Cybercrime costs, stolen credentials and AI: what should teams prioritise?

TL;DR: Global cybercrime costs are projected to hit $10.5 trillion in 2026, while stolen credentials drive 31% of breaches and organizations need 277 days on average to identify and contain incidents, according to Ordr's 2026 cybersecurity data analysis. The governance challenge is no longer awareness but reducing dwell time, standing trust and recovery delay before losses compound.

Editorial analysis by NHI Mgmt Group, based on content published by Ordr: “Cybersecurity Statistics 2026 Report”.

By the numbers:

• Global cybercrime costs are projected to reach $10.5 trillion in 2026.
• Organizations need an average of 277 days to identify and contain security incidents.
• Stolen credentials account for 31% of breaches and carry an average cost impact of $4.50 million.

Key questions

Q: What breaks when compromised credentials are still accepted by identity systems?

A: When compromised credentials are still accepted, detection becomes a post-exploitation signal rather than a control.

Q: Why do breaches involving compromised credentials usually become so expensive?

A: Compromised credentials are expensive because attackers can look like legitimate users while moving through normal workflows.

Q: What are the signs that incident detection is failing?

A: Common signs include breaches that remain undiscovered for months, repeated account abuse across multiple systems and recovery work that starts only after data loss or backup disruption.

Practitioner guidance

• Harden credential entry points Enforce phishing-resistant MFA for privileged and high-risk accounts, and verify that service accounts do not rely on shared or static authentication paths.
• Measure time to identify and contain Track detection and containment as separate metrics, then set escalation targets for identity-related incidents where reused credentials or privilege misuse are suspected.
• Protect backup and recovery paths Isolate backup repositories from the same trust domain as production access, and ensure restore privileges are tightly scoped and monitored.

Bottom line: Stolen credentials, slow detection and poor recovery posture are combining to make breach economics worse even when attackers use simple entry methods.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →