Topic starter
11/07/2026 8:24 pm
TL;DR: Cybercrime losses are projected to reach $15.63 trillion by 2029, third-party involvement in breaches has doubled to 30%, and data exfiltration appears in 80% of attacks, according to Secureframe’s roundup of 210 plus cybersecurity statistics. The data points to a threat environment where visibility, supply chain control, and identity governance matter more than perimeter assumptions.
Editorial analysis by NHI Mgmt Group, based on content published by Secureframe: “Cybersecurity Kit to prepare for evolving cyber threats in 2026”.
By the numbers:
- Cybercrime losses are projected to hit $15.63 trillion by 2029, up from $10.5 trillion in 2025, according to Secureframe’s roundup of current research.
- Third-party involvement in breaches doubled to 30%, underscoring growing supply chain risk, according to Secureframe’s summary of breach statistics.
- Data exfiltration was observed in 80% of attacks, confirming data theft as a primary objective, according to Secureframe’s source roundup.
Key questions
Q: What breaks when third-party access is not reviewed continuously?
A: The break is that access stays active long after the business relationship, vendor task, or application purpose has changed.
Q: Why do attackers favour data exfiltration over immediate disruption?
A: Exfiltration is attractive because it can be done quietly through legitimate credentials and normal-looking access paths.
Q: How do security teams know whether identity controls are keeping pace with cyber risk?
A: Look for two signals: whether access can be revoked quickly enough to matter, and whether unusual access patterns are visible before data leaves the environment.
Practitioner guidance
- Strengthen third-party identity governance Inventory every vendor, support, and partner account, then assign an owner, expiry condition, and revocation path to each one.
- Treat data exfiltration as an identity problem Correlate authentication events, token use, and bulk data access so unusual reads or exports are visible before they become large-scale theft.
- Reduce standing privilege across high-risk workflows Remove persistent access where task-based access is sufficient, especially for administrators, support teams, and automation that can reach customer or production data.
Bottom line: Rising attack volume is important because it exposes whether identity, access, and data controls can sustain continuous pressure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:53 pm
Attack volume has become a governance capacity problem, not just a threat-intelligence problem: organisations are now forced to manage a constant background rate of probing, misuse, and exploitation attempts. That volume exposes whether identity, access, and data controls are continuous or merely periodic. The field should stop treating security effectiveness as a point-in-time state and start treating it as a sustained control throughput problem. Practitioners need controls that fail safely when pressure rises, not only when a breach is obvious.
A question worth separating out:
Q: What is the difference between perimeter defence and identity governance in modern attacks?
A: Perimeter defence tries to stop entry, but identity governance limits what happens after entry, especially when attackers use valid credentials or delegated access. In today’s environment, many attacks bypass the edge and move through trusted identities, partner accounts, or automation. That means the decisive control is not just blocking traffic, but constraining access scope, duration, and revocation speed.
👉 Read our full editorial: Cybersecurity statistics point to rising attack volume and breach risk