Cybersecurity Statistics 2026: Spending, Workforce and Attack Data

Worldwide spending on information security is expected to reach $244 billion in 2026, with a constant currency growth of 11.6%, per Gartner. The CVE Program published 48,244 CVE Records in 2025, up from 40,077 in 2024. In the US, CyberSeek counted 514,359 online job openings for cybersecurity-related positions in 2025. Taken together, these cybersecurity statistics show security budgets and vulnerability counts both rising while hiring demand stays large.

IBM’s 2026 Cost of a Data Breach Report puts the global breach average at $4.99 million. The figures below cover what organizations spend on security, who does the work, and how much attack activity they face. Forecasts, surveys and network telemetry are labeled as such, and none of them measures how well a single product or control protects a network.

Key Takeaways

• Security software accounts for $121,154 million of the $239,759 million total in Gartner’s July 2025 forecast for 2026, or 50.5% of all end-user security spending.
• Published CVE Records rose 20.4% in 2025, while Gartner’s July 2025 forecast put security spending growth in 2025 at 10.1%.
• In the 2026 Verizon DBIR, exploitation of vulnerabilities accounted for 31% of breaches, while only 26% of critical vulnerabilities were fully remediated in 2025.
• Claimed attacks rose 50% in 2025 even as total on-chain ransomware payments fell by approximately 8%, and the share of ransoms paid potentially reached an all-time low at 28%, per Chainalysis.
• In ISC2’s 2025 workforce study, 59% of respondents cited critical or significant skill needs (a 15% increase from 2024).
• Employment of information security analysts is projected to grow 21% from 2025 to 2035, with a median annual wage of $129,180 in May 2025, per the US Bureau of Labor Statistics.
• In IBM’s 2026 study, one in four malicious breaches were AI-enabled, and these breaches cost an average of $6 million.

Editor’s Choice

• Worldwide information security spending, 2026 forecast: $244 billion.
• Published CVE Records, 2025: 48,244.
• Online cybersecurity job openings in the US, 2025: 514,359.
• Global average cost of a data breach, 2026 report: $4.99 million.
• On-chain ransomware payments, 2025: more than $820 million.
• Network-layer DDoS attacks mitigated by Cloudflare, first half of 2026: 23.2 million.

Cybersecurity Spending Statistics

• Gartner projected worldwide end-user spending on information security to reach $213 billion in 2025, up from $193 billion in 2024.
• In that July 2025 forecast, spending is estimated to increase 12.5% in 2026 to total $240 billion.
• Gartner’s February 2026 forecast analysis puts spending on information security at $244 billion in 2026.
• Security software is the fastest growing segment because more companies continue to move from on-premises to cloud-based systems, Gartner said.
• Security software spending is forecast to rise from $94,960 million in 2024 to $121,154 million in 2026, a 27.6% increase over two years and 50.5% of the 2026 total.
• Gartner’s July 2025 forecast for 2025 is a 10.1% rise over 2024 spending.
• Rising threats and the expanding use of AI and generative AI (GenAI), by both internal users of AI and attackers, will remain key growth drivers, according to Gartner.

Source: Gartner, July 2025

About This Data

• Compiled from 14 sources: 3 government-run statistics programs, 6 company threat reports and releases, 2 research firm forecasts, and 3 industry association and nonprofit publications.
• The sources were published between July 2025 and October 2026; forecasts, surveys and network telemetry are labeled as such.
• Primary releases and official data pages qualified, secondary news coverage did not, and figures are updated as sources publish new editions.

Where will cybersecurity be in 5 years?

Current forecasts point to a bigger market and a bigger workforce. Gartner’s February 2026 analysis expects spending on information security to grow to $244 billion in 2026. The Bureau of Labor Statistics projects employment of information security analysts to grow 21% from 2025 to 2035, much faster than the average for all occupations.

Published CVE Records by Year

• The CVE Program published 48,244 CVE Records in 2025, up from 40,077 in 2024.
• That is a 20.4% year-over-year increase.
• The 2025 count is 2.8 times the 17,308 records published in 2019.
• Fourth-quarter 2025 publications reached 12,796 records.
• The counts are a point-in-time snapshot of published CVE Records taken after the end of each quarter, and prior quarters are recalculated to remove rejected records.

