IBM Security

Cost of a Data
Breach Report2023

Table of contents

01 →Executive summary

02 →Complete findings– What’s new in the 2023 report– Key findings– Global highlights– Initial attack vectors– Identifying attacks– Data breach lifecycle– Key cost factors– Ransomware and destructive attacks– Business partner supply chain attacks– Software supply chain attacks– Regulatory environments– Cloud breaches– Mega breaches– Security investments– Security AI and automation– Incident response– Threat intelligence– Vulnerability and risk management– Attack surface management– Managed security service providers(MSSPs)03 →Recommendations
to help reduce the costof a data breach04 →Organization demographics– Geographic demographics– Industry demographics– Industry definitions

05 →Research methodology– How we calculate the cost of adata breach– Data breach FAQs
– Research limitations

06 →About Ponemon Instituteand IBM Security– Take the next steps
		

2

01
Executive summary
The Cost of a Data Breach Report equips IT,
risk management and security leaders withquantifiable evidence to help them better manage
their security investments, risk profile and strategic
decision-making processes. The 2023 edition
represents this report’s 18th consecutive year.

The years mentioned in this report referto the year the report was published,
not necessarily the year of the breach.
The breaches studied took place across
16 countries and regions and in 17
different industries.
Throughout this report, we’ll examine theroot causes and both short-term and longterm consequences of data breaches. We’llalso explore the factors and technologies
that enabled companies to limit losses—aswell as those that led to increased costs.

This year’s research—conducted independently
by Ponemon Institute and sponsored, analyzed
and published by IBM Security®—studied 553
organizations impacted by data breaches that
occurred between March 2022 and March 2023.

Next section

3

01

Executive summary

What’s new in the 2023 report
Each year, we continue to evolve theCost of a Data Breach Report to match
new technologies, emerging tactics
and recent events. For the first time,
this year’s research explores:– How breaches are identified: whether
by an organization’s own security teams,
another third party or the attacker– The impact of involving law enforcement
in a ransomware attack– The effect of ransomware playbooks
and workflows– Specific costs associated withregulatory fines– If and how companies plan to increase
security investment as a result ofa breach– The impact of the following mitigation
strategies:• Threat intelligence• Vulnerability and risk management• Attack surface management (ASM)• Managed security service providers(MSSPs)Previous section

Next section

As the cost of a breach continues toincrease, this report delivers essential
insights to help security and IT teams
better manage risk and limit potential
losses. The report is divided into five
major sections:– The executive summary with key findings
and what’s new in the 2023 edition– In-depth analysis on the complete
findings, including breach costs bygeographic region and industry– Security recommendations fromIBM Security experts based on thisreport’s results– Demographics of organizations andindustry definitions– The study’s methodology, including how
costs were calculated4

01

USD 4.45M

Average total cost of a breach
The average cost of a data breach reached an all-time high in 2023
of USD 4.45 million. This represents a 2.3% increase from the 2022
cost of USD 4.35 million. Taking a long-term view, the average cost has
increased 15.3% from USD 3.86 million in the 2020 report.

Key findings
The key findings described here are basedon IBM Security analysis of research datacompiled by Ponemon Institute. Costamounts in this report are measured in
US dollars (USD).

51%

Percentage of organizations planning to increase
security investments as a result of a breach
While data breach costs continued to rise, report participants
were almost equally split on whether they plan to increase security
investments because of a data breach. The top areas identified
for additional investments included incident response (IR)planning and testing, employee training, and threat detection
and response technologies.

USD 1.76M

Previous section

Next section

The effect of extensive security AI and automationon the financial impact of a breach
Security AI and automation were shown to be important investments
for reducing costs and minimizing time to identify and containbreaches. Organizations that used these capabilities extensively within
their approach experienced, on average, a 108-day shorter time toidentify and contain the breach. They also reported USD 1.76 million
lower data breach costs compared to organizations that didn’t use
security AI and automation capabilities.

5

01

Executive summary

1 in 3

USD 470,000

53.3%

82%

Number of breaches identified by anorganization’s own security teams or tools
Only one-third of companies discovered
the data breach through their own security
teams, highlighting a need for better
threat detection. 67% of breaches werereported by a benign third party or by theattackers themselves. When attackers
disclosed a breach, it cost organizations
nearly USD 1 million more compared tointernal detection.

Additional cost experienced byorganizations that didn’t involve law
enforcement in a ransomware attack
This year’s research shows that excluding
law enforcement from ransomware
incidents led to higher costs. While 63%of respondents said they involved law
enforcement, the 37% that didn’t also
paid 9.6% more and experienced a 33-day
longer breach lifecycle.

Since 2020, healthcare data breach costs
have increased 53.3%
The highly regulated healthcare industry
has seen a considerable rise in data breachcosts since 2020. For the 13th year ina row, the healthcare industry reported
the most expensive data breaches, at an
average cost of USD 10.93 million.

The percentage of breaches that involved
data stored in the cloud—public, private or
multiple environments
Cloud environments were frequent targets
for cyberattackers in 2023. Attackers often
gained access to multiple environments,
with 39% of breaches spanning multiple
environments and incurring a higher-thanaverage cost of USD 4.75 million.

Previous section

Next section

6

01

Executive summary

USD 1.68M

USD 1.49M

USD 1.44M

USD 1.02M

Cost savings from high levels of
DevSecOps adoption
Integrated security testing in the softwaredevelopment process (DevSecOps) showedsizable ROI in 2023. Organizations withhigh DevSecOps adoption saved USD
1.68 million compared to those withlow or no adoption. Compared to othercost-mitigating factors, DevSecOps
demonstrated the largest cost savings.

Cost savings achieved by organizations
with high levels of IR planning and testingIn addition to being a priority investment
for organizations, IR planning and testing
emerged as a highly effective tactic forcontaining the cost of a data breach.
Organizations with high levels of IR
planning and testing saved USD 1.49
million compared to those with low levels.

Increase in data breach costs fororganizations that had high levels of
security system complexity
Organizations that reported low or no
security system complexity experienced
an average data breach cost of USD 3.84
million in 2023. Those with high levelsof security system complexity reported
an average cost of USD 5.28 million,
representing an increase of 31.6%.

