2024 ($ millions) | 2025 ($ millions) | 2026 ($ millions) | |---|---|---|---| | Network security | 21,317 | 23,273 | 25,825 | | Security services | 77,130 | 83,812 | 92,780 | | Security software | 94,960 | 105,940 | 121,154 | | Total | 193,408 | 213,025 | 239,759 | *Source: Gartner, July 2025* ### About This Data - Compiled from 14 sources: 3 government-run statistics programs, 6 company threat reports and releases, 2 research firm forecasts, and 3 industry association and nonprofit publications. - The sources were published between July 2025 and October 2026; forecasts, surveys and network telemetry are labeled as such. - Primary releases and official data pages qualified, secondary news coverage did not, and figures are updated as sources publish new editions. ### Where will cybersecurity be in 5 years? Current forecasts point to a bigger market and a bigger workforce. Gartner’s February 2026 analysis expects spending on information security to grow to **$244 billion** in 2026. The [Bureau of Labor Statistics](https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm) projects employment of information security analysts to grow **21%** from 2025 to 2035, much faster than the average for all occupations. ## Published CVE Records by Year - The CVE Program published **48,244** CVE Records in 2025, up from **40,077** in 2024. - That is a **20.4%** year-over-year increase. - The 2025 count is **2.8 times** the **17,308** records published in 2019. - Fourth-quarter 2025 publications reached **12,796** records. - The counts are a point-in-time snapshot of published CVE Records taken after the end of each quarter, and prior quarters are recalculated to remove rejected records. PUBLISHED CVE RECORDS · Source: CVE Program metrics, 2026 PUBLISHED CVE RECORDS CVE Program · 2026 CVE Records Published by Year 50K 37.5K 25K 12.5K 0 17,308 2019 18,375 2020 20,161 2021 25,059 2022 28,961 2023 40,077 2024 48,244 2025 SOURCE CVE Program metrics, 2026 View the data| Year | Published CVE Records | |---|---| | 2019 | 17,308 | | 2020 | 18,375 | | 2021 | 20,161 | | 2022 | 25,059 | | 2023 | 28,961 | | 2024 | 40,077 | | 2025 | 48,244 | ## Recent Developments - **October 1, 2026:** Microsoft released the 2026 Digital Defense Report, which found nearly **40,000** CVEs were published in the first half of 2026, putting the year on track to roughly double. - **October 1, 2026:** In the same report, Microsoft Defender observed ClickFix-style attacker-supplied commands executed on more than **1.1 million** unique devices between February and early May 2026, roughly an eightfold increase. - **August 11, 2026:** Cloudflare’s H1 2026 DDoS Threat Report said Cloudflare mitigated a combined **935** network-layer DDoS attacks exceeding 1 Tbps in the first half of 2026, a **519%** quarter-over-quarter surge between Q1 and Q2. - **July 29, 2026:** IBM’s 2026 Cost of a Data Breach Report found one in four malicious breaches were AI-enabled, a **56%** increase over last year. - **May 19, 2026:** CIS reported that the newly released 2026 Verizon DBIR, now in its 19th year, analyzed over **31,000** security incidents and **22,000** confirmed data breaches spanning **145** countries. ## Vulnerability Statistics for 2026 - **20,709** CVE Records were published in the second quarter of 2026, compared with **11,701** in the second quarter of 2025. - That is a **77.0%** year-over-year jump for the quarter. - **15,163** records were published in the first quarter of 2026, bringing the total for the first two quarters to **35,872**. - The median time from vulnerability discovery in the wild to weaponization has fallen to well below **24 hours**, Microsoft reported. - Enterprise remediation for critical external vulnerabilities can take **30 to 60 days**. PUBLISHED CVE RECORDS · Source: CVE Program metrics, 2026 PUBLISHED CVE RECORDS CVE Program · 2026 CVE Records Published by Quarter 24K 18K 12K 6K 0 12,009 Q1 2025 11,701 Q2 2025 11,738 Q3 2025 12,796 Q4 2025 15,163 Q1 2026 20,709 Q2 2026 SOURCE CVE Program metrics, 2026 View the data| Quarter | Published CVE Records | |---|---| | Q1 2025 | 12,009 | | Q2 2025 | 11,701 | | Q3 2025 | 11,738 | | Q4 2025 | 12,796 | | Q1 2026 | 15,163 | | Q2 2026 | 20,709 | > **Key finding:** The CVE Program published 20,709 records in the second quarter of 2026, and Microsoft found the median time from vulnerability discovery in the wild to weaponization has fallen to well below 24 hours. More flaws, exploited sooner, leave security teams less time to patch each one. ## Cybersecurity Workforce and Job Openings - CyberSeek counted **514,359** online job openings for cybersecurity-related positions in 2025, a national total. - The national supply vs. demand ratio, which shows the available cybersecurity workers relative to employer demand, was **74%** in 2025. - Many projected openings for information security analysts are expected to result from the need to replace workers who transfer to different occupations or exit the labor force. - In ISC2’s 2025 study, **75%** of respondents are likely to stay at their current organization for the next 12 months, dropping to **66%** over the next two years. | Metric | Value | Source | |---|---|---| | Online cybersecurity job openings, 2025 | 514,359 | CyberSeek | | Employed cybersecurity workforce, 2025 | 1,337,400 | CyberSeek | | Supply-to-demand ratio, 2025 | 74% | CyberSeek | | Information security analyst jobs, 2025 | 192,900 | BLS | | Projected analyst openings per year, 2025-2035 | About 14,100 | BLS | | Projected analyst employment growth, 2025-2035 | 21% | BLS | *Source: CyberSeek, US Bureau of Labor Statistics* ### Is cybersecurity a dying field? No. Employment of information security analysts is projected to grow **21%** from 2025 to 2035, much faster than the average for all occupations, per the Bureau of Labor Statistics. In ISC2’s 2025 survey, **87%** believe there will always be a need for cybersecurity professionals and **81%** are confident the profession will remain strong. ## Cybersecurity Salary Statistics - The median annual wage for information security analysts was **$129,180** in May 2025, per the Bureau of Labor Statistics. - The lowest 10% earned less than **$75,090**, and the highest 10% earned more than **$199,850**. - The top-decile threshold is **2.7 times** the bottom-decile threshold. - Analysts working in the information industry had a median annual wage of **$138,650**. MEDIAN ANNUAL WAGE · Source: US Bureau of Labor Statistics, May 2025 MEDIAN ANNUAL WAGE US Bureau of Labor Statistics · 2025 Security Analyst Median Pay by Industry ($) Information $138,650 Computer systems design and related services $132,410 Finance and insurance $130,630 Management of companies and enterprises $128,950 Management, scientific, and technical consulting services $125,420 0 30K 60K 90K 120K 150K SOURCE US Bureau of Labor Statistics, May 2025 View the data| Industry | Median Annual Wage ($) | |---|---| | Information | 138,650 | | Computer systems design and related services | 132,410 | | Finance and insurance | 130,630 | | Management of companies and enterprises | 128,950 | | Management, scientific, and technical consulting services | 125,420 | ## Cybersecurity Skills Gap Statistics - In ISC2’s 2025 Cybersecurity Workforce Study, **95%** reported that they have at least one skill need (a **5%** increase from 2024). - **59%** cited critical or significant skill needs (a **15%** increase from 2024). - Nearly nine in 10 respondents (**88%**) have experienced at least one significant cybersecurity consequence because of a skills shortage, and **69%** have experienced more than one. - **72%** of respondents agree that reducing security personnel significantly increases the risk of a breach. - Reports of layoffs (**24%**) decreased by one percentage point in 2025. - Almost half (**48%**) of respondents feel exhausted from trying to stay current on the latest cybersecurity threats, and **47%** feel overwhelmed by the workload. - The study is based on online survey data collected in May and June 2025 from **16,029** cybersecurity practitioners and decision-makers. SHARE OF RESPONDENTS · Source: ISC2 2025 Cybersecurity Workforce Study SHARE OF RESPONDENTS ISC2 · 2025 Cyber Workforce Strain Indicators (%) At least one skill need 95% At least one skills-shortage consequence 88% Critical or significant skill needs 59% Budget cuts reported 36% Not enough resources to staff teams 33% Cannot afford staff with needed skills 29% 0 20 40 60 80 100 SOURCE ISC2 2025 Cybersecurity Workforce Study View the data| Finding | Share of Respondents (%) | |---|---| | At least one skill need | 95 | | At least one skills-shortage consequence | 88 | | Critical or significant skill needs | 59 | | Budget cuts reported | 36 | | Not enough resources to staff teams | 33 | | Cannot afford staff with needed skills | 29 | > **Worth