Most cybersecurity statistics quoted in board papers and vendor decks cannot be traced back to a primary report, and many that can are years out of date or describe a different population than the reader assumes. This page collects headline figures only from the publishers' own report pages, PDFs and datasets: government statistics bodies, national agencies, law enforcement and the recurring annual industry reports. Every figure is shown with its report name, publisher and as-of year, so you can check it and refresh it when the next edition appears. It is written for security leaders, analysts and anyone who needs a number they can defend, and it links to the NHI Mgmt Group statistics pages that go deeper on each theme. Last reviewed: October 2026.
Key takeaways
- Exploited vulnerabilities now lead breach entry. The Verizon 2026 Data Breach Investigations Report (DBIR) says 31% of breaches start with software vulnerabilities, overtaking stolen credentials as the top initial access route.
- Ransomware is common in breaches but less often paid. Ransomware features in 48% of breaches in the 2026 DBIR, while Verizon reports payouts shrinking and many victims declining to pay.
- Breach costs hit a record. IBM's Cost of a Data Breach Report 2026 puts the global average at USD 4.99 million, up 12% on the previous year.
- Fraud losses dwarf ransomware losses in complaint data. The FBI IC3 2025 Internet Crime Report records USD 20.877 billion in reported losses, with business email compromise at about USD 3.05 billion and ransomware complaints reporting about USD 32 million.
- Basics still decide most outcomes. In the UK Cyber Security Breaches Survey 2025/2026, 43% of businesses had a breach or attack, phishing was the most common type, and only 25% had a formal incident response plan.
Headline statistics
| Figure | Report, publisher, as-of year |
|---|---|
| 31% of breaches start with exploitation of software vulnerabilities | Data Breach Investigations Report 2026, Verizon (incidents 1 November 2024 to 31 October 2025) |
| 48% of breaches involve ransomware | Data Breach Investigations Report 2026, Verizon |
| USD 4.99 million global average cost of a data breach, up 12% | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| 1,008,597 complaints and USD 20.877 billion in reported losses | Internet Crime Report 2025, FBI Internet Crime Complaint Center (IC3) |
| 43% of UK businesses (about 612,000) and 28% of charities identified a breach or attack in the previous 12 months | Cyber Security Breaches Survey 2025/2026, UK Department for Science, Innovation and Technology (DSIT), published 30 April 2026 |
| 8,257 incidents analysed; DDoS accounted for 51.3% of recorded incidents | ENISA Threat Landscape 2026, European Union Agency for Cybersecurity (calendar year 2025) |
| 204 nationally significant incidents out of 429 handled, up from 89 | NCSC Annual Review 2025, UK National Cyber Security Centre (1 September 2024 to 31 August 2025) |
| 1,754 vulnerabilities in the Known Exploited Vulnerabilities catalogue; 270 added in 2026 to 21 October | Known Exploited Vulnerabilities Catalog, CISA (catalogue version 2026.10.21) |
| 59% of organisations report critical or significant cybersecurity skills needs, up from 44% | 2025 Cybersecurity Workforce Study, ISC2 (survey July to August 2025) |
Statistics by theme (each with primary source and as-of date)
Breaches and their cost
| Figure | Report, publisher, as-of year |
|---|---|
| Global average breach cost USD 4.99 million, described by IBM as a record high, driven by higher detection, escalation and lost business costs | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| Organisations using security AI and automation extensively saved USD 1.93 million compared with those using none | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| Breaches involving AI model inversion attacks averaged USD 6 million | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| Medium (65%) and large (69%) UK businesses were more likely to identify breaches or attacks than micro (42%) and small (46%) businesses | Cyber Security Breaches Survey 2025/2026, DSIT |
For breakdowns by industry, record type and region, see the Data Breach Statistics Guide.
Initial access and vulnerability exploitation
| Figure | Report, publisher, as-of year |
|---|---|
| 31% of breaches start with software vulnerabilities, now ahead of stolen credentials as the top initial access method | Data Breach Investigations Report 2026, Verizon |
| Vulnerability exploitation was the vector in 60.4% of unauthorised access incidents where a vector could be identified (only 5.2% of unauthorised access incidents had an identifiable vector) | ENISA Threat Landscape 2026, ENISA |
| 1,754 entries in the KEV catalogue as of 21 October 2026 | Known Exploited Vulnerabilities Catalog, CISA |
| Entries added per calendar year: 186 in 2024, 245 in 2025, 270 in 2026 to 21 October | Known Exploited Vulnerabilities Catalog, CISA (catalogue version 2026.10.21) |
| 361 KEV entries are flagged as known to be used in ransomware campaigns | Known Exploited Vulnerabilities Catalog, CISA (catalogue version 2026.10.21) |
| Microsoft products account for 390 KEV entries, followed by Cisco (101) and Apple (95) | Known Exploited Vulnerabilities Catalog, CISA (catalogue version 2026.10.21) |
Counts per vendor reflect installed base and disclosure practice as much as product quality. See the Vulnerability and Exploitation Statistics Guide and the Vulnerability Prioritisation Guide.
Ransomware and extortion
| Figure | Report, publisher, as-of year |
|---|---|
| 48% of breaches involve ransomware | Data Breach Investigations Report 2026, Verizon |
| 3,611 ransomware complaints with USD 32,320,105 in reported losses; most reported variants Akira, Qilin, INC/Lynx/Sinobi, BianLian and Play | Internet Crime Report 2025, FBI IC3 |
| Ransomware made up 47.3% of financially motivated incident claims | ENISA Threat Landscape 2026, ENISA |
| 1% of UK businesses experienced ransomware, down from 3% in each of the two previous surveys | Cyber Security Breaches Survey 2025/2026, DSIT |
IC3 losses exclude most business interruption and recovery costs and depend on victims reporting, so they understate ransomware's impact. See the Ransomware Statistics Guide and the Ransomware Prevention Guide.
Phishing, social engineering and fraud
| Figure | Report, publisher, as-of year |
|---|---|
| Phishing was the most common breach or attack type: 38% of businesses and 25% of charities | Cyber Security Breaches Survey 2025/2026, DSIT |
| Impersonation affected 12% of UK businesses, down from 17% in 2023 | Cyber Security Breaches Survey 2025/2026, DSIT |
| Phishing accounted for 77.8% of social engineering incidents, followed by malicious spam at 13% | ENISA Threat Landscape 2026, ENISA |
| 191,561 phishing and spoofing complaints | Internet Crime Report 2025, FBI IC3 |
| Business email compromise: 24,768 complaints, USD 3,046,598,558 in losses | Internet Crime Report 2025, FBI IC3 |
| Investment fraud: 72,984 complaints, USD 8,648,617,756 in losses | Internet Crime Report 2025, FBI IC3 |
| Cryptocurrency-related losses: USD 11,366,669,732 | Internet Crime Report 2025, FBI IC3 |
| Victims aged 60 and over: 201,266 complaints, USD 7.748 billion in losses | Internet Crime Report 2025, FBI IC3 |
| Mobile users show 40% higher click rates, making mobile a favoured phishing target | Data Breach Investigations Report 2026, Verizon |
See the Phishing Statistics Guide, the Business Email Compromise and Fraud Statistics Guide and the Phishing-Resistant MFA Guide.
AI in attacks and defence
| Figure | Report, publisher, as-of year |
|---|---|
| 15% of attack techniques are bolstered by generative AI | Data Breach Investigations Report 2026, Verizon |
| AI-driven attacks up 56%, led by deepfake impersonation and AI-enabled malware | Cost of a Data Breach Report 2026, IBM with Ponemon Institute |
| AI is the most pressing skills need, cited by 41% of respondents; 28% have integrated AI security tools | 2025 Cybersecurity Workforce Study, ISC2 |
See the AI Security Statistics Guide and the Deepfake and AI Impersonation Guide.
