2026 Cybersecurity Benchmarks: Detection, Cost, Spending & Risk Data

In October 2026, the Inovo InfoSec research team analyzed 21 industry reports and benchmark studies, covering breach and survey data from 2021 through mid-2026, to set the reference values organizations use to measure detection speed, breach cost, security investment, and risk exposure. Core sources include IBM's 2026 Cost of a Data Breach Report, which studied 602 breached organizations between March 2025 and February 2026;¹ Verizon's 2026 Data Breach Investigations Report, which covers more than 22,000 confirmed breaches in 145 countries;²⁰ Mandiant's M-Trends 2026, built on more than 500,000 hours of incident response work in 2025;¹⁶ KnowBe4's analysis of 42 million phishing simulations at 64,000 organizations;³¹ and IANS Research and Artico Search's survey of more than 500 security executives.³⁸ The scope covers organizations of all sizes, with breakouts for industry, company size, and security program maturity.

Key Cybersecurity Benchmarks

Figure 1. Average Cost of a Data Breach, Global vs. United States, 2022 to 2026

Source: IBM Cost of a Data Breach Report, 2022 to 2026 editions.¹˒¹²˒¹³ Each edition reports breaches from the prior 12 to 13 months.

Key takeaways:

• The US average cost of a breach rose from $9.44 million to $11.5 million across five report editions.¹³˒¹²

• The global average reached a record $4.99 million in 2026, up 12% after a one-year dip to $4.44 million.¹˒¹²

• US organizations now pay more than twice the global average per breach.¹²

• This article covers performance benchmarks, the numbers used to compare one security program with another. It does not cover CIS Benchmarks, which are configuration hardening standards. The table below presents the core benchmark for each of the four areas in this report, with the 2026 value and the prior-year value.

Table 1. 2026 Cybersecurity Benchmarks at a Glance

Benchmark	What it measures	2026 value	Prior year
Detection and response
Mean time to identify (MTTI)	Days from breach to discovery	183 days³	181 days⁸
Mean time to contain (MTTC)	Days from discovery to containment	64 days³	60 days⁸
Breach lifecycle	Identify plus contain	247 days³	241 days⁶
Median dwell time	Days an attacker is inside before detection	14 days¹⁶	11 days¹⁶
Cost
Average cost of a data breach (global)	Total cost per breach	$4.99M¹	$4.44M⁶
Average cost of a data breach (US)	Total cost per breach	$11.5M³	$10.22M⁷
Cost per record (customer PII)	Cost per compromised record	$192⁴	$160⁸
Security program
Security budget as % of IT spend	Share of IT spend on security	9.9%³³	10.9%³⁵
Security budget as % of revenue	Security spend vs. company revenue	0.69% (2025)³⁵	Flat³⁵
Workforce MFA adoption	Share of users enrolled in MFA	70% (Jan 2025)³⁹	66%⁴¹
Risk and exposure
Baseline phish-prone percentage	Untrained employees who engage with a phish	33.2%³¹	33.1%³²
Breaches starting with exploitation	Top initial access vector	31%¹⁹	20%²⁶
Median time to fix a critical vulnerability	Days to full remediation	43 days²¹	32 days²¹

Key takeaways:

• Detection slowed on both major measures: IBM's breach lifecycle rose from 241 to 247 days, the first increase after five years of decline,³ and Mandiant's median dwell time rose from 11 to 14 days.¹⁶

• Breach costs hit a record. The global average reached $4.99 million, up 12%, and the US average reached $11.5 million, more than double the global figure.¹˒³

• Exploited software flaws now start 31% of breaches, ahead of stolen credentials,¹⁹ while the median time to fully fix a critical vulnerability grew from 32 to 43 days.²¹

• Security budgets did not keep pace: security's share of the IT budget fell to 9.9%, the same level as 2021.³³

Detection and Response Benchmarks

Three numbers describe how fast an organization finds and stops an attack. Mean time to identify (MTTI) is the number of days between the breach and its discovery. Mean time to contain (MTTC) is the number of days from discovery to containment. Dwell time is how long an attacker stays inside before anyone notices. IBM reports a mean across all breaches it studies, while Mandiant reports a median from its own incident response cases, so the two figures measure different samples. The table below answers the first follow-up question most readers have: how fast do organizations actually find and stop attackers?

