Cyber Security Statistics and Facts (2026)

Introduction

Cyber Security Statistics: Cybersecurity has become a top priority for organizations worldwide, driven by the escalating volume and complexity of cyber threats. As businesses increasingly adopt digital technologies, the risk of cyberattacks, such as data breaches, ransomware, and phishing, has risen, creating significant challenges for data privacy and security.

The increasing frequency of high-profile cyber incidents has exposed vulnerabilities in various sectors, prompting governments and organizations to enhance their cybersecurity measures. In response, emerging technologies such as artificial intelligence and machine learning are being integrated to enhance threat detection and response capabilities.

The following statistics offer a comprehensive overview of the cybersecurity landscape, shedding light on the trends, risks, and developments that are shaping this critical field.

Editor’s Choice

• Email remains the primary distribution channel for malware, accounting for 94% of incidents.
• Cyberattacks occur every 39 seconds on average, highlighting the rapid pace of threats.
• Hackers stole a total of $29 million from a fintech company in a recent attack.
• Ransomware breaches typically take 49 days longer to identify and resolve compared to other attack types.
• WordPress plugins are responsible for 97% of security breaches in the online ecosystem.
• Ongoing hacks have resulted in the theft of $3 billion in cryptocurrency.
• 66% of Chief Information Officers (CIOs) plan to boost their cybersecurity investments moving forward.
• According to cybersecurity statistics for remote work, 74% of IT professionals view it as a significant risk to overall security.

(Source: University of North Georgia, Spin AI, Tripwire)

General Cybersecurity Statistics

• 46% of global cyber incidents impact businesses with fewer than 1,000 employees.
• In 2023, over 40% of small businesses reported experiencing a cyberattack.
• Approximately 33% of small businesses rely on free cybersecurity solutions instead of professional-grade services.
• Over 70% of global cybersecurity incidents were driven by ransom demands.
• According to 2021 cyberattack data, Phishing was responsible for over 40% of breaches, with malware contributing 11% and hacking 22%.
• More than 300 billion passwords are currently in use worldwide.
• Over 40% of the global population remains offline, making them highly vulnerable when they connect to the internet.
• The global cybersecurity workforce is projected at approximately 4.7 million professionals.
• 33% of organizations plan to increase their cybersecurity budgets over the next year.
• Cybersecurity Ventures predicts a shortage of 3.5 million unfilled cybersecurity positions by 2025.
• Only 4% of organizations feel confident in their ability to protect connected devices and technologies from cyberattacks.
• In 2021, the median salary for information security analysts was $102,600 annually.
• The lowest 10% of information security analysts earned under $61,520, while the highest 10% earned more than $165,920.
• As of July 2022, Chief Information Security Officers (CISOs) earned an average annual salary of $170,980.
• It’s projected that 56,500 cybersecurity jobs will be created between 2021 and 2031.
• Information security analyst roles are expected to grow by 35% from 2021 to 2031, much faster than the average growth rate.

(Source: National University, Embroker, Inc., Sprinto)

Cyber Security Market Size

Pin

• According to Market.us, the cyber security market is projected to grow from $215.9 billion in 2024 to $608.3 billion by 2033, representing a compound annual growth rate (CAGR) of 12.2% from 2024 to 2033.
• The growth of this market is driven by the growing sophistication of cyber threats, which compels constant advancements and informs the development of security technologies. Government compliance and regulations values that mandate improved data protection measures.
• In 2023, the Solutions segment led the cybersecurity market with an over 57.6% share, driven by increasing demand for firewalls, antivirus, IDS, and encryption.
• In 2023, the On-premises segment held a dominant 62.4% market share, appealing to organizations seeking high control and data privacy.
• In 2023, the Network Security segment captured over 30% of the market, driven by a rise in cyber threats targeting enterprise networks.
• In 2023, large enterprises held a significant 69.2% share of the cybersecurity market, supported by substantial resources for advanced security solutions.
• In 2023, the BFSI sector dominated the cybersecurity market with a 25% share, driven by the critical need to protect sensitive financial data.
• In 2023, North America led the cyber security market with a 36.8% share and USD 70.8 billion in revenues, driven by top cybersecurity firms and innovation.

(Source: Market.us)

Healthcare Cybersecurity Market Size

Pin

• According to Market.us, the healthcare cybersecurity market is projected to grow from $20.6 billion in 2025 to $71.4 billion by 2034, representing a compound annual growth rate (CAGR) of 14.8% from 2025 to 2043.
• The growth of the healthcare cybersecurity market is driven by increasing healthcare data breaches, rising adoption of IT solutions, and demand for cloud-based security.
• 55.6% of the Healthcare Cybersecurity Market share in 2024 was dominated by the Services segment, driven by the increasing demand for managed security services.
• 19.7% of the market share in 2024 was held by cyber insurance (IAM) due to its critical role in ensuring secure access to sensitive patient data.
• Malware was the dominant threat in the healthcare cybersecurity market, accounting for 25.9% of the market share in 2024, with healthcare organizations being prime targets for ransomware attacks.
• Hospitals represented the largest end-user segment in 2024, holding 40.2% of the market share, driven by their vast patient data repositories and essential services.
• North America led the market with a 30% share in 2023.

(Source: Market.us)

Cybersecurity Trends and CISO Insights

• 75% of detected identity attacks in 2023 were malware-free, involving tactics like phishing, social engineering, and leveraging trusted relationships. This marks an increase from 62% in 2021 and 40% in 2019.
• In 2023, devices such as edge gateway devices were the most common initial point of network access for attackers.
• 82% of Chief Information Security Officers (CISOs) would consider becoming whistleblowers if their organization neglected security and compliance, putting the business at risk.
• Generative AI is expected to be used for cyber activities in 2024.
• 84% of CISOs fear personal liability for cybersecurity incidents.
• 35% of CISOs are already utilizing AI for security applications, and 61% plan to adopt AI in the next year.
• Cloud environment intrusions surged by 75% in the past year.

Pin

• Cases involving cloud-conscious threats increased by 110% year-over-year.
• The number of victims listed on eCrime leak sites rose by 76%.
• 86% of CISOs believe that generative AI will help address security skills gaps and talent shortages.
• 39% of CISOs plan to train their teams to understand better the cybersecurity risks associated with generative AI.
• Spam emails saw a 15% decrease year-over-year.
• Only 35% of CISOs report that their boards assign satisfactory cybersecurity budgets.
• 4 in 5 CISOs observed an increase in cyber threats as the economy declined.
• 84% of cloud-conscious intrusions by adversaries were linked to likely eCrime actors, while only 16% were attributed to targeted intrusion actors.
• 31% of CISOs reported delays or cancellations of security projects due to insufficient funding.

Pin

(Source: National University, Verizon, Norton, Viking Cloud, Inc.)

Data Breach Trends

Pin

(Source: Marketing VF Ltd.

Cybersecurity Threats – by Type

Phishing attack

• 57% of organizations report experiencing phishing attempts on a weekly or daily basis.
• Phishing emerged as the leading cause in 41% of security breaches, marking it as the most frequent initial attack method.
• 26% of phishing attacks targeted vulnerabilities in public-facing applications.
• Phishing incidents are responsible for over 80% of all reported cybersecurity breaches.
• A phishing attack costs businesses $17,700 every minute.
• Phishing is the most prevalent email attack technique, accounting for 39.6% of all email-related security threats.
• 96% of phishing attacks are carried out through email communication.
• 30% of small businesses identify phishing as their primary cybersecurity threat.
• IBM’s 2023 report revealed that phishing attacks cost companies an average of $4.9 million per breach.
• In November 2022, Google blocked more than 231 billion phishing and spam emails.
• The 18-24 age group was the most vulnerable to falling for phishing emails in 2022.
• Half of the individuals who were tricked by phishing emails cited tiredness or distraction as the main reason for their mistakes.
• Over 85% of mobile phishing attacks were executed outside of email via messaging apps, social networks, or games.
• The financial services sector faced five times more phishing attempts than any other industry in 2022.
• In November 2023, 682 different brands fell victim to phishing spoofing attacks.

(Source: National University, Varonis, Embroker, Inc., GreatHorn, International Business Machines Corporation, CSO Online)

Malware and Ransomware Statistics

• In 2022, a staggering 5.4 billion malware attacks occurred worldwide.
• Approximately 4 out of 10 malware attacks result in the leakage of sensitive data.
• Over 70% of malware attacks target specific individuals or organizations.
• The average ransom demand surged significantly from $812,380 in 2022 to $1,542,333 in 2023.
• Threat actors execute an average of 11.5 attacks per minute, according to Parachute.
• In March 2023, the number of ransomware victims was nearly double that of the previous year.
• A large majority (92%) of malware is delivered via email.
• Above 300,000 Android managers have downloaded banking trojan apps from the Google Play Store.
• In the first half of 2022, there were 2.8 billion malware attacks.
• The VBA Trojan was the most frequently encountered malware variant in 2022.
• Iran was the most affected country by mobile malware attacks.
• Spyware was the most common type of malware targeting individual victims.
• The US experienced the highest number of malware attacks annually, 9 times more than the UK.
• 70% of organizations report that their users are exposed to malware ads while browsing.
• Around 24,000 malicious mobile apps are blocked daily across the internet.
• Approximately 20% of newly observed domains that were resolved were flagged as malicious in the first half of 2022.
• Nearly 47.4% of all internet traffic in 2022 came from bots, marking a 5.1% increase from 2021.
• From November 2021 to October 2022, Microsoft Office applications were the most exploited applications, accounting for 70% of attacks. (Statista)
• 94% of malware is distributed via email.
• In the first half of 2022, nearly 79 million domains were flagged as malicious by researchers based on newly observed domain data.
• The average cost of recovering from a ransomware attack in 2024 is projected to be $2.73 million.
• Only 8% of businesses that pay a ransom to hackers manage to recover all of their data.
• From November 2021 to October 2022, Microsoft Office applications were the most frequently targeted, accounting for 70% of exploited applications.
• 75% of organizations experienced at least one ransomware attack in the previous year.
• Despite advancements in technology, ransomware accounted for 72% of cybersecurity attacks in 2023.
• 83% of businesses affected by ransomware chose to pay the ransom following an attack.
• More than half of the organizations paid over $100,000 in ransom following an attack.
• 52% of businesses reported experiencing a ransomware attack that severely impacted their systems and operations.
• 82% of data breaches involved cloud-based data, with ransomware being the leading cause.
• The average ransom in 2023 reached $1.54 million, nearly double the amount from 2022.
• As of 2023, over 72% of businesses worldwide were affected by ransomware attacks.
• IBM reported that it takes an average of 49 days to detect a ransomware attack.
• Ransomware-as-a-service (RaaS) is on the rise, with 67 active RaaS operations detected in the first half of 2022.
• The proportion of ransomware attacks has decreased from 21% in 2021 to 17% in 2023.
• In the first half of 2023, ransomware extortion resulted in an additional $176 million compared to the total extortion amount in 2022.

(Source: National University, Tech Jury, Infosecurity Mag, Statista, Verizon, Imperva, Akamai, Sophos)

Business Email Compromise (BEC) Statistics

• In 2022, 34% of all cyberattacks were identified as Business Email Compromise (BEC) attacks.
• 52% of individuals fell for phishing links, believing a senior executive sent them.
• 19% of all data breaches are attributed to Business Email Compromise (BEC).
• BEC attacks resulted in damages totalling $1.8 billion in 2021.
• The most common method of extracting funds from BEC attacks was through gift card requests, which accounted for 68% of cases.
• 29% of companies lost a client in 2022 due to a Business Email Compromise attack.

(Source: National University, Tech Jury)

Other Attacks Statistics

• 6,248 DDoS attacks were recorded in 2022, making them the most prevalent incident type
• The most common types of cyber threats involve the use of stolen cards, followed by ransomware and phishing.
• Application-layer DDoS attacks saw a 15% increase in the second quarter of 2023.
• Incidents targeting cryptocurrency firms surged by an astonishing 600% in the first quarter of 2023, alongside a 15% rise in HTTP DDoS attacks.
• Internal actors are responsible for 19% of all data breaches.
• The global number of IoT attacks reached over 10.54 million in December 2022.
• Nearly 58% of IoT-related attacks were carried out with the intent of cryptocurrency mining.
• On average, a smart home could face over 12,000 hacker attacks per week.
• In 2021, 30% of known zero-day vulnerabilities were targeted at mobile devices.
• 43% of all breaches are caused by insider threats, whether intentional or unintentional.
• Hackers exposed over 24 billion passwords in 2022, with 64% of these passwords consisting of only 8 to 11 characters.

(Source: National University, Verizon, Norton, Check Point, Purplesec, Statista, Cloudflare)

Cybersecurity Statistics by Industry

Cybersecurity Challenges in the Financial Sector

• Financial services institutions are facing an increase in cyber incidents due to outdated or imperfect asset data, which delays the effective mitigation of cyber threats.
• The two primary cyber threats in the education sector are software vulnerabilities and phishing, accounting for 29% and 30% of overall attacks, respectively.
• The average cost of a data breach in the finance sector is $5.85 million.
• On average, a financial services employee has access to 13% of the company’s total files.
• The finance industry ranks as the second most targeted sector for basic web application attacks.
• 63% of financial institutions reported a rise in destructive cyber attacks.
• Cyber attacks in the finance sector most commonly result in the leak of confidential information (64%) and disruption of core activities (40%).
• Data breaches within the financial sector are among the most costly to resolve.
• 64% of successful cyber attacks in the financial sector are ransomware-related.
• 57% of banking executives have identified cybersecurity as their top priority for this year.

(Source: KPMG, Varonis, Fortra, LLC, CSI, Banking Exchange, Blaze Infosec, International Business Machines Corporation,  PT Security, Infosecurity Magazine)

Cybersecurity Challenges in the Healthcare Sector

• Between 2020 and 2024, the cost of healthcare data breaches increased by 53.3%.
• In February 2024, a massive cyberattack targeted Change Healthcare, a subsidiary of UnitedHealth Group, marking one of the largest attacks on the healthcare sector. This attack resulted in disruptions at 94% of hospitals.
• The Change Healthcare breach compromised sensitive health information for over 190 million Americans. (2024)
• In January 2025, the US Department of Health and Human Services received 61 data breach reports from healthcare providers.
• 75% of healthcare data breaches reported in the first half of 2023 were due to hacking incidents.
• 21% of healthcare data breaches were caused by unauthorized access or disclosure, representing a 133% increase from 2022.
• The average cost of a healthcare data breach reached $10.10 million, representing a 9.4% increase from previous years, which is significantly higher than the average cost in other industries.
• Nearly two-thirds of healthcare organizations have faced a supply chain attack in the past two years, resulting in a 70% increase in disruptions to patient care.
• Over 93% of healthcare organizations have experienced at least one data breach in recent years, with 57% reporting more than five breaches.
• Healthcare ransomware attacks have surged by 264% over the past five years, making
• Hospitals and healthcare providers are prime targets for cybercriminals.
• 62% of hospital administrators feel inadequately prepared or undertrained to handle a cybersecurity breach.
• There has been a 239% increase in major breaches related to hacking in the healthcare sector over the last four years.
• The average cost of a healthcare breach is approximately $408 per patient record, excluding financial losses resulting from business disruption, reduced productivity, and damaged reputation.
• Data breaches in healthcare have led to a 64% increase in advertising costs as organizations seek to reassure consumers.
• Medical devices in healthcare institutions are found to have an average of 6.2 cybersecurity vulnerabilities each
• Healthcare institutions allocate 4-7% of their budget to cybersecurity, compared to an average of 15% in other sectors.

(Source: SafetyDetectives, BDO, Fortra, Becker, Hospital Review, Chief Healthcare Executive, FierceHealthcare, Black Book Research, Cybersecurity Ventures, AJMC)

Cybersecurity Challenges in the Education Sector

• 66% of educational institutions have experienced a ransomware attack.
• 61% of education respondents feel moderately or highly prepared to handle cybersecurity incidents and minimize downtime.
• Only 4% of educational institutions managed to recover 100% of their data after paying the ransom.
• 50% of education organizations had to employ various restoration methods to recover data after a ransomware attack.
• 65% of higher education institutions have prioritized data security as their primary focus for the year.
• 79% of higher education institutions reported feeling ransomware attacks within the past year, with exploited vulnerabilities and compromised credentials being the primary causes.
• 62% of education administrators face challenges in recruiting qualified cybersecurity staff.
• The average cost to resolve a ransomware attack in higher education amounts to $1.42 million.
• 47% of education respondents indicated that their cyber insurance policy plays a significant role in shaping their cybersecurity strategy, although 21% lack such a policy.
• According to the US Government Accountability Office, ransomware attacks can result in learning time losses ranging from 3 days to 3 weeks.

Pin

(Source: US Government Accountability Office, Sophos, Chronicle, Higher Ed Dive, Educause, EdTech Magazine Cadre Information Security)

Cybersecurity Challenges in the Energy Sector

• In 2023, 90% of the world’s leading energy companies experienced third-party data breaches.
• Cyberattacks targeting US utilities increased by 70% from September 2023 to September 2024.
• Nearly 60% of cyberattacks in the energy sector were attributed to state-affiliated actors.
• The average cost of a cyberattack on the energy sector was $4.72 million per incident in 2022.
• The energy sector remains highly vulnerable to social engineering attacks, with 60% of all data breaches in this industry resulting from phishing.
• In late 2023, a coordinated cyberattack targeted 22 energy firms as part of a large-scale attack on Danish infrastructure.

(Source: Parachute)

Cost of Cyberattacks

• 95% of cybersecurity incidents at small and medium businesses (SMBs) result in costs ranging from $826 to $653,587.
• Half of SMBs report that it took 24 hours or more to recover from a cyberattack.
• In a survey, 51% of small businesses indicated their website was down for 8 to 24 hours following an attack.
• 55% of US consumers would be less likely to continue doing business with companies that have experienced a data breach.
• Nearly 40% of small businesses reported losing critical data as a result of a cyberattack.
• 51% of small businesses affected by ransomware opted to pay the ransom demand.
• 75% of SMBs stated they could not continue operations if a ransomware attack hit them.
• A survey of US small businesses from late 2021 revealed that only 17% had insurance to cover costs in the event of a cyber breach.
• 48% of those businesses did not purchase cyber insurance until after an attack, and 64% of respondents were unfamiliar with cyber insurance.

(Source: StrongDM)

Cybersecurity Workforce Challenges

• The global cybersecurity workforce currently consists of 5.5 million professionals, but there is a need for an additional 5 million experts to address the skills gap.
• 44% of cybersecurity professionals have less than three years of experience, a result of high turnover rates and intense competition in recruitment.
• 46% of organizations report having unfilled cybersecurity positions at mid-to-senior levels, highlighting a significant talent shortage.
• Around 40% of C-level executives plan to leverage AI to help mitigate the shortage of critical cybersecurity skills.
• 63% of organizations are planning to implement emerging technologies, such as AI, to alleviate the cybersecurity workforce shortage.
• The demand for cybersecurity experts is highest in regions such as the Asia-Pacific, the Middle East, Africa, and North America.
• The employment growth for IT security analysts is projected to be 29% higher than the average demand for all other jobs entering 2023.
• 41% of organizations have already adopted AI to help address the growing cybersecurity skills gap.
• Projections estimate that 17,300 IT security analyst positions will open each year over the next decade.
• By 2028, it is predicted that AI will reduce the essentials for entry-level cybersecurity roles by up to 50%.
• By 2026, 70% of boards are expected to include at least one member with cybersecurity expertise.
• In 2023, the global cybersecurity workforce faced a shortage of 3.5 million unfilled jobs.
• Cybersecurity Security Specialists, an entry-level role, earn an average salary of $102,677.
• 46% of companies reported having more than 10 unfilled cybersecurity positions as of 2024, according to a Cisco survey.
• Cybersecurity job growth is projected to increase by 35% over the next decade.
• Women represent just 24% of the cybersecurity workforce.
• 71% of organizations report being impacted by the cybersecurity skills gap.
• 68% of organizations identify staffing issues as the biggest threat to achieving their cybersecurity goals.
• 67% of small and medium businesses lack the in-house expertise to handle a data breach.
• 61% of mid-sized businesses operate without dedicated cybersecurity staff, and 47% of cybersecurity leaders acknowledge training gaps or critical skill shortages within their teams.

Pin

(Source: Asseco, Gartner, Cybercrime Magazine, Monster, Arctic Wolf, Cisco, Monster, AAG IT, Help Net Security)

Cybersecurity Awareness Trends 

• Over the past 12 months, 72% of businesses and 68% of charities maintained cybersecurity as a high priority, consistent with the previous two years.
• Awareness of UK government cybersecurity initiatives has decreased over time, particularly among micro businesses. The breakdown by campaign is as follows:
• Cyber Aware campaign: 24% of businesses and 26% of charities.
• 10-step guidance: 12% of businesses and 15% of charities.
• Cyber Essentials: 12% of businesses and 15% of charities.
• In 2023, 70% of security awareness practitioners reported dedicating half or less of their working time to security awareness.
• Only 14% of security awareness practitioners devote 90% or more of their time to security awareness tasks.
• While 75% of respondents had a security awareness budget, only 25% were aware of the details of their budget.
• 39% of organization leaders approve that “cybersecurity is a key business enabler.” (World Economic Forum)
• 56% of cyber leaders meet with business leaders monthly or more often to discuss cyber-related topics.
• 69% of organizations believe top executives have a clear understanding of how cybersecurity is managed.
• 66% of respondents from the manufacturing and transportation sectors view cybersecurity as an afterthought within their organizations. Additionally, 65% of manufacturing and 56% of transportation respondents confirmed that efforts are often siloed.
• Only 48% of manufacturing and 53% of transportation executives involve cybersecurity in broader corporate strategy discussions.
• 59% of small businesses surveyed do not use security awareness training.
• 65% of IT professionals believe their cybersecurity awareness training programs require expansion.
• When asked about responses to cyber attacks, 39% of experts said they intensified employee training.

(Source: Secureframe, ThriveDX, SANS Institute, UK Government,  World Economic Forum, LevelBlue, Hiscox)

Recent Cyber Attacks

(Source: hereinafter)

Conclusion

Cybersecurity remains a key focus for most organisations, yet notable gaps in training, strategic alignment, and awareness persist, particularly among small businesses and specific industries. Although many businesses recognize the importance of cybersecurity, only a few fully incorporate it into their strategies or allocate sufficient resources for training.

The increasing number of cyber threats underscores the urgent need for ongoing investments in cybersecurity, stronger leadership involvement, and comprehensive employee training to enhance resilience and protect vital data.

FAQ’s