Threat landscape: who is targeted and why
| Figure | Report, publisher, as-of year |
|---|---|
| DDoS accounted for 51.3% and unauthorised access for 39.5% of recorded incidents | ENISA Threat Landscape 2026, ENISA |
| Ideology-driven (hacktivist) activity made up 57.3% of incidents; financially motivated 29.3%; cyber espionage 5.9% in the executive summary | ENISA Threat Landscape 2026, ENISA |
| Most targeted sectors: public administration 31.8%, business services 8.5%, transport 8%, manufacturing 6.9%, finance and banking 5.6% | ENISA Threat Landscape 2026, ENISA |
| About 73% of recorded incidents affected entities classed as essential | ENISA Threat Landscape 2026, ENISA |
| 429 incidents handled, 204 nationally significant (89 the year before), 18 highly significant | NCSC Annual Review 2025, NCSC (year to 31 August 2025) |
ENISA's DDoS and hacktivism shares are counts of recorded incidents, most of them low impact, not a measure of harm. See the Hacktivism Guide and the DDoS Protection Guide.
Governance, supply chain and insurance
| Figure | Report, publisher, as-of year |
|---|---|
| 31% of UK businesses (68% of large businesses) and 30% of charities have a board member or trustee responsible for cyber security | Cyber Security Breaches Survey 2025/2026, DSIT |
| 25% of businesses and 19% of charities have a formal incident response plan | Cyber Security Breaches Survey 2025/2026, DSIT |
| 15% of businesses reviewed cyber risks from immediate suppliers; 6% reviewed the wider supply chain | Cyber Security Breaches Survey 2025/2026, DSIT |
| 47% of businesses and 35% of charities have some form of cyber insurance | Cyber Security Breaches Survey 2025/2026, DSIT |
| 19% of businesses (about 267,000) and 14% of charities were victims of at least one cyber crime | Cyber Security Breaches Survey 2025/2026, DSIT |
See the Supply Chain Attack Statistics Guide, the Cyber Insurance Statistics Guide and the Third-Party Risk Management Guide.
Workforce and skills
| Figure | Report, publisher, as-of year |
|---|---|
| 95% of respondents report at least one skills need; 59% report critical (23%) or significant (36%) needs, up from 44% | 2025 Cybersecurity Workforce Study, ISC2 (16,029 respondents) |
| 24% of organisations had security layoffs, 36% budget cuts and 39% hiring freezes | 2025 Cybersecurity Workforce Study, ISC2 |
ISC2's 2025 study does not publish a global workforce gap figure, so older gap numbers should not be presented as current. See the Security Workforce and Skills Gap Statistics Guide.
Other themes
Figures for identity attacks, non-human identities and leaked secrets, cloud, insider threat and OT are covered on their own pages, where sources specific to each field are listed: the Identity Attack Statistics Guide, Non-Human Identity and Secrets Statistics Guide, Cloud Security Statistics Guide, Insider Threat Statistics Guide and OT and ICS Security Statistics Guide.
What the numbers mean for defenders
| Signal in the data | Defensive priority | Measure it with |
|---|---|---|
| Vulnerability exploitation is the leading initial access route (Verizon DBIR 2026) and KEV additions keep rising (CISA) | Patch internet-facing systems against KEV entries first; reduce exposed edge services. See the Vulnerability Management Guide. | Median days to remediate KEV-listed vulnerabilities on internet-facing assets |
| Phishing is the most common attack type (DSIT 2025/2026, ENISA 2026) and BEC losses exceed USD 3 billion (IC3 2025) | Phishing-resistant MFA for staff and administrators; out-of-band verification for payment changes | Percentage of accounts on phishing-resistant MFA; percentage of payment change requests independently verified |
| Ransomware in nearly half of breaches (Verizon DBIR 2026) | Isolated, tested backups and rehearsed recovery. See the Ransomware Response and Recovery Guide. | Time to restore a tier-1 service in the last test |
| Few organisations have incident response plans (25%) or review suppliers (15%) (DSIT 2025/2026) | Written, exercised incident plan; supplier risk tiering. See the Incident Response Guide. | Date of last tabletop; percentage of critical suppliers assessed |
| Security AI and automation linked to USD 1.93 million lower breach costs (IBM 2026) | Automate triage and containment where detections are mature | Mean time to contain, tracked quarterly |
- Use your own data first: Industry averages describe someone else's estate. Use them to frame risk, then show your own exposure: KEV backlog, MFA coverage, restore times.
- Machine credentials sit behind several of these numbers: Exploited edge devices, stolen tokens and leaked API keys all give attackers non-human access that MFA does not cover. See the Non-Human Identity (NHI) Guide.
- Small and large organisations read the same data differently: DSIT shows large businesses far more likely to detect attacks, partly because they look harder. A small business with no detected incidents may simply have no detection. Baseline schemes are a sensible floor. See the Cyber Essentials Guide.
Methodology notes and caveats
| Source | What it measures | Main caveat |
|---|---|---|
| Verizon DBIR | Confirmed breaches and incidents from Verizon's caseload and contributing partners | Contributor mix changes each year, so shifts can reflect who contributed as much as attacker behaviour |
| IBM Cost of a Data Breach | Modelled costs from interviews with breached organisations, research by Ponemon Institute | Averages are skewed by a few very costly breaches; compare like with like across editions |
| FBI IC3 Internet Crime Report | Complaints filed with IC3, mainly from the United States | Self-reported; losses are what victims report, and many incidents are never reported |
| UK Cyber Security Breaches Survey | Official statistics from a survey of UK businesses, charities and education institutions | Counts breaches organisations identified; small firms detect less. Since 2025/2026 the edition label is dual-year to match fieldwork timing |
| ENISA Threat Landscape | Incidents recorded from open sources and information shared with ENISA | Reporting period changed: the 2025 edition covered July 2024 to June 2025 (4,875 incidents); the 2026 edition covers calendar 2025 (8,257 incidents), so editions are not directly comparable |
| NCSC Annual Review | Incidents the NCSC handled, by severity category | Reflects incidents reported to the NCSC, not all UK incidents |
| CISA KEV | Vulnerabilities with reliable evidence of exploitation in the wild | Inclusion requires a clear remediation action; 2021 counts include the catalogue's initial launch load |
| ISC2 Workforce Study | Online survey of security professionals | Opinion survey, not a census; 2025 edition reports needs, not a numeric workforce gap |
- Do not mix editions: Quote the year of the report and the period it covers. A "2026" report usually describes the previous year's data.
- Percentages need their base: ENISA's 60.4% vulnerability exploitation figure is a share of a small subset of incidents with a known vector; quoting it as "60% of attacks" is wrong.
- Vendor reports are the vendor's figures: Verizon and IBM are industry publishers, not neutral statistics bodies. Attribute their numbers to them.
- What is excluded here: Figures that appear only in aggregator roundups, or that could not be found on the publisher's own page, report or dataset, were left out.
Practitioner checklist
- Cite the report name, publisher and year next to every figure you reuse.
- Check the reporting period, not only the edition year, before comparing two numbers.
- Prefer government statistics (DSIT, ENISA, NCSC, IC3) for prevalence claims and label industry figures as such.
- Pair each external statistic in a board paper with an internal metric that shows your own position.
- Track KEV-listed vulnerabilities in your estate against the catalogue each week.
- Refresh figures when new editions publish: DBIR in spring, DSIT survey in spring, IBM in summer, ENISA in autumn, NCSC review in October, IC3 in spring.
- Drop any statistic you cannot trace to its primary source.
Standards and references
- UK DSIT: Cyber Security Breaches Survey 2025/2026
- ENISA: Threat Landscape 2026
- FBI IC3: Internet Crime Report 2025
- NCSC: Annual Review 2025 release, UK experiencing four nationally significant cyber attacks every week
- CISA: Known Exploited Vulnerabilities Catalog
- Verizon: 2026 Data Breach Investigations Report
- IBM: Cost of a Data Breach Report 2026
- ISC2: 2025 Cybersecurity Workforce Study
Related NHI Mgmt Group resources: Data Breach Statistics Guide · Ransomware Statistics Guide · Non-Human Identity and Secrets Statistics Guide · Identity Attack Statistics Guide