Average cost difference between
breaches that took more than 200 days
to find and resolve, and those that took
less than 200 days
Time to identify and contain breaches—
known as the breach lifecycle—continues
to be integral to the overall financial
impact. Breaches with identification andcontainment times under 200 days costorganizations USD 3.93 million. Thoseover 200 days cost USD 4.95 million—adifference of 23%.

Previous section

Next section7

02Complete findings
In this section, we provide the detailed findings ofthis report across 18 themes. Topics are presented
in the following order:– Global highlights– Initial attack vectors– Identifying attacks– Data breach lifecycle– Key cost factors– Ransomware and destructive attacks– Business partner supply chain attacks– Software supply chain attacks– Regulatory environments– Cloud breaches– Mega breaches– Security investments– Security AI and automation– Incident response– Threat intelligence– Vulnerability and risk management– Attack surface management– Managed security service providers

Previous section

Next section8

02Complete findings

Global highlights
The Cost of a Data Breach Reportprovides a global picture of the cost ofdata breaches, built using data from over553 breaches in 16 different countries
and taking into account hundreds of cost
factors. This section examines critical
metrics at the level of global average.
We also explore the average per-record
comparative costs between countries
and industries.

USD 4.45M
Global average total cost of a data breach02Complete findings

Total cost of a data breach

$5.00
$4.50

Figure 1. The cost of a data breachclimbed to a new high.
Globally, the average cost of a data breachrose to USD 4.45 million, a USD 100,000
increase from 2022. This represents a
2.3% increase from the 2022 average costof USD 4.35 million. Since 2020, when the
average total cost of a data breach was
USD 3.86 million, the average total cost has
increased 15.3%.

Figure 2. Per-record cost of a data breachalso reached a new high.
In 2023, the average cost per record
involved in a data breach was USD 165, a
small increase from the 2022 average of
USD 164. This matches the relatively small
growth from 2021 to 2022, where the costrose by just USD 3. In the last seven years,
the largest increase in average per-record
costs was between 2020 and 2021, when
the average rose from USD 146 to USD 161
or 10.3%. This study examined breaches
sized between 2,200 and 102,000 records.1

$4.00

$3.62

$3.86

$3.92

$3.86

2018

2019

2020

$4.24

$4.35

$4.45

2021

2022

2023

$164

$165

2022

2023

$3.50
$3.00
$2.50
2017

Figure 1. Measured in USD millions

Per-record cost of a data breach

$170
$165

$161

$160
$155
$148

$150
$145

$150
$146

$141

$140
$135
2017

2018

2019

2020

2021

Figure 2. Measured in USD

Previous section

Next section

10

02

Figure 3. For the 13th consecutive year,
the United States held the title for thehighest data breach costs.
The top five countries or regions with thehighest average cost of a data breach saw
considerable changes from 2022.

Complete findings

2023

2022

1

United States
USD 9.48 million

United States
USD 9.44 million

2

Middle East
USD 8.07 million

Middle East
USD 7.46 million

3

CanadaUSD 5.13 million

CanadaUSD 5.64 million

4

Germany
USD 4.67 million

United Kingdom
USD 5.05 million

5

Japan
USD 4.52 million

Germany
USD 4.85 million

Previous section

Next section

Of this year’s top five, Japan is the only
country that didn’t appear on the 2022 top
five list, moving up from the number 6 mostexpensive spot last year. The top 5 list lastyear also included the United Kingdom (UK)at an average data breach cost of USD 5.05
million. This year, the UK saw a significant
drop in average cost at USD 4.21 million—
down 16.6% from last year—resulting inplacement just outside of the top five.

In Canada, the average total cost of a data
breach decreased from USD 5.64 million
to USD 5.13 million or 9%. The average
cost also decreased in Germany, droppingfrom USD 4.85 million to USD 4.67 million
or 3.7%. Japan saw the average drop
slightly, from USD 4.57 million to USD 4.52
million or 1.1%.

The United States again had the highest
average total cost of a data breach at USD
9.48 million, an increase of 0.4% fromlast year’s USD 9.44 million. Like last year,
the Middle East had the second-highest
average total cost of a data breach at
USD 8.07 million, up 8.2% from USD
7.46 million.

11

02

Complete findings

Cost of a data breach by country or region#1
United States
2023 $9.48 ↑2022 $9.44

Figure 3. Measured in USD millions#2
Middle East
2023 $8.07 ↑2022 $7.46#3
Canada2023 $5.13 ↓2022 $5.64#4Germany2023 $4.67 ↓2022 $4.85

#5
Japan
2023 $4.52 ↓2022 $4.57#6
UnitedKingdom2023 $4.21 ↓2022 $5.05#7France2023 $4.08 ↓2022 $4.34

#8
Italy
2023 $3.86 ↑2022 $3.74#9Latin America
2023 $3.69 ↑2022 $2.80#10South Korea
2023 $3.48 ↓2022 $3.57#11
ASEAN 22023 $3.05 ↑2022 $2.87#12South Africa
2023 $2.79 ↓2022 $3.36#13Australia
2023 $2.70 ↓2022 $2.92

#14
India
2023 $2.18 ↓2022 $2.32#15
Scandinavia
2023 $1.91 ↓2022 $2.08#16Brazil2023 $1.22 ↓2022 $1.38

02Complete findings

Cost of a data breach by industry

Healthcare$10.10$5.90$5.97

Financial

Figure 4. Across industries, healthcare
reported the highest costs for the 13thyear in a row.
Healthcare continues to experience thehighest data breach costs of all industries,
increasing from USD 10.10 million in 2022
to USD 10.93 million in 2023—an increaseof 8.2%. Over the past three years, theaverage cost of a data breach in healthcare
has grown 53.3%, increasing more than
USD 3 million compared to the average costof USD 7.13 million in 2020. Healthcare
faces high levels of industry regulationand is considered critical infrastructure by
the US government. Since the start of the
COVID-19 pandemic, the industry has seen
notably higher average data breach costs.
The top five most costly industries
underwent some changes from last year’s
rankings. Technology dropped out of the

top five while the industrial sector wasadded, showing a 5.8% increase as it
moved from the seventh-highest to thefifth. According to IBM threat intelligence,
manufacturing is the industry mostcommonly targeted by cybercriminals.

$4.82
$5.01

Pharmaceuticals
Energy

$4.78
$4.72

Industrial

$4.73
$4.47
$4.66
$4.97

Technology

$4.47
$4.70

Professional services

2023
1

2

3

4

Healthcare
USD 10.93 million
Financial
USD 5.90 million
Pharmaceuticals
USD 4.82 million
EnergyUSD 4.78 million

2022

Transportation

$4.18
$3.59

Communications

$3.90
$3.62

Consumer

$3.80
$3.86

Education

$3.65
$3.86

Research

$3.63
$3.88

Entertainment

$3.62
$3.83

Healthcare
USD 10.10 million
Financial
USD 5.97 million
Pharmaceuticals
USD 5.01 million

$3.58
$3.15

Media

Technology
USD 4.97 million

Hospitality

$3.36
$2.94

Retail

$2.96
$3.28
$2.60
$2.07

Public sector

5

Industrial
USD 4.73 million

EnergyUSD 4.72 million

$0.00
2023

$10.93

$1.00

$2.00

$3.00

$4.00

$5.00

$6.00

$7.00

$8.00

$9.00

$10.00 $11.00

2022

Figure 4. Measured in USD millions
Previous section

Next section

13

02

Complete findings

Figure 5. Mean times to identify
and contain breaches stayed roughly
the same.
Compared to 2022, both the mean time
to identify (MTTI) and the mean time tocontain (MTTC) breaches saw only marginalchanges. Mean time to identify refers to
the time it takes an organization to uncovera security breach. Mean time to containrefers to the time required to resolve asecurity breach once it has been identified.

In 2022, it took organizations 207 days
to identify a breach. In 2023, it took only
204 days. On the other hand, organizations
required an average of 73 days to containbreaches in 2023, while they required
just 70 days on average in 2022. The
highest mean times to contain and identify
breaches both occurred in 2021, at 212
and 75 days, respectively.

Time to identify and contain the breach

2023

204

73

277

2022

207

70

277

2021

212

75

287

2020

207

73

280

2019

206

73

279

2018

197

2017

191
0

MTTI

50

100

266

69

257

66
150

200

250

300

MTTC

Figure 5. Measured in days

Previous section

Next section

14

02

Complete findings

Figure 6. Lost business costs hit afive-year low.
Last year’s report saw detection andescalation costs rise to become thecostliest category of data breach expenses,
indicating a shift toward longer and morecomplex breach investigations. The trend
continued this year as detection andescalation costs remained in the top spot
and rose from USD 1.44 million to USD 1.58
million, demonstrating a change of USD
140,000 or 9.7%. Detection and escalation
costs include activities that enable a
company to reasonably detect a breachand can include forensic and investigative
activities, assessment and audit services,
crisis management, and communications
to executives and boards.

The other key cost segments of a data
breach—lost business cost, post-breach
response and notification—also saw
changes compared to 2022. Lost businesscosts dropped 8.5%, from USD 1.42
million in 2022 to USD 1.30 million in
2023. Lost business costs include activities
such as business disruptions and revenue
losses from system downtime, the costof lost customers and acquiring newcustomers, and reputation losses anddiminished goodwill.
Notably, the notification cost segment rosefrom USD 310,000 in 2022 to USD 370,000
in 2023, which represents a 19.4%
increase. Post-breach response costs roseby just USD 20,000. Notification costs
include activities that enable the company
to notify data subjects, data protection
regulators and other third parties.

Cost of a data breach divided into four cost segments

$4.50
$4.00
$3.50

$0.31

$0.37

$1.18

$1.20

$1.24

$1.44

$1.58

$0.27
$0.16
$1.02

$0.21
$1.07

$0.24
$1.14
$0.99

$3.00
$2.50

$1.23

$1.22

$1.11

$1.45

$1.42

$1.52

$1.59

$1.42

2018

2019

2020

2021

2022

$2.00
$1.50
$1.00

$1.30

$0.50
$0.00

Lost business cost

Detection and escalation

Post-breach response

2023

Notification

Figure 6. Measured in USD millions

Previous section

Next section

15

02

Complete findings

Figure 7. Smaller organizations faced
considerably higher data breach costs
than last year.
In 2023, organizations with more than
5,000 employees saw the average costof a data breach decrease compared to2022. On the other hand, those with5,000 or fewer employees saw
considerable increases in the average
cost of a data breach.

saw an increase of 21.4%, from USD 2.71
million to USD 3.29 million. In the 1,001–
5,000 employee range, the average cost of adata breach increased from USD 4.06 million
to USD 4.87 million, rising nearly 20%.

Organizations with fewer than 500
employees reported that the average
impact of a data breach increased from
USD 2.92 million to USD 3.31 million or
13.4%. Those with 500–1,000 employees

In the 10,001–25,000 range, respondents
reported an average cost of USD 5.46
million, a decrease of 1.8% from 2022’s
figure of USD 5.56 million. Organizations
with more than 25,000 employees saw theaverage cost drop from USD 5.56 million
in 2022 to USD 5.42 million in 2023, adecrease of USD 140,000 or 2.5%.

Cost of a data breach by head count

$6.00
$4.87

$5.00
$4.05 $4.06

$4.00
$3.31

$3.00

$2.95 $2.92$5.47 $5.56 $5.46$5.10 $5.18

$5.69
$5.28

$5.42

$4.33

$3.29
$2.61 $2.71

$2.00
$1.00
$0.00
Fewer than 500
employees
2021

2022

500–1,000
employees

1,001–5,000
employees

5,001–10,000
employees

10,001–25,000
employees

More than 25,000
employees

2023

Figure 7. Measured in USD millions

Previous section

Next section

16

02

Complete findings

Did the data breach result in yourorganization increasing the cost ofservices and products?

No
43%

Figure 8. Most organizations continue
to increase the prices of services andproducts as a result of a data breach.
The majority (57%) of respondents
indicated that data breaches led to anincrease in the pricing of their business
offerings, passing on costs to consumers.
This finding is similar to our 2022 report,
where 60% of respondents said they
increased prices.

Yes
57%

Figure 8. Share of total sampleof breached organizations

Previous section

Next section

17

02

Complete findings
Type of data compromised

Customer PII

47%
44%

Employee PII

Figures 9a and 9b. Customer PII was
the costliest—and most common—record
compromised.
Of all record types, customer and employee
personal identifiable information (PII)
was the costliest to have compromised.
In 2023, customer PII such as names andSocial Security numbers cost organizations
USD 183 per record, with employee PII
close behind at USD 181 per record.
The least expensive record type to havecompromised is anonymized customer
data, which cost organizations USD 138 perrecord in 2023.
As was the case in 2022 and 2021,
customer PII was the most commonly
breached record type in 2023. 52%of all breaches involved some form ofcustomer PII. This is an increase of five
percentage points from 2022, whencustomer PII accounted for 47% of all datacompromised. The second-most commonlycompromised data type was employee
PII at 40%. Compromised employee PII
has seen sizable growth from 2021,
when it only accounted for 26% of allrecords compromised.
Compromised intellectual property grew
three percentage points since 2022, whileanonymized (non-PII) data dropped sevenpercentage points from 2022—decreasingfrom 33% to 26%. Other corporate
data, such as financial information andclient lists, increased from 15% of datacompromised in 2022 to 21% in 2023.

34%

26%

Intellectual property

27%

28%
15%
12%
0%
2023

2022

10%

20%

40%

34%
31%

26%

Other corporate data

52%

33%

21%

30%

40%

50%

60%

2021

Figure 9a. More than one response permitted

Per-record cost of a data breach by type of record compromised

Customer PII$183

Employee PII$181

Other corporate data

$168

Intellectual property$156

Anonymized customer data (non-PII)

$138
$0

$40

$80

$120

$160

$200

Figure 9b. Measured in USD
Previous section

Next section

18

02

Complete findings

Initial attack vectors
This section examines the initial attack
vector identified for data breaches inthe study and its impact on the breachcost and timeline. It identifies the mostcommon root causes for data breaches in
the report and compares the average costof breaches for each category as well as
the average time to identify and containthose breaches. Phishing and stolen orcompromised credentials were the twomost prevalent attack vectors in this year’s
report, and both also ranked among the top
four costliest incident types.

16%
Percentage of breaches in whichphishing was the initial attack vector

USD 4.90M
Average cost of a data breach with a malicious
insider initial attack vector

Previous section

Next section

19

02

Complete findings

Figure 10. Phishing and stolen orcompromised credentials were the twomost common initial attack vectors.
Phishing and stolen or compromised
credentials were responsible for 16%
and 15% of breaches, respectively, withphishing moving into the lead spot bya small margin over stolen credentials,
which was the most common vector in
the 2022 report. Cloud misconfiguration
was identified as the initial vector for 11%
of attacks, followed by business email
compromise at 9%. This year, for the firsttime, the report examined both zero-day(unknown) vulnerabilities as well as known,
unpatched vulnerabilities as the sourceof the data breach and found that morethan 5% of the breaches studied originatedfrom known vulnerabilities that had yet
to be patched.

Although relatively rare at 6% of
occurrences, attacks initiated by malicious
insiders were the costliest, at an averageof USD 4.90 million, which is 9.6% higher
than the global average cost of USD 4.45
million per data breach. Phishing was
the most prevalent attack vector andthe second most expensive at USD 4.76
million. Breaches attributed to system error
were the least costly, at an average of USD
3.96 million, and the least common, at 5%of occurrences.

Cost and frequency of a data breach by initial attack vector$5.00
Malicious insider
$4.90
$4.70

Accidental data loss or lostor stolen device
$4.46

$4.40

Known unpatchedvulnerability
$4.17

$4.10

$3.80

Business email
compromise$4.67
Socialengineering$4.55

Physical security
compromise$4.10

System error$3.96

Phishing$4.76

Unknown (zero-day)vulnerability$4.45

Stolen or compromised
credentials
$4.62

Cloud
misconfiguration
$4.00

$3.50
4%

6%

8%

10%

12%

14%

16%

18%

Figure 10. Measured in USD millions

Previous section

Next section

20

02

Complete findings

Figure 11. Breaches that initiated withstolen or compromised credentials
and malicious insiders took the longest
to resolve.
This year, it took nearly 11 months (328days) to identify and contain data breaches
resulting from stolen or compromised
credentials, on average, and about 10
months (308 days) to resolve breaches
that were initiated by a malicious insider.
Those two vectors, along with phishingand business email compromise, were also
responsible for the costliest breaches.

Time to identify and contain a data breach by initial attack vector

Stolen or compromised credentials

240

Malicious insider

228

Social engineering

218

80

298

Phishing

217

76

293

Accidental data loss or lost or stolen device

205

Unknown (zero-day) vulnerability

195

77

272

Physical security compromise

198

69

267

Business email compromise

194

72

266

Cloud misconfiguration

190

68

258

Known unpatched vulnerability

183

70

253

System error

180

As a point of comparison, the overall meantime to identify and contain a data breachwas 277 days or just over nine months.
That figure has remained relatively constantover the past few years of the report.

0
MTTI

50

100

88

328

80

308

283

78

236

56
150

200

250

300

350

MTTC

Figure 11. Measured in days

Previous section

Next section

21

02

Complete findings

Identifying attacks
This section looks at how breaches
were identified and the differences incost and containment time based on
the identification method, analyses thatare reported for the first time this year.
There are three categories that define
how breaches are identified: by anorganization’s internal security teams andtools, including managed security service
providers (MSSPs); by a benign third
party, such as a security researcher or law
enforcement; and by disclosure from theattacker, as in the case of ransomware.

Previous section

Next section

33%
Only one-third of breaches
were identified by theorganizations’ internal
security teams and tools

22

02

Complete findings

How was the breach identified?

By a benign third party

Figure 12. Breaches were most commonly
identified by a benign third party.
40% of breaches were identified by abenign third party or outsider, whereas
33% of breaches were identified by internalteams and tools. Over one-quarter or 27%
of breaches were disclosed by the attacker
as part of a ransomware attack.

Figure 13. Data breaches disclosed by theattacker, such as with ransomware, cost
significantly more.
Attacks disclosed by attackers had an
average cost of USD 5.23 million, which
was a 19.5% or USD 930,000 difference
over the average cost of breaches identified
through internal security teams or tools of
USD 4.30 million. Additionally, breaches
disclosed by attackers cost 16.1% or USD
780,000 more than the USD 4.45 million
average cost of a data breach for 2023.
Breaches identified by an organization’s
own security teams and tools weresignificantly less expensive, costing nearly
USD 1 million less than incidents disclosedby the attacker.

40%

By the organization’s
security teams and tools

33%

By disclosure from the attacker

27%
0%

5%

10% 15% 20% 25% 30% 35% 40% 45%

Figure 12. Only one response permitted

Cost of a data breach by how the breach was identified

By a benign third party

$4.68
$4.30

By disclosure from the attacker
$0.00

$5.23
$1.00

$2.00

$3.00

$4.00

$5.00

$6.00

Figure 13. Measured in USD millions

Previous section

Next section

23

02

Complete findings

Figure 14. Data breaches disclosed by
the attacker also took the longest time toidentify and contain.
Respondents required a mean time of
320 days to identify and contain breaches
disclosed by the attacker. This time frame
was 80 additional days or 28.2% longer
compared to breaches identified internally,
which took a mean time of 241 days toidentify and contain. The mean time toidentify and contain a breach disclosed by
the attacker took 47 days or 15.9% longer
compared to breaches identified by abenign third party.

Time to identify and contain a breach by how the breach was identified

By disclosure from the attacker

233

By a benign third party

203

By the organization’s security teams and tools

MTTI

50

100

273

70

182
0

320

87

241

59
150

200

250

300

350

MTTC

Figure 14. Measured in days

Previous section

Next section

24

02

Complete findings

Data breach lifecycle
The data breach lifecycle is defined as theelapsed time between the initial detectionof the breach and its containment. “Timeto identify” describes the time, in days,
it takes to discover an incident. “Timeto contain” refers to the time, in days,
it takes for an organization to resolve
the situation and restore service after
the breach has been detected. These
two metrics help determine theeffectiveness of an organization’s
IR and containment processes.

277 daysTime to identify and contain a data breachPrevious section

Next section

02

Complete findings

Figure 15. A shorter data breach lifecycle
continues to be associated with lower
data breach costs.
A shorter data breach lifecycle of fewer
than 200 days was associated with anaverage cost of USD 3.93 million, while alonger lifecycle of more than 200 days was
associated with an average cost of USD
4.95 million. This reflects a 23% difference
and a cost savings of USD 1.02 million forthe shorter lifecycle.
Looking back at previous years, the average
cost of a data breach based on the 200day lifecycle has been relatively consistent,
although it changed incrementally.

For a data breach lifecycle of fewer than
200 days, the 2023 value of USD 3.93
million grew 5.1% from the previous year’s
average cost of USD 3.74 million. For a data
breach lifecycle of more than 200 days, the2023 value of USD 4.95 million grew 1.9%
from the previous year’s average cost of
USD 4.86 million. The average cost savingsof USD 1.02 million reported in 2023
reflects an 8.9% decrease from 2022’s
cost savings of USD 1.12 million.

Cost of a data breach based on thebreach lifecycle
$6.00
$4.95

$5.00
$4.00

$3.93

$3.00
$2.00
$1.00
$0.00
Lifecycle<200 days

Figure 15. Measured in USD millions

Previous section

Next section

26

02

Complete findings

Key cost factors
The types of security technologies andpractices employed within an organization
are among many factors that influence themean cost of a data breach. This section
quantifies 27 cost factors to help security
and risk decision-makers understand thedegree to which these factors amplify
or mitigate costs. These factors aren’t
additive, so it’s not consistent with theresearch methodology to add multiple cost
factors together to calculate the potential
cost of a breach.

This year, the Cost of a Data Breach Reportconsiders several new factors, including
supply chain breaches, ASM tools, data
security and protection software, endpoint
detection and response (EDR) tools, threat
intelligence, proactive threat hunting,IR teams, and security orchestration,
automation and response (SOAR) tools.

USD 5.36M
Average cost of a breach for organizations
with high levels of security skills shortage

02

Complete findings
Impact of key factors on total cost of a data breach
DevSecOps approach

Figure 16. The impact of 27 factors on themean cost of a data breach.
The chart demonstrates the average costdifference of breaches at organizations withthese cost-influencing factors comparedto the overall average data breach cost of
USD 4.45 million. Cost mitigators describe
those factors that are associated with alower-than-average breach cost, while cost
amplifiers are associated with a higherthan-average breach cost.
The three factors that rank most effective
as cost mitigators—those associatedwith the biggest cost reduction—are
the adoption of a DevSecOps approach,employee training, and IR planningand testing. For example, breaches atorganizations with a DevSecOps approachin place had an average cost that was USD

249,000 less than the 2023 mean costof a data breach of USD 4.45 million orapproximately USD 4.20 million.
The biggest cost amplifiers were security
system complexity, security skills shortage,and noncompliance with regulations. For
example, breaches at organizations withsecurity system complexity had an average
cost of USD 241,000 more than the 2023
mean cost of a data breach of USD 4.45
million or approximately USD 4.69 million.

-$249,278

Employee training-$232,867

IR plan and testing-$232,008

AI, machine learning–driven insights-$225,627

IR team-$221,794

Encryption-$221,593

Security information and event management (SIEM)-$202,347

SOAR tools-$202,232

Proactive threat hunting-$201,111

Threat intelligence-$196,936

Insurance protection-$196,452

Offensive security testing-$187,703

Identity and access management (IAM)-$180,358

EDR tools-$174,267

Data security and protection software-$170,412

Board-level oversight-$167,818

ASM tools-$162,278

CISO appointed
MSSP-$130,086-$73,082

Remote workforce$173,074

Supply chain breach$192,485

IoT or OT environment impacted$195,428

Third-party involvement$216,441

Migration to the cloud$218,362

Noncompliance with regulations$218,915

Security skills shortage$238,637

Security system complexity$240,889-$300,000 -$200,000 -$100,000

Avg. cost $100,000 $200,000 $300,000

Figure 16. Measured in USD
Previous section

Next section

28

02

Complete findings

Figure 17. The three most impactful cost
amplifiers out of 27 factors.
This chart compares organizations
with the highest levels of a top-ranking
cost amplifier to those with the lowest
level, which in some cases could meanno instance of that same factor. This
comparison differs from the prior analysis(Figure 16) in which a high presence of
these factors is compared to the mean.
There was a difference of USD 1.58 million
or 34.6% between high levels and low
levels of secrity skills shortage. A differenceof USD 1.44 million or 31.6% occurred
between high levels and low levels of
security system complexity. And there
was a difference of USD 1.04 million or
23% between high levels and low levelsof noncompliance with regulations.

Organizations with a high level of security
skills shortage had a USD 5.36 million
average cost, which was USD 910,000
higher than the average cost of a data
breach, a difference of 18.6%. Those witha high level of security system complexity
had a USD 5.28 million average cost, fora difference of USD 830,000 or 17.1%
compared to the average cost of a data
breach. Organizations with a high level ofnoncompliance with regulations showed
an average cost of USD 5.05 million, which
exceeded the average cost of a data breachby USD 560,000, a difference of 12.6%.

Cost of a data breach for organizations with a high levelversus low level of three cost-amplifying factors

$6.00

$5.36

$5.28

$5.05

$5.00
$3.78

$4.00

$3.84

$4.01

$3.00
$2.00
$1.00
$0.00
Security skills shortage
High level

Security systemcomplexity

Low level or none

Figure 17. Measured in USD millions

Previous section

Next section

29

02

Complete findings

Figure 18. The three most impactful cost
mitigators out of 27 factors.
The chart compares organizations withthe highest levels of a top-ranking cost
mitigator to those with the lowest level,
which in some cases could mean no
instance of that same factor. The average
cost of a breach showed a differenceof USD 1.68 million or 38.4% between
organizations with high levels and low
levels of a DevSecOps approach. There
was a difference of USD 1.49 million or
34.1% between high levels and little to no
IR planning and testing. And last, there wasa difference of USD 1.5 million or 33.9%
between high levels and low levels of
employee training.

Organizations with high levels of these cost
mitigators present had a significantly lower
than average cost of a data breach. Highlevel DevSecOps adopters had an average
cost of USD 3.54 million—a differenceof USD 910,000 or 22.8% compared tothe overall average cost of a data breach.
Organizations with a low usage of a
DevSecOps approach had an average costof USD 5.22 million, which was significantly
higher by a difference of USD 770,000
or 15.9% compared to the average costof a data breach.

Cost of a data breach for organizations with a high levelversus low level of three cost-mitigating factors

$6.00

$5.22

$5.00
$4.00

$5.18

$5.11
$3.62

$3.54

$3.68

$3.00
$2.00
$1.00
$0.00
DevSecOps approach
High level

IR plan and testing

Employee training

Low level or none

Figure 18. Measured in USD millions

Previous section

Next section

30

02

Complete findings

Ransomware anddestructive attacks
This year, ransomware and destructive
attacks3 accounted for 24% and 25% of
malicious attacks, respectively.
As in the 2022 report, we looked at the
lifecycle of these types of breaches andthe impact of paying a ransom compared
to not paying a ransom. This study
doesn’t include the cost of the ransom in
calculating the total cost of the breach.
In the 2023 report, for the first time, we
examined the influence of involving law
enforcement in the effort to contain aransomware attack.

Previous section

Next section

25%
Share of malicious
attacks that renderedsystems inoperable

31

02

Complete findings

Share of total breaches by type of malicious attack

Destructive attack

Figure 19. Nearly one-quarter of attacks
involved ransomware.
Destructive attacks that left systems
inoperable accounted for one out of every
four attacks, and another 24% involved
ransomware. Business partner andsoftware supply chain attacks accounted
for 15% and 12% of attacks, respectively.

Figure 20. Ransomware attack costs
increased significantly.
At USD 5.13 million, the average cost of
a ransomware attack in the 2023 reportincreased 13% from the average cost of
USD 4.54 million in the 2022 report. At
USD 5.24 million, the average cost of a
destructive attack in the 2023 report also
increased 2.3% from the average cost of
USD 5.12 million in the 2022 report.

25%

Ransomware

24%

Attack on the business partner supply chain

15%

Attack on the software supply chain

12%
0%

5%

10%

15%

20%

25%

30%

Figure 19. Percentages for each attack type shown areout of total breaches; bars will not sum to 100%

Cost of a ransomware or destructive attack

Destructive attack$5.24

Ransomware attack

$5.13

$0.00

$1.00

$2.00

$3.00

$4.00

$5.00

$6.00

Figure 20. Measured in USD millions

Previous section

Next section

32

02

Complete findings

Figures 21 and 22. Organizations thatinvolved law enforcement saw significant
time and cost savings.
37% of ransomware victims opted not to
involve law enforcement to help containa ransomware breach, but those that did
experienced a less costly ransomware
breach overall. The average cost of aransomware breach was USD 5.11 million
when law enforcement wasn’t involved and
USD 4.64 million when law enforcement
was involved, for a difference of 9.6%
or USD 470,000.

Share of ransomware attacks withlaw enforcement involved

Cost of a ransomware attack by
law enforcement involvement

$6.00
$5.11
$5.00
37%

$4.64

$4.00
$3.00
63%

$2.00
$1.00
$0.00

Law enforcement involved
Law enforcement not involved

Figure 21. Share of all ransomware attacks

Previous section

Next section

Law enforcement Law enforcement
involved
not involved

Figure 22. Measured in USD millions

33

02

Complete findings

Time to identify and contain a ransomware
attack with law enforcement involvement
Figure 23. Measured in days

226

Figure 23. Law enforcement helped
shorten time to identify and containransomware breaches.
Total time to identify and contain aransomware breach was 11.4% or 33 days
shorter with law enforcement involvement,
at 273 days in total compared to 306 days.
The mean time to contain a ransomware
breach was 63 days or 23.8% shorter withlaw enforcement involvement compared
to 80 days without. It’s clear that involving
law enforcement can help reduce the costand duration of a ransomware breach.

80

306

273
210
MTTI

63

MTTC

Previous section

Next section

34

02

Complete findings

Impact of automated response playbooks or workflows for ransomware
on time to contain a ransomware breachDidn’t have automated response
playbooks or workflows

Figure 24. Automated response playbooks
or workflows cut down the time to containa ransomware breach.
Among organizations that experienced
a ransomware attack, those that had
automated response playbooks orworkflows designed specifically for
ransomware attacks were able to containthem in 68 days or 16% fewer days
compared to the average of 80 days fororganizations without automated response
playbooks or workflows.

Figure 25. Paying the ransom led tominimal cost savings.
Organizations that paid the ransom during
a ransomware attack achieved only asmall difference in total cost, at USD 5.06
million compared to USD 5.17 million, acost difference of USD 110,000 or 2.2%.
However, this calculation doesn’t include
the cost of the ransom itself. Given thehigh cost of most ransomware demands,
organizations that paid the ransom likely
ended up spending more overall thanthose that didn’t pay the ransom. In the2022 report, the total cost savings were
USD 630,000, with a total cost differenceof 13.1%, again not including the cost of
the ransom itself. The data shows thatpaying a ransom has become increasingly
less advantageous overall, with an 82.5%
decrease in savings from the 2022 to2023 reports.

80

Had automated response
playbooks or workflows

68
0

10

20

30

40

50

60

70

80

90

MTTC

Figure 24. Measured in days

Cost of a ransomware attack based on whether the ransom was paid

$5.17

Didn’t pay ransom

$5.12
$5.06

Paid ransom

$0.00
2023

$4.49
$1.00

$2.00

$3.00

$4.00

$5.00

$6.00

2022

Figure 25. Measured in USD millions (cost of ransom not included)

Previous section

Next section

35

02

Complete findings

Cost of a data breach due to a business partner supply chain compromise

Business partner supply
chain attacks
A business partner supply chain
compromise is a data breach that originateswith an attack on a business partner. In
this year’s study, 15% of organizations
identified a supply chain compromise as
the source of a data breach.

Figures 26 and 27. A business partner
supply chain compromise cost 11.8%
more and took 12.8% longer to identify
and contain than other breach types.
The cost of a data breach due to a business
partner supply chain compromise averaged
USD 4.76 million, which was USD 530,000
or 11.8% higher than the USD 4.23 million
average cost of a data breach that was due
to another cause.
Organizations took an average of 233
days to identify and 74 days to contain abusiness partner supply chain compromise,
for a total lifecycle of 307 days. That
average lifecycle was 37 days or 12.8%
longer than the average lifecycle of 270
days for data breaches attributed toanother cause.

Business partner supply
chain compromise$4.76

Not a business partner supply
chain compromise

$4.23

$0.00

$1.00

$2.00

$3.00

$4.00

$5.00

Figure 26. Measured in USD millions

Time to identify and contain a data breach based on occurrenceof a business partner supply chain compromise

Business partner supply
chain compromise

233

Not a business partner supply
chain compromise

206
0

MTTI

50

100

307

74

270

64
150

200

250

300

MTTC

Figure 27. Measured in days

Previous section

Next section

36

02

Complete findings

Software supply chain attacks
For the first time this year, the study also
examined attacks that originated from asoftware supply chain attack in which an
attacker infiltrates a software vendor’s
network and deploys malicious code
to compromise the software before thevendor sends it to its customers. The
compromised software then attacks thecustomer’s data or system. In this year’s
study, 12% of organizations identified asoftware supply chain attack as the sourceof a data breach.

Previous section

Next section

12%
Share of data breaches
originated from a software
supply chain attack

37

02

Complete findings

Cost of a data breach based on occurrence of a software
supply chain compromise

Software supply
chain compromise

Figures 28 and 29. Software supply chain
compromises cost 8.3% more and took
8.9% longer to identify and contain thanother breach types.
The cost of a data breach due to a software
supply chain compromise averaged USD
4.63 million, which was USD 370,000 or
8.3% higher than the USD 4.26 million
average cost of a data breach that wasdue to another cause. A breach due to asoftware supply chain compromise had
an 8.9% longer lifecycle, at 294 days
compared to 269, than data breaches
due to other causes.

Although a supply chain compromise
originating from within the software supply
chain is less costly than one originatingfrom a business partner, both still costmore and take longer than the averagedata breach.

$4.63

$4.26

$0.00

$1.00

$2.00

$3.00

$4.00

$5.00

77

294

Figure 28. Measured in USD millions

Time to identify and contain a data breach based on
occurrence of a software supply chain compromise

Software supply
chain compromise217

Not a software supply
chain compromise

202

0
MTTI

50

100

269

67

150

200

250

300

MTTC

Figure 29. Measured in days

Previous section

Next section

38

02

Complete findings

Regulatory environments
The research examined how the degree ofdata regulation affected the cost of a data
breach. In environments with high levels ofdata regulation, 58% of costs continued to
accrue after the first year. In low-regulation
environments, 64% of the costs associatedwith a breach were more likely to beresolved within the first year.
The cost of a data breach tends to change
in the time elapsed since the breach. Theremay be different costs associated with eachstage of the breach as it’s identified andcontained and as the compromised data isrecovered or repaired.

Previous section

Next section

USD 250,000
20% of organizations that experienced
a data breach paid this much or morein fines

02

Figures 30a and 30b. Peak costs wereincurred more than two years after adata breach was identified in high-data
regulation environments.
Organizations in low-regulation
environments took on nearly two-thirdsof their data breach costs in the firstyear, whereas organizations in highregulation environments took on lessthan half of their data breach costs inthe first year. Data breach costs in lowregulation environments peaked at 21%
of total costs accrued in the time frame of
6–9 months. Data breach costs in highregulation environments peaked at 21%
of total costs accrued after the two-year
mark. The bulk of data breach costs ina low-regulation environment spiked
early on and tapered with time. In a highregulation environment, costs oscillated
and continued to rise two years after thebreach was identified.

Complete findings

Distribution over time of data breach costs in low-data versus high-data regulation environments

Distribution of data breach costs by
year in low-data versus high-data
regulation environments

25%
20%

20%

15%

21%

21%
18%

15%

18%

16%

16%

13%

14%

10%

10%

10%
6%

5%

9%
7%

Low regulation

First year

51%

64%

42%

Second year

31%

32%

37%

6–9
months9–12months4%

Two-plus years

18%

4%

21%

2%

0%

2023 averageHighregulation

3%

3%
3–6
months

5%

4%

5%

0–3
monthsLow
regulation

15%

9%

Percentage of total cost2023
average

16%

10%
10%

Time elapsed
since breach

12–15
months15–18
months18–21
months21–24
months>2 years

Figure 30b. Percentage of total costs over the years

High regulation

Figure 30a. Percentage of total costs accrued in three-month intervals

Previous section

Next section

40

02

Complete findings

Cost of a data breach for critical infrastructureindustries versus other industries
Figure 31. Measured in USD millions$5.04

Figure 31. Data breach costs for criticalinfrastructure industries exceed
USD 5 million.
Critical infrastructure organizations
included those in the financial
services, industrial, technology, energy,transportation, communication, healthcare,education and public sector industries.
These organizations incurred data breachcosts that were USD 1.26 million higher
than the average cost of USD 3.78 million
for organizations in other industries, adifference of 28.6%. This USD 5.04 million
value also reflects a 4.6% increase of
USD 4.82 million over the 2022 reported
average cost of a data breach for criticalinfrastructure industries.

$3.78
Other industries

Previous section

Next section

41

02

Figures 32 and 33. Fewer than one-thirdof organizations incurred fines due to data
breaches, and 80% of fines amounted to
USD 250,000 or less.
Of the organizations studied, 31% incurredfines as a result of a data breach, and only
20% of those fines exceeded USD 250,000.
A fine of USD 250,000 represented 5.6%of the average total cost of a data breachin the 2023 report.

Complete findings

Did your organization incur any
fines from the data breach?

Distribution of cost of fines incurred from a data breach

30%
25%

25%

31%

19%

20%
15%

21%

20%

15%

10%

69%

5%
0%
Less than $25,000

Incurred fines$50,001–$100,000$101,001–$250,000

More than $250,000

No fines

Figure 32. Share of all organizations

Previous section$25,000–$50,000

Figure 33. Among those that experienced fines, as measured in USD

Next section

42

02

Complete findings

Cloud breaches
The cost and duration of a breach varied
depending on where the data was stored.
Most commonly, the breaches studied
included data that spanned multiple
environments—including cloud and on
premises—and breaches of this type also
contributed to higher costs and longer time
to identify and contain a data breach.

Previous section

Next section

82%
Share of breaches thatinvolved data stored incloud environments—
public cloud, private
cloud or across multiple
environments

43

02

Complete findings

Where was the breached data stored?

39%

Across multiple typesof environments

Figure 34. Breaches most commonly
impacted data stored across multiple
environments.
The largest percentage of breaches,
39%, involved data stored acrossmultiple environments, followed by 27%
of breaches that involved data stored in
the public cloud. The number of breaches
occurring across multiple environments
surpassed the combined 34% ofbreaches occurring only in private
cloud or on-premises environments.

Figure 35. Data breaches in public
clouds and multiple environments
had higher costs.
In the 2023 report, the cost of data
breaches across multiple environments
reached USD 4.75 million, the highest
cost of the environments analyzed, and17.6% higher than the USD 3.98 million
cost of data breaches in a private cloudenvironment, which was the lowest
cost of the environments analyzed. The
cost of data breaches across multiple
environments also exceeded the average
cost of a data breach of USD 4.45 million
by a margin of 6.5%.

18%

On premises

27%

Public cloud16%

Private cloud
0%

5%

10%

15%

20%

25%

30%

35%

40%

Figure 34. Share of all breaches

Cost of a data breach by storage location of breached data

$4.75
On premises

$3.99
$4.57

Public cloudPrivate cloud$3.98$0.00 $0.50 $1.00 $1.50 $2.00 $2.50 $3.00 $3.50 $4.00 $4.50 $5.00

Figure 35. Measured in USD millions

Previous section

Next section

44

02

Complete findings

Figure 36. The use of public clouds andmultiple environments also contributes
to longer data breach lifecycles.
The longest time to identify and containa breach involved data stored acrossmultiple environments, taking 291 days.
This interval exceeded the shortest time toidentify and contain a breach—which was
235 days in a private cloud environment—by 56 days or 21.3%. It’s also worth notingthat the use of multiple environments isthe only model that exceeds the 2023
reported average time to identify andcontain a data breach of 277 days bya margin of 14 days or 4.9%.

Time to identify and contain a data breach by storage location of breached data

Across multiple typesof environments

216

On premises

178

Public cloud

0

50

276

69

178

235

56
100

150

200

291

232

54

207

Private cloud

MTTI

76

250

300

MTTC

Figure 36. Measured in days

Previous section

Next section

45

02

Complete findings

Mega breaches
Mega breaches, characterized by morethan one million compromised records, arerelatively rare. But they exert a powerful
impact due to their outsized scope.

USD 332M
Average total cost for breaches of
50 million to 60 million records

This year’s study included 20 organizations
that endured the loss or theft of between
1 million and 60 million records due to data
breaches. The study deployed a distinct
methodology to examine those mega
breaