Cybersecurity Statistics (2026): 38 Sourced Figures

This page collects figures on the broad state of cybersecurity: what attacks cost, how breaches start, how fast flaws get fixed, who does the work and how much organizations spend. Every number links to the document that first published it. The main sources are the FBI, CISA, NIST, the US Bureau of Labor Statistics, the UK government and the insurance regulators’ association NAIC. Breach cost and breach cause figures come from two long-running vendor studies, IBM and Verizon. They are labeled as vendor-reported. Ransomware and identity theft are covered on their own pages in the StatWharf research directory, so this page gives only headline figures for them.

Method

The data window runs from 2024 to October 2026. StatWharf used primary sources only. That means government agencies, a body of insurance regulators, a professional membership body, an analyst firm’s press release and the publisher of each named study. Statistics aggregators and blogs that re-quote other sources were excluded. Each figure was checked against its source on October 11, 2026. Figures that did not appear on their primary source were dropped. One example is a US average breach cost. It appears in secondary coverage of the IBM 2026 study but not on IBM’s own public pages. No value on this page is modeled, estimated or calculated by StatWharf.

Two cautions apply throughout. First, government complaint data counts only what victims report to it. The FBI notes that some victims do not report any loss amount. Second, the IBM and Verizon studies describe the organizations in their own datasets. They are not random samples of all companies.

Cybercrime reported to the FBI

The FBI Internet Crime Complaint Center (IC3) publishes an annual count of cybercrime complaints from US victims. The 2025 report was released in April 2026. It covers both individuals and businesses.

Cyber-enabled fraud accounted for US$17.697 billion of the 2025 losses. IC3 says it now receives almost 3,000 complaints per day. Phishing is the most reported crime type by count. It is not the most costly. Business email compromise, in which a criminal poses as a supplier or executive to redirect a payment, produced far larger losses from far fewer complaints. The 2025 report is also the first to tag complaints that involved artificial intelligence. It counted 22,364 of them.

The ransomware loss figure in the IC3 report is low by design. The FBI states that it does not normally include lost business, time, wages, files, equipment or third-party remediation. Some victims also report no loss amount at all.

Data breach costs and causes

Two annual vendor studies supply most of the breach figures that journalists and security teams quote. IBM sponsors the Cost of a Data Breach study, which Ponemon Institute conducts. The 2026 edition covers breaches at 602 organizations globally between March 2025 and February 2026. Verizon publishes the Data Breach Investigations Report (DBIR). Its 2026 edition examines more than 31,000 security incidents, of which more than 22,000 were confirmed data breaches. Law enforcement, forensic firms, insurers and others contributed the data. Both are vendor-reported.

IBM describes the US$4.99 million average as a record high and a 12% increase over the prior year. It attributes the rise to higher detection, escalation and lost business costs. One in four malicious breaches in the study was AI-enabled, mostly through deepfake impersonation and AI-enabled malware.

The DBIR finding on initial access is the main change of 2026. Exploited vulnerabilities overtook stolen credentials as the most common way in. Credential abuse fell to 13% of breaches. The “human element” covers social engineering, errors and the use of stolen credentials. It rose slightly from 60% the previous year. Verizon’s dataset runs from late 2024 to late 2025.

The human element figure is the closest primary answer to a common question: what share of breaches are caused by human error? Verizon does not report a single “human error” share. Its human element measure includes people who were tricked as well as people who made mistakes.

Vulnerabilities and patching

Vulnerability counts come from three US government sources. CISA keeps the Known Exploited Vulnerabilities (KEV) catalog, a list of flaws confirmed to be exploited in real attacks. NIST runs the National Vulnerability Database (NVD), which adds analysis to each published CVE record. CISA’s scanning service for critical infrastructure measures what is exposed on the internet. Verizon’s DBIR adds data on how fast organizations fix KEV flaws.

NIST changed how the NVD works in April 2026 because of the volume of new records. It says it enriched nearly 42,000 CVEs in 2025, 45% more than in any prior year. NIST says this was still not enough to keep up. The remediation data points the same way. The share of KEV flaws fully fixed fell from 38% the year before, and the median time to fix rose from 32 days.

CISA’s review states that most threat activity in fiscal 2024 and 2025 came from opportunistic criminals. They scanned the internet for exposed flaws. Groups using unknown zero-day exploits were the smaller part. Its scanning service enrolled 10,890 organizations in fiscal 2025. Organizations that track this backlog across many assets usually use dedicated tooling for discovery, prioritization and patch tracking.

The cybersecurity workforce

The Bureau of Labor Statistics counts one core security occupation, information security analysts. Its two main series measure different things. The Occupational Outlook Handbook counts jobs. The Current Population Survey counts employed people by the occupation they report, so its total is higher. ISC2, a membership body for security professionals, surveys the wider field each year.

BLS describes the projected growth as much faster than the average for all occupations. The Current Population Survey puts the number of employed information security analysts at 261,000 in 2025. Its 2025 averages cover 11 months, because October 2025 data were not collected during the federal government shutdown.

The ISC2 study drew on 16,029 practitioners and decision-makers. Respondents are self-selected and are not a random sample. The share citing critical or significant skills needs rose from 44% in 2024. ISC2 did not publish a workforce gap estimate in 2025. It said respondents now rank missing skills above missing headcount. On remote work, 31% of respondents said they prefer to work fully remote, against the 23% who do.

Security spending and cyber insurance

Gartner publishes the most quoted forecast of security spending. Its latest public press release with a worldwide total dates from July 2025. Later updates are sold to clients and were not used here. The NAIC collects cyber insurance data from insurers’ annual statements. Its 2025 report covers calendar 2024.

Gartner forecast 2026 growth of 12.5%. Security software is the largest and fastest-growing segment. Gartner links its growth to the move from on-premises systems to cloud services.

The NAIC reports that 2024 was the first year in which US cyber premium fell, by 7%. The 2023 total was US$9.84 billion. Policies in force stayed flat. The number of claims rose almost 40% to nearly 50,000. The NAIC does not publish an average premium per policy. Buyers who want a price for their own cover need a quote.

Small businesses

The best official source on small business cyber incidents is the UK government’s Cyber Security Breaches Survey. It is a random-probability survey of 2,112 UK businesses and 1,085 charities, carried out from August to December 2025. It was published on April 30, 2026. No US federal agency publishes a comparable annual survey. The DBIR adds a breakdown of breaches at small and medium-sized businesses.

The 43% rate equals about 612,000 UK businesses. It was unchanged from the prior year. It was 50% two years earlier. Larger firms report more incidents, partly because they have more systems and better detection.

Most UK incidents were cheap. The median perceived cost of the most disruptive breach was £0 for businesses. The survey notes that a minority of cases carry high costs. That contrast with the IBM average is expected. IBM studies breaches of sensitive records at mostly larger organizations, while the UK survey counts every attack a business noticed, including blocked phishing emails.

What the figures show

Three points stand out. First, reported losses keep rising. US victims reported US$20.877 billion in losses to the FBI in 2025, up 26% in a year. The vendor estimate of an average breach also reached a record at US$4.99 million.

Second, unpatched software is now the leading way in. Exploited vulnerabilities started 31% of breaches in the DBIR dataset. Only 26% of known exploited flaws were fully fixed, and new CVE submissions have grown 263% since 2020.

Third, the workforce is growing but stretched. BLS projects 21% growth in information security analyst jobs over ten years, while 59% of ISC2 respondents report critical or significant skills gaps.

Where to go next

The figures on exploited vulnerabilities and slow patching are the main reason organizations buy vulnerability management tools. Security teams that size a patching program can compare products on the StatWharf page for vulnerability management software. It sets out scanning scope, prioritization method and published pricing for each product. It does not name a single best product. Other statistics pages are listed in the research directory.

The next update follows three releases: the FBI IC3 report for 2026, the 2027 Verizon DBIR and the next NAIC cyber insurance report. Corrections to any figure can be sent to the editorial address below.

Factual corrections are free: editorial@statwharf.com.