Table 2. Detection and Response Benchmarks, 2026

Metric	2026	Prior	Note
Mean time to identify	183 days³	181 days⁸	Mean across all breaches studied
Mean time to contain	64 days³	60 days⁸	After discovery
Full breach lifecycle	247 days³	241 days⁶	First increase after five years of decline
Cost of breaches over vs. under 200 days	$5.65M vs. $4.32M³	$5.01M vs. $3.87M⁸	Speed penalty of $1.33M
Global median dwell time	14 days¹⁶	11 days¹⁶	Mandiant cases, calendar 2025
Dwell time, espionage and North Korean IT worker cases	122 days¹⁶	New breakout	Drove the overall increase
First detected internally	52%¹⁶	43%¹⁶	Organization found it itself
Notified by an external entity	34%¹⁷	43%¹⁷	Partner, law enforcement, or researcher
Notified by the attacker	14%¹⁷	Not reported	Rises to 44% in ransomware cases¹⁷
Lifecycle with extensive security AI and automation	215 days vs. 280 with none³	80 days shorter (2025)⁶	65 days shorter³

Key takeaways:

• The typical breach stays hidden for about six months and takes another two months to contain.³

• Breaches that ran past 200 days cost $5.65 million on average, compared with $4.32 million for those closed sooner, a gap of $1.33 million.³

• Internal detection rose from 43% to 52% of Mandiant cases,¹⁶ but about half of intrusions are still first reported by an outside party or by the attacker.¹⁷

Breach Lifecycle by Attack Vector

How a breach starts largely decides how long it stays hidden. IBM does not publish 2026 lifecycle data by industry, but it does break it out by attack vector. The table below shows which kinds of breaches take longest to find and close.

Table 3. Breach Lifecycle by Attack Vector, 2026

Attack vector	Days to identify	Days to contain	Total lifecycle
Supply chain compromise	194⁹	64⁹	258 days⁹
Data stored across multiple environments	Not broken out	Not broken out	256 days¹¹
Social engineering	Not broken out	Not broken out	254 days¹⁰
Phishing	Not broken out	Not broken out	251 days¹⁰
Valid account abuse	179¹⁰	64¹⁰	243 days¹⁰
All breaches	183³	64³	247 days³
Reference: healthcare, all vectors (2025 edition)	Not broken out	Not broken out	279 days⁶

Key takeaways:

• Supply chain breaches take the longest to find, 11 days longer than the average breach, because the attack starts inside a trusted vendor.⁹˒³

• Breaches that begin with a valid login are found a little faster than average but still take about eight months to close.¹⁰

• Healthcare, in the most recent industry breakout, ran more than a month past the global average.⁶

Detection Speed Year over Year

A single year can mislead, so the chart below tracks both detection measures across five report editions. It answers a common follow-up question: is detection getting faster or slower over time?

Figure 2. Breach Lifecycle and Median Dwell Time by Report Edition, 2022 to 2026

Sources: IBM lifecycle, 2022 to 2026 editions;¹⁴˒¹³˒¹⁵˒⁶˒³ Mandiant median dwell time, M-Trends 2022 to 2026 editions.¹⁸˒¹⁶ IBM reports a mean across all breaches studied; Mandiant reports a median from its incident response cases. Each Mandiant edition covers the prior calendar year. The IBM panel axis starts at 200 days.

Key takeaways:

• Both measures improved steadily from the 2022 edition through 2025, then reversed in 2026.

• IBM's lifecycle fell from 277 days to 241 before rising to 247.¹⁴˒⁶˒³ Mandiant's median dwell time fell from 21 days to 10 before climbing to 14.¹⁸˒¹⁶

• Mandiant links the rise to long-running espionage and insider-style operations, which had a median dwell time of 122 days.¹⁶

• One year of regression does not erase a multi-year trend, but it shows that detection does not improve on its own.

Cost Benchmarks

IBM counts four kinds of cost in a breach: detection and escalation, notification, post-breach response, and lost business. The table below breaks the 2026 total into the cost benchmarks most often used in budget and risk discussions.

Table 4. Data Breach Cost Benchmarks, 2026

Metric	2026	2025
Global average cost of a data breach	$4.99M (+12%, record)¹	$4.44M⁶
US average cost of a data breach	$11.5M (+11%)³˒¹¹	$10.22M⁷
Cost per hour of a breach	About $1,100²	Not reported
Detection and escalation cost	$1.64M³	Not compared
Lost business cost	$1.54M³	Not compared
Cost per record, customer PII	$192⁴	$160⁸
Cost per record, intellectual property	$196⁴	Not compared
AI-enabled breach (1 in 4 malicious breaches)	$6.0M¹	Not tracked
Breaches involving shadow AI	$5.39M¹¹	$4.63M¹¹
Savings from extensive security AI and automation	1.93M(4.00M vs. $5.93M)²˒³	$1.9M⁸

Key takeaways:

• The global average rose 12% to a record $4.99 million after one year of decline.¹

• Detection, escalation, and lost business make up 63% of the total, the costs that shrink when a breach is found and closed faster.²

• Breaches that involved attacker use of AI cost about $1 million more than average.¹

Breach Cost by Industry

The global average hides wide differences between sectors. The table below shows what a breach costs in 10 of the 17 industries IBM tracks, with the compliance framework most common in each.

Table 5. Average Data Breach Cost by Industry, 2026

Industry	2026 average cost	Change from 2025	Common compliance driver
Healthcare	$6.64M⁴˒⁵	-11%⁴	HIPAA, HITRUST
Financial services	$6.29M⁴	+13%⁴	GLBA, PCI DSS, SOC 2
Industrial	$5.50M⁴	+10%⁴	CMMC, NIST SP 800-171
Technology	$5.50M⁴	+15%⁴	SOC 2, ISO 27001
Pharmaceuticals	$5.25M⁴	+14%⁴	FDA, HIPAA
Energy	$5.24M⁴	+8%⁴	NERC CIP
Services (incl. legal, accounting)	$5.08M⁴	+11%⁴	SOC 2, client requirements
Education	$4.15M⁴	+9%⁴	FERPA
Retail	$3.80M⁴	+7%⁴	PCI DSS
Public sector	$3.50M⁴	+22%⁴	FISMA, FedRAMP
All industries	$4.99M¹	+12%¹	Varies

Key takeaways:

• Healthcare remains the costliest sector, a position IBM reports it has held for 15 straight years, even though it was the only sector whose cost fell.⁵˒⁴

• Industrial organizations, which include defense manufacturers, average $5.5 million per breach, about 10% above the global figure.⁴

• Seven of the 10 sectors shown sit above the global average, including healthcare, financial services, industrial, and technology.⁴

Breach Impact by Company Size

IBM no longer reports breach cost by headcount, so readers at smaller companies often ask whether these numbers apply to them. The table below uses Verizon's breach data and its study of roughly 70,000 cyber insurance claims to answer that question.²⁰

Table 6. Breach Impact by Company Size

Company size	Ransomware exposure	Median insurance claim	Worst-case loss (top 2.5% of claims)
Small and mid-sized businesses (SMBs)	96% of ransomware victims of known size;²⁷ ransomware in 83% of SMB breaches²⁸	$38,406²⁹	More than 7% of revenue²⁰
Large enterprises	About 4% of ransomware victims of known size²⁷	About $283,000³⁰	2% of revenue or less³⁰
All organizations	Ransomware in 48% of breaches¹⁹	$83,000 typical paid claim³⁰	Top 10% of claims exceed $920,000³⁰

Note: Verizon's breach report defines SMBs as organizations with fewer than 1,000 employees; its claims study uses revenue under $25 million.²⁸˒²⁹ Insurance claim medians measure a different thing than IBM's average breach cost and should not be compared with Table 4.

Key takeaways:

• Ransomware is the defining breach for smaller organizations: it appears in 83% of SMB breaches, and SMBs make up 96% of ransomware victims whose size is known.²⁸˒²⁷

• Smaller firms lose fewer dollars per claim, but their worst incidents consume more than 7% of revenue, while large enterprise losses stay at or below 2%.²⁰˒³⁰

• Company size changes the shape of the risk, not whether the risk exists.

Security Program Benchmarks

Security spending is usually compared in two ways: as a share of the IT budget and as a share of company revenue. Each can mislead on its own. A company with a small IT budget can look well funded on the first measure and underfunded on the second. The table below shows both, along with how budgets are split and how fast they are growing.

Table 7. Security Spending Benchmarks

Metric	Benchmark	Year
Security budget as % of IT spend	9.9% (same level as 2021)³³	2026
Security budget as % of IT spend, trend	10.9% (2025); 11.9% (2024); 8.6% (2020)³⁵	2020 to 2025
Security budget as % of revenue	0.69%³⁵	2025
SMB and mid-market security budget as % of revenue	1.1% (about $11,000 per $1M of revenue)³⁷	2025
SMB and mid-market average security budget	$3.4M; from $600K (under $50M revenue) to 5M(600M to $1B)³⁶	2025
Average / median budget growth	5% / 0%³⁸	2026
CISOs who received a requested increase	45% (64% asked)³⁸	2026
Staff and compensation share of budget	37% (39% in 2025)³⁴˒³⁵	2026
Software, including AI, share of budget	35% (29% in 2025)³⁴	2026

Key takeaways:

• Security takes about a tenth of the IT budget, and that share has fallen two years in a row as AI projects pulled overall IT spending ahead.³³˒³⁵

• The median budget increase was 0%, even though the average rose 5%.³⁸

• Smaller and mid-market companies spend 1.1% of revenue on security, compared with 0.69% for all companies, because baseline program costs do not shrink with company size.³⁷˒³⁵

Security Staffing and Skills Benchmarks

Budget is only half of the program. The table below answers the next question: do peers have the people to run security, and how do they fill the gaps?

Table 8. Security Staffing and Skills Benchmarks

Metric	Benchmark
Security teams using a managed security service provider (MSSP)	75% to 86%, depending on company size³⁵
Annual cost: dedicated CISO vs. virtual CISO (vCISO)	$250K to $400K vs. $40K to $120K⁴⁸
Organizations reporting at least one skills gap	95% (up 5 points)⁴⁶
Organizations with critical or significant skills gaps	59% (44% prior year)⁴⁷
Had a significant consequence tied to a skills shortage	88% (69% more than one)⁴⁵
Reported security budget cuts / layoffs	36% / 24%⁴⁶
CISOs who expect AI to create new security roles	81%³⁸

Key takeaways:

• Most security teams at every company size use an MSSP for part of their program.³⁵

• A virtual CISO costs roughly a quarter to a third of a full-time hire, which explains why the model is common in mid-market firms.⁴⁸

• Nearly nine in ten security professionals say their organization has had a significant consequence tied to missing skills.⁴⁵

Security Control Adoption Rates

Spending and staffing matter because of the controls they buy. The table below shows how many organizations have three baseline controls in place: multi-factor authentication (MFA), zero trust, and endpoint detection and response (EDR).

Table 9. Adoption of MFA, Zero Trust, and EDR

Control	Adoption	Segment detail
Workforce MFA	70% of users³⁹	Technology 87%; retail 52%; transportation 42%³⁹Under 100 employees 86% vs. 20,000+ at 64%⁴⁰
Phishing-resistant MFA	14.0% of users³⁹	Up from 8.6% a year earlier³⁹
Zero trust strategy (any implementation)	63% fully or partially⁴²	Typically covers half or less of the environment⁴²
Zero trust fully implemented	17%⁴³	82% call it essential⁴³
Endpoint detection and response (EDR)	97.7% of respondents⁴⁴	Vendor survey; the vendor notes it runs above market estimates for mid-market firms⁴⁴
Sensitive data encrypted at rest and in transit	37% of breached organizations¹	Breached sample only
Access controls on AI models and data	40% of breached organizations²	Breached sample only
Third parties that fully fixed cloud MFA gaps	23%²¹	Third-party cloud accounts

Key takeaways:

• Nearly a third of workforce users still sign in without MFA, and only about one in seven uses a phishing-resistant method.³⁹

• Most organizations have started a zero trust program, but fewer than one in five have completed it.⁴²˒⁴³

• The EDR figure comes from a single vendor survey and is likely higher than the true rate among mid-market firms.⁴⁴

• Among breached organizations, fewer than four in ten encrypted sensitive data both at rest and in transit.¹

Risk and Exposure Benchmarks

Exposure benchmarks measure how open an organization is to attack across three surfaces: people (phishing), systems (unpatched software), and partners (third parties). The table below shows the current benchmark for each.

Table 10. Risk and Exposure Benchmarks

Metric	Benchmark	Prior
Organizations with at least one successful cyber attack in 12 months	29%⁴⁹	Not reported
US small businesses with at least one attack in 12 months	56%⁵⁰	Not reported
Baseline phish-prone percentage (untrained)	33.2%³¹	33.1%³²
Breaches starting with vulnerability exploitation	31%¹⁹	20%²⁶
Breaches starting with credential abuse	13% (16% on prior method)²²	22%²²
Breaches involving a third party	48%²⁰	30%²³
Breaches involving ransomware	48%¹⁹	44%²⁴
Median days to fully fix a critical vulnerability	43 days²¹	32 days²¹
Known exploited vulnerabilities (CISA KEV) fully fixed	26%²¹	38%²¹
Mean time to exploit a vulnerability	-7 days (exploited before a patch exists)¹⁶	63 days in 2018⁵⁶
Ransomware victims who did not pay	69%²⁵	Not compared

Note: the Hiscox figures come from its 2026 survey of 6,800 small businesses.⁵¹ "Successful attack" and "attack" are different measures and should not be compared with each other.

Key takeaways:

• One in three untrained employees engages with a phishing simulation, a rate that barely moved in a year.³¹˒³²

• Attackers now exploit flaws about a week before a patch exists on average, while the typical organization takes 43 days to fully fix a critical vulnerability and fully fixes only 26% of known exploited ones.¹⁶˒²¹

• Nearly half of breaches now involve a third party, up from 30% a year earlier.²⁰˒²³

Exposure Benchmarks by Industry

Exposure is not spread evenly. The table below compares human risk, entry points, and third-party or ransomware exposure across the industries where data is available.

Table 11. Exposure Benchmarks by Industry

Industry	Baseline phish-prone %	Breaches starting with exploitation	Third-party or ransomware exposure	Average breach cost
Healthcare and pharmaceuticals	42.7%³¹	20% (healthcare)⁵³	Third party in 32% of breaches⁵²	$6.64M (healthcare)⁴
Retail and wholesale	36.0%³¹	42% (retail)⁵⁴	Third party in 68% of breaches⁵⁴	$3.80M (retail)⁴
Manufacturing / industrial	Not in public release	38%⁵⁴	Ransomware in 61% of breaches⁵⁵	$5.50M (industrial)⁴
Insurance	38.1%³¹	Not broken out	Not broken out	See financial services, $6.29M⁴
All industries	33.2%³¹	31%¹⁹	Third party in 48%;²⁰ ransomware in 48%¹⁹	$4.99M¹

Note: KnowBe4, Verizon, and IBM group industries differently. Labels in parentheses show the grouping each source uses.

Key takeaways:

• Healthcare carries the highest human risk and the highest breach cost at the same time.³¹˒⁴

• Retail shows the heaviest partner exposure, with more than two-thirds of breaches involving a third party.⁵⁴

• Manufacturing breaches lean toward ransomware and exploited vulnerabilities more than phishing.⁵⁵˒⁵⁴

Benchmarks by Program Maturity

No single public study scores security maturity directly, so the table below measures it through observable program traits. It answers the question readers ask last: what actually changes when a program matures?

Table 12. How Benchmarks Change as Security Programs Mature

Maturity indicator	Less mature	More mature	Difference
Security awareness training	33.2% phish-prone with no training³¹	20.1% after 90 days; 4.2% after 1 year³¹	79% reduction³¹
Security AI and automation	None: 280-day lifecycle, $5.93M average cost³	Extensive: 215 days, $4.00M³	65 days and $1.93M³
Who detects the breach (2023 data)	External notice: 13 days median dwell¹⁸	Internal detection: 9 days median dwell¹⁸	4 days faster¹⁸
Breach lifecycle	Over 200 days: $5.65M³	Under 200 days: $4.32M³	$1.33M³
Authentication strength	Password plus SMS code or push	Phishing-resistant MFA	Used by 14.0% of users³⁹

Key takeaways:

• One year of consistent training cuts phishing susceptibility by about four-fifths.³¹

• Organizations that use security AI and automation extensively close breaches more than two months faster and pay about $1.9 million less per breach.³

• Organizations that detect intrusions themselves find them faster than those that wait for outside notice.¹⁸

• The biggest gains in speed and cost come from program maturity, not company size.

What These Benchmarks Mean for Your Program

Benchmarks show where peers stand, not where a specific organization should be. A defense subcontractor that handles controlled unclassified information and a SaaS company pursuing SOC 2 face different risks and need different controls. The most useful comparison is a framework-based gap analysis: measuring your own controls against a recognized standard such as the CIS Controls, NIST SP 800-171, SOC 2, or ISO 27001, then fixing the gaps that reduce the most risk per dollar. Across this report, the data points to the same levers again and again: faster detection, consistent training, stronger authentication, and faster patching.

Inovo InfoSec builds that comparison into every engagement. Its Assess, Remediate, Manage approach starts with a Security Maturity Level Assessment that produces a custom roadmap, budget, and timeline, led by CISOs with CISSP credentials. Inovo has guided every client through its CMMC, SOC 2, and ISO 27001 audits to date, a 100% audit success rate built on the same framework-first process. To see how your program compares to these benchmarks, contact Inovo InfoSec.

References

1. IBM, "IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average," July 29, 2026. https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average

2. IBM X-Force, "AI-powered adversaries and the enterprise risk challenge," July 29, 2026.https://www.ibm.com/think/x-force/2026-cost-of-a-data-breach-ai-adversaries-enterprise-risk

3. Security Boulevard (The CISO Perspective), "How Much Does a Data Breach Cost? IBM's 2026 Report Puts the US Average at $11.5 Million," August 25, 2026. https://securityboulevard.com/2026/08/how-much-does-a-data-breach-cost-ibms-2026-report-puts-the-us-average-at-11-5-million/

4. DataBreachCost.com, "IBM Cost of a Data Breach Report 2026: Key Findings," August 2026.https://databreachcost.com/report/2026

5. IBM, "What is a data breach?," 2026. https://www.ibm.com/think/topics/data-breach

6. IBM and Ponemon Institute, "Cost of a Data Breach Report 2025," July 2025.https://www.bakerdonelson.com/webfiles/Publications/20250822_Cost-of-a-Data-Breach-Report-2025.pdf

7. CyberScoop, "IBM: Cost of a Data Breach 2025," July 2025. https://cyberscoop.com/ibm-cost-data-breach-2025/

8. StationX, "Average Cost of a Data Breach: Statistics," 2026. https://app.stationx.net/articles/cost-of-data-breach-statistics

9. Bright Defense, "Data Breach Statistics for 2026," 2026. https://www.brightdefense.com/resources/data-breach-statistics/

10. Enzoic, "IBM 2026 Cost of a Data Breach: Valid Accounts and Credentials," 2026. https://www.enzoic.com/?p=85776

11. Baker Donelson, "Ten Takeaways from IBM's 2026 Cost of a Data Breach Report," 2026.https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report

12. LiberationTek, "Cost of a Data Breach 2026: IBM's $4.99M Average Revealed," 2026.https://liberationtek.com/cybersecurity/cost-of-a-data-breach/

13. Morgan Lewis, "Study Finds Average Cost of Data Breaches Continued to Rise in 2023," March 2024.https://www.morganlewis.com/blogs/sourcingatmorganlewis/2024/03/study-finds-average-cost-of-data-breaches-continued-to-rise-in-2023

14. Morgan Lewis, "Study Finds Average Cost of Data Breaches Reaches All-Time High in 2022," January 2023.https://morganlewis.com/blogs/sourcingatmorganlewis/2023/01/study-finds-average-cost-of-data-breaches-reaches-all-time-high-in-2022

15. IBM UK Newsroom, "IBM Report: Soaring Data Breach Disruption Drive Costs to Record Levels," July 30, 2024.https://uk.newsroom.ibm.com/IBM-Report-Soaring-Data-Breach-Disruption-Drive-Costs-to-Record-Levels

16. Mandiant (Google Cloud), "M-Trends 2026: Data, Insights, and Strategies From the Frontlines," 2026.https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026

17. Mandiant (Google Cloud), "M-Trends 2026 Report, Executive Edition," 2026.https://cloud.google.com/security/resources/m-trends-executive-edition

18. Mandiant, "M-Trends 2024 Special Report," April 2024. https://services.google.com/fh/files/misc/m-trends-2024.pdf

19. Verizon, "2026 Data Breach Investigations Report," May 2026.https://www.verizon.com/business/resources/reports/dbir/

20. Verizon, "Cybersecurity Insights for SMBs: 2026 DBIR and Breach Impact Study Infographic," 2026.https://www.verizon.com/business/resources/infographics/2026-dbir-bis-smb-revenue-losses.pdf

21. SecurityWeek, "Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector," May 2026. https://www.securityweek.com/verizon-dbir-2026-vulnerability-exploitation-overtakes-credential-theft-as-top-breach-vector/

22. Descope, "Verizon DBIR 2026: Credential Abuse Is Down, But Not Out," 2026.https://www.descope.com/blog/post/verizon-dbir-2026

23. Expert Insights, "Supply Chain Breaches Surge 60% To Hit Half Of All Incidents," May 21, 2026.https://expertinsights.com/news/supply-chain-breaches-surge-60-to-hit-half-of-all-incidents

24. WaterISAC, "Verizon's 2026 Data Breach Investigations Report (DBIR)," 2026. https://www.waterisac.org/tlpclear-verizons-2026-data-breach-investigations-report-dbir

25. Help Net Security, "Verizon DBIR: Vulnerability exploitation is the dominant initial access vector," May 20, 2026.https://www.helpnetsecurity.com/2026/05/20/verizon-2026-dbir-findings/

26. Tech Insider, "Verizon DBIR: Exploits Overtake Credentials at 31% [2026]," 2026. https://tech-insider.org/verizon-dbir-2026/

27. Secureframe, "140+ Data Breach Statistics & Trends From 2026 Reports," 2026. https://secureframe.com/blog/data-breach-statistics

28. Stingrai, "Small Business Cybersecurity Statistics 2026," October 1, 2026. https://www.stingrai.io/blog/small-business-cybersecurity-statistics-2026

29. PrivacyTerms, "Cost of a Data Breach for Small Businesses 2026: $38,406 Median," 2026.https://privacyterms.io/cost-of-a-data-breach-small-businesses-2026

30. Adyog Pulse, "Verizon 2026 Breach Impact Study: Median Claim $83,000," 2026.https://pulse.adyog.com/insights/verizon-bis-2026-breach-cost-claims-data

31. KnowBe4, "KnowBe4 Research Finds Global Phishing Susceptibility Drops 79% After One Year of Security Awareness Training," July 7, 2026. https://www.knowbe4.com/press/knowbe4-research-finds-global-phishing-susceptibility-drops-79-after-one-year-of-security-awareness-training

32. KnowBe4 via Business Wire, "KnowBe4 Report Reveals Security Training Reduces Global Phishing Click Rates by 86%," May 13, 2025. https://secure.businesswire.com/news/home/20250513295204/en/KnowBe4-Report-Reveals-Global-Phishing-Click-Rates-by-86

33. IANS and Artico Search, "2026 Security Budget Benchmark Report," 2026. https://www.ians.com/lp/security-budget-benchmark-report

34. IANS, "How AI Is Expected to Shape Security Budgets in 2027," 2026. https://www.ians.com/blog/how-ai-is-expected-to-shape-security-budgets-in-2027

35. IANS and Artico Search, "2025 Security Budget Benchmark Report," August 5, 2025.https://www.ians.com/insights/ciso-leadership/2025-security-budget-benchmark-report

36. IANS, "How Do You Compare? 2025 Comp and Budget Data for Small and Midmarket CISOs," June 17, 2025.https://www.iansresearch.com/resources/all-blogs/post/security-blog/2025/06/17/how-do-you-compare--2025-comp-and-budget-data-for-small-and-midmarket-cisos

37. IANS Research, "IANS and Artico Search Release Compensation and Budget Report for CISOs in the Small and Middle Market," June 17, 2025. https://www.iansresearch.com/resources/press-releases/detail/ians-and-artico-search-release-compensation-and-budget-report-for-cisos-in-the-small-and-middle-market

38. CSO Online, "Security spending is growing, except for the typical CISO," September 17, 2026.https://www.csoonline.com/article/4223455/security-spending-is-growing-except-for-the-typical-ciso.html

39. Okta, "The Secure Sign-in Trends Report 2025," 2025. https://www.okta.com/newsroom/articles/secure-sign-in-trends-report-2025

40. SC Media, "Phishing-resistant authentication is taking off," 2025. https://www.scworld.com/resource/phishing-resistant-authentication-is-taking-off

41. Swif, "MFA Statistics," 2026. https://swif.ai/blog/mfa-statistics

42. Gartner, "Gartner Survey Reveals 63% of Organizations Worldwide Have Implemented a Zero-Trust Strategy," April 22, 2024. https://www.gartner.com/en/newsroom/press-releases/2024-04-22-gartner-survey-reveals-63-percent-of-organizations-worldwide-have-implemented-a-zero-trust-strategy

43. ORDR, "Zero Trust Statistics 2026 Report," April 3, 2026. https://ordr.net/blog/zero-trust-statistics-2026-report

44. Security Boulevard (Bitdefender), "Endpoint Detection & Response is Table Stakes Security," May 2026.https://securityboulevard.com/2026/05/endpoint-detection-response-is-table-stakes-security/

45. ISC2, "ISC2 Publishes 2025 Cybersecurity Workforce Study," December 4, 2025.https://www.isc2.org/Insights/2025/12/ISC2-publishes-2025-cybersecurity-workforce-study

46. Security Info Watch, "Cybersecurity Skills Gaps Now Outpace Headcount Shortages, ISC2 Workforce Study Finds," December 15, 2025. https://www.securityinfowatch.com/cybersecurity/article/55338497/cybersecurity-skills-gaps-now-outpace-headcount-shortages-isc2-workforce-study-finds

47. Freevacy (Infosecurity Magazine), "Skills shortages continue to be critical cybersecurity challenge," December 4, 2025. https://www.freevacy.com/news/infosecuroty-magazine/skills-shortages-continue-to-be-critical-cybersecurity-challenge/6976

48. Cybersecurity Ventures, "Virtual Or Full-Time CISO: ROI Calculator On Security Leadership," June 16, 2026.https://cybersecurityventures.com/?p=36394

49. IT Brief UK, "Hiscox: cyber attacks cost small firms USD $52,000," September 17, 2026.https://itbrief.co.uk/story/hiscox-cyber-attacks-cost-small-firms-usd-52-000

50. Rochester Business Journal, "More than half of US small businesses face cyberattacks, experts say," October 15, 2026. https://rbj.net/2026/10/15/us-small-businesses-face-cyberattacks-experts/

51. Institute of Directors, "Almost one in three firms hit by cyber attacks," 2026.https://www.iod.com/resources/cyber/almost-one-in-three-firms-hit-by-cyber-attacks/

52. Paubox, "Third parties behind a third of healthcare breach exposure," 2026. https://www.paubox.com/blog/third-parties-behind-a-third-of-healthcare-breach-exposure

53. Textbook of Digital Health, "Verizon 2026 Data Breach Investigations Report: 1,492 healthcare incidents, third parties involved in 32%," May 26, 2026. https://www.textbookofdigitalhealth.com/news/2026-05-26-verizon-dbir-healthcare.html

54. Axis Intelligence, "Verizon DBIR 2026 by Industry," 2026. https://axis-intelligence.com/?p=43217

55. Manufacturing.net, "Verizon Unveils Latest Data Breach Report," 2026.https://www.manufacturing.net/cybersecurity/news/22967240/verizon-unveils-latest-data-breach-report

56. Suzu Labs, "Mean Time to Exploit Has Gone Negative. Security Strategy Has to Change.," 2026.https://suzulabs.com/suzu-labs-blog/mean-time-to-exploit-has-gone-negative.-security-strategy-has-to-change