noting:** ISC2 found 33% of respondents stated their organizations do not have the resources to adequately staff their teams, while CyberSeek counted 514,359 online job openings for cybersecurity-related positions. A posting count measures demand, and budgets decide how many of those roles get filled. ## How Attackers Get In: Breach Pattern Statistics - In the 2026 Verizon DBIR, [exploitation of vulnerabilities](/cybersecurity-threat-statistics/) has become the most common initial access vector, accounting for **31%** of breaches. - Only **26%** of critical vulnerabilities were fully remediated in 2025, and the median [time to resolution](/cyber-resilience-statistics/) increased to **43 days**. - The incidents described in the 2026 edition took place between November 1, 2024, and October 31, 2025. - Microsoft Defender Experts data, a separate dataset, found that user execution accounted for **30%** of observed initial access and valid accounts another **20%**. SHARE OF BREACHES · Source: Verizon 2026 DBIR, Center for Internet Security SHARE OF BREACHES Verizon · 2026 Breach Patterns in the 2026 Verizon DBIR (%) Ransomware present 48% Third-party involvement 48% Exploitation as initial access 31% Credential abuse as initial access 13% 0 10 20 30 40 50 SOURCE Verizon 2026 DBIR, Center for Internet Security View the data| Breach pattern | Share of Breaches (%) | |---|---| | Ransomware present | 48 | | Third-party involvement | 48 | | Exploitation as initial access | 31 | | Credential abuse as initial access | 13 | > **Why it matters:** In the 2026 Verizon DBIR, exploitation of vulnerabilities accounted for 31% of breaches, while only 26% of critical vulnerabilities were fully remediated in 2025. The most common way in is also a gap many organizations are slow to close, so patch speed shows up directly in breach data. ## Ransomware Statistics - Chainalysis found ransomware actors received more than **$820 million** in on-chain payments in 2025, a decline of approximately **8%** year-over-year from **$892 million**. - The 2025 total is likely to approach or exceed **$900 million** as more events and payments are attributed. - The median ransom payment grew **368%** year-over-year to nearly **$60,000**. - eCrime.ch data showed a **50%** increase in claimed ransomware victims, marking the most active year on record. - In IBM’s 2026 study, reported ransomware incidents rose to **39%**, from **34%** the year prior. | Metric | Value | Source | |---|---|---| | On-chain ransomware payments, 2025 | More than $820 million | Chainalysis | | On-chain ransomware payments, 2024 (updated) | $892 million | Chainalysis | | Share of ransoms paid, 2025 | 28% | Chainalysis | | Change in median ransom payment, 2025 | +368% | Chainalysis | | Breaches with ransomware present | 48% | Verizon 2026 DBIR | | Ransomware victims who declined to pay | 69% | Verizon 2026 DBIR | | Reported ransomware incidents | 39% (34% a year earlier) | IBM 2026 study | *Source: Chainalysis 2026, Verizon 2026 DBIR, IBM 2026* > **By the numbers:** Chainalysis found claimed attacks rose 50% while total on-chain ransomware payments fell by approximately 8%, to more than $820 million in 2025, and the 2026 Verizon DBIR found 69% of victims declined to pay. On-chain payments count only crypto ransoms, so they understate the wider [cost of cyber crime](/cyber-crime-statistics/) victims report. ## DDoS Attack Statistics - Midway through the year, Cloudflare had mitigated **23.2 million** network-layer and **29.64 trillion** HTTP DDoS requests, covering the first half of 2026. - That works out to approximately **5,343** network-layer DDoS attacks per hour, or about **128,000** per day. - During the second quarter, Cloudflare mitigated **805** network-layer attacks exceeding 1 Tbps, representing a more than six-fold increase over the previous quarter. - DNS Floods alone climbed from **25.7%** to **40.0%** of network-layer attacks quarter-over-quarter. - CLDAP Floods surged **580%** quarter-over-quarter to become the #3 vector in Q2. | Metric | Value | |---|---| | Network-layer DDoS attacks mitigated, first half of 2026 | 23.2 million | | Network-layer attacks per hour | Approximately 5,343 | | Attacks above 1 Tbps, first half of 2026 | 935 | | Attacks above 1 Tbps, second quarter of 2026 | 805 | | DNS-based share of network-layer attacks | 34.3% | | Network-layer attacks under 500 Mbps | 96.62% | | Network-layer attacks ending in under 10 minutes | 90.60% | *Source: Cloudflare DDoS Threat Report, H1 2026* ## Cost of a Data Breach Statistics - IBM’s 2026 Cost of a Data Breach Report puts the [global breach average](/data-breach-statistics/) at **$4.99 million**. - Financial services breaches were reported to cost on average **$6.3 million**, the largest value in the table below. - Companies that reported using AI and automation in security operations cut breach costs by an average of almost **$2 million**. - The 2026 report is based on breaches experienced by **602** organizations globally between March 2025 and February 2026. AVERAGE COST · Source: IBM 2026 Cost of a Data Breach Report AVERAGE COST IBM · 2026 Average Breach Cost by Group ($ millions) AI-enabled breaches $6M Financial services $6.3M Energy $5.2M Global average $4.99M 0 1.4 2.8 4.2 5.6 7 SOURCE IBM 2026 Cost of a Data Breach Report View the data| Breach group | Average Cost ($ millions) | |---|---| | AI-enabled breaches | 6 | | Financial services | 6.3 | | Energy | 5.2 | | Global average | 4.99 | ## AI in Cybersecurity Statistics - IBM found one in four malicious breaches were AI-enabled, a **56%** increase over last year. - In Ponemon Institute’s follow-on research, **85%** of organizations said they plan to increase security spending after becoming aware of advanced frontier AI cyber capabilities, compared to just **64%** that reported in the initial research that they plan to increase security spend after experiencing a breach. - More than **50%** reported using agents for threat detection and containment, while only **18%** apply agents to vulnerability management. - **28%** of ISC2 respondents have already integrated AI tools into their operations, and **69%** are engaged in adoption activities. | Metric | Value | Source | |---|---|---| | Malicious breaches that were AI-enabled | One in four | IBM 2026 study | | AI-driven attacks targeting critical infrastructure sectors | 62% | IBM 2026 study | | Organizations planning higher security spending after frontier AI awareness | 85% | IBM follow-on research, May 2026 | | Organizations applying agents to vulnerability management | 18% | IBM 2026 research | | Respondents citing AI as a top skill needed | 41% | ISC2 2025 study | | Respondents citing cloud security as a top skill needed | 36% | ISC2 2025 study | *Source: IBM 2026 Cost of a Data Breach Report, ISC2 2025 Cybersecurity Workforce Study* ## UK Cyber Breach Statistics by Business Size - The UK Cyber Security Breaches Survey 2025/2026 found just over four in ten businesses (**43%**) and around three in ten charities (**28%**) reported having experienced any kind of cyber security breach or attack in the last 12 months. - This equates to approximately **612,000** UK businesses and **57,000** UK charities. - Large businesses (**69%**) were more likely to have experienced a cyber breach or attack than [micro businesses](/small-business-cyber-attack-statistics/) (**42%**). - Phishing attacks remained the most prevalent type of breach or attack by far, experienced by **38%** of businesses and **25%** of charities. - Almost half of businesses (**47%**) reported being [insured against cyber security risks](/cyber-insurance-statistics/) in some way. - Board-level responsibility for cyber security sat at **31%** of businesses. - The survey covered **2,112** UK businesses and **1,085** UK registered charities between August and December 2025. BREACH OR ATTACK IN LAST 12 MONTHS · Source: UK Cyber Security Breaches Survey 2025/2026 BREACH OR ATTACK IN LAST 12 MONTHS UK Cyber · 2025 UK Businesses Breached by Size (%) Micro 42% Small 46% Medium 65% Large 69% 0 14 28 42 56 70 SOURCE UK Cyber Security Breaches Survey 2025/2026 View the data| Business size | Breach or Attack in Last 12 Months (%) | |---|---| | Micro | 42 | | Small | 46 | | Medium | 65 | | Large | 69 | ## Conclusion Gartner’s forecast of **$244 billion** in information security spending in 2026 shows budgets still rising, while the CVE Program’s count of **48,244** published CVE Records in 2025 shows the workload rising faster. Spending and attack data point the same way: more money is going into security, and the flaws and attacks it faces are growing at least as fast. The next readings to watch are Gartner’s next worldwide forecast update, the CVE Program’s third-quarter count and ISC2’s next workforce study, which will show whether the shift from headcount to skills holds.