Recent Developments

• October 1, 2026: Microsoft released the 2026 Digital Defense Report, which found nearly 40,000 CVEs were published in the first half of 2026, putting the year on track to roughly double.
• October 1, 2026: In the same report, Microsoft Defender observed ClickFix-style attacker-supplied commands executed on more than 1.1 million unique devices between February and early May 2026, roughly an eightfold increase.
• August 11, 2026: Cloudflare’s H1 2026 DDoS Threat Report said Cloudflare mitigated a combined 935 network-layer DDoS attacks exceeding 1 Tbps in the first half of 2026, a 519% quarter-over-quarter surge between Q1 and Q2.
• July 29, 2026: IBM’s 2026 Cost of a Data Breach Report found one in four malicious breaches were AI-enabled, a 56% increase over last year.
• May 19, 2026: CIS reported that the newly released 2026 Verizon DBIR, now in its 19th year, analyzed over 31,000 security incidents and 22,000 confirmed data breaches spanning 145 countries.

Vulnerability Statistics for 2026

• 20,709 CVE Records were published in the second quarter of 2026, compared with 11,701 in the second quarter of 2025.
• That is a 77.0% year-over-year jump for the quarter.
• 15,163 records were published in the first quarter of 2026, bringing the total for the first two quarters to 35,872.
• The median time from vulnerability discovery in the wild to weaponization has fallen to well below 24 hours, Microsoft reported.
• Enterprise remediation for critical external vulnerabilities can take 30 to 60 days.

Key finding: The CVE Program published 20,709 records in the second quarter of 2026, and Microsoft found the median time from vulnerability discovery in the wild to weaponization has fallen to well below 24 hours. More flaws, exploited sooner, leave security teams less time to patch each one.

Cybersecurity Workforce and Job Openings

• CyberSeek counted 514,359 online job openings for cybersecurity-related positions in 2025, a national total.
• The national supply vs. demand ratio, which shows the available cybersecurity workers relative to employer demand, was 74% in 2025.
• Many projected openings for information security analysts are expected to result from the need to replace workers who transfer to different occupations or exit the labor force.
• In ISC2’s 2025 study, 75% of respondents are likely to stay at their current organization for the next 12 months, dropping to 66% over the next two years.

Source: CyberSeek, US Bureau of Labor Statistics

Is cybersecurity a dying field?

No. Employment of information security analysts is projected to grow 21% from 2025 to 2035, much faster than the average for all occupations, per the Bureau of Labor Statistics.

In ISC2’s 2025 survey, 87% believe there will always be a need for cybersecurity professionals and 81% are confident the profession will remain strong.

Cybersecurity Salary Statistics

• The median annual wage for information security analysts was $129,180 in May 2025, per the Bureau of Labor Statistics.
• The lowest 10% earned less than $75,090, and the highest 10% earned more than $199,850.
• The top-decile threshold is 2.7 times the bottom-decile threshold.
• Analysts working in the information industry had a median annual wage of $138,650.

Cybersecurity Skills Gap Statistics

• In ISC2’s 2025 Cybersecurity Workforce Study, 95% reported that they have at least one skill need (a 5% increase from 2024).
• 59% cited critical or significant skill needs (a 15% increase from 2024).
• Nearly nine in 10 respondents (88%) have experienced at least one significant cybersecurity consequence because of a skills shortage, and 69% have experienced more than one.
• 72% of respondents agree that reducing security personnel significantly increases the risk of a breach.
• Reports of layoffs (24%) decreased by one percentage point in 2025.
• Almost half (48%) of respondents feel exhausted from trying to stay current on the latest cybersecurity threats, and 47% feel overwhelmed by the workload.
• The study is based on online survey data collected in May and June 2025 from 16,029 cybersecurity practitioners and decision-makers.

Worth noting: ISC2 found 33% of respondents stated their organizations do not have the resources to adequately staff their teams, while CyberSeek counted 514,359 online job openings for cybersecurity-related positions. A posting count measures demand, and budgets decide how many of those roles get filled.

How Attackers Get In: Breach Pattern Statistics

• In the 2026 Verizon DBIR, exploitation of vulnerabilities has become the most common initial access vector, accounting for 31% of breaches.
• Only 26% of critical vulnerabilities were fully remediated in 2025, and the median time to resolution increased to 43 days.
• The incidents described in the 2026 edition took place between November 1, 2024, and October 31, 2025.
• Microsoft Defender Experts data, a separate dataset, found that user execution accounted for 30% of observed initial access and valid accounts another 20%.

Why it matters: In the 2026 Verizon DBIR, exploitation of vulnerabilities accounted for 31% of breaches, while only 26% of critical vulnerabilities were fully remediated in 2025. The most common way in is also a gap many organizations are slow to close, so patch speed shows up directly in breach data.

Ransomware Statistics

• Chainalysis found ransomware actors received more than $820 million in on-chain payments in 2025, a decline of approximately 8% year-over-year from $892 million.
• The 2025 total is likely to approach or exceed $900 million as more events and payments are attributed.
• The median ransom payment grew 368% year-over-year to nearly $60,000.
• eCrime.ch data showed a 50% increase in claimed ransomware victims, marking the most active year on record.
• In IBM’s 2026 study, reported ransomware incidents rose to 39%, from 34% the year prior.

Source: Chainalysis 2026, Verizon 2026 DBIR, IBM 2026

By the numbers: Chainalysis found claimed attacks rose 50% while total on-chain ransomware payments fell by approximately 8%, to more than $820 million in 2025, and the 2026 Verizon DBIR found 69% of victims declined to pay. On-chain payments count only crypto ransoms, so they understate the wider cost of cyber crime victims report.

DDoS Attack Statistics

• Midway through the year, Cloudflare had mitigated 23.2 million network-layer and 29.64 trillion HTTP DDoS requests, covering the first half of 2026.
• That works out to approximately 5,343 network-layer DDoS attacks per hour, or about 128,000 per day.
• During the second quarter, Cloudflare mitigated 805 network-layer attacks exceeding 1 Tbps, representing a more than six-fold increase over the previous quarter.
• DNS Floods alone climbed from 25.7% to 40.0% of network-layer attacks quarter-over-quarter.
• CLDAP Floods surged 580% quarter-over-quarter to become the #3 vector in Q2.

Source: Cloudflare DDoS Threat Report, H1 2026

Cost of a Data Breach Statistics

• IBM’s 2026 Cost of a Data Breach Report puts the global breach average at $4.99 million.
• Financial services breaches were reported to cost on average $6.3 million, the largest value in the table below.
• Companies that reported using AI and automation in security operations cut breach costs by an average of almost $2 million.
• The 2026 report is based on breaches experienced by 602 organizations globally between March 2025 and February 2026.

AI in Cybersecurity Statistics

• IBM found one in four malicious breaches were AI-enabled, a 56% increase over last year.
• In Ponemon Institute’s follow-on research, 85% of organizations said they plan to increase security spending after becoming aware of advanced frontier AI cyber capabilities, compared to just 64% that reported in the initial research that they plan to increase security spend after experiencing a breach.
• More than 50% reported using agents for threat detection and containment, while only 18% apply agents to vulnerability management.
• 28% of ISC2 respondents have already integrated AI tools into their operations, and 69% are engaged in adoption activities.

Source: IBM 2026 Cost of a Data Breach Report, ISC2 2025 Cybersecurity Workforce Study

UK Cyber Breach Statistics by Business Size

• The UK Cyber Security Breaches Survey 2025/2026 found just over four in ten businesses (43%) and around three in ten charities (28%) reported having experienced any kind of cyber security breach or attack in the last 12 months.
• This equates to approximately 612,000 UK businesses and 57,000 UK charities.
• Large businesses (69%) were more likely to have experienced a cyber breach or attack than micro businesses (42%).
• Phishing attacks remained the most prevalent type of breach or attack by far, experienced by 38% of businesses and 25% of charities.
• Almost half of businesses (47%) reported being insured against cyber security risks in some way.
• Board-level responsibility for cyber security sat at 31% of businesses.
• The survey covered 2,112 UK businesses and 1,085 UK registered charities between August and December 2025.

Conclusion

Gartner’s forecast of $244 billion in information security spending in 2026 shows budgets still rising, while the CVE Program’s count of 48,244 published CVE Records in 2025 shows the workload rising faster. Spending and attack data point the same way: more money is going into security, and the flaws and attacks it faces are growing at least as fast.

The next readings to watch are Gartner’s next worldwide forecast update, the CVE Program’s third-quarter count and ISC2’s next workforce study, which will show whether the shift from headcount to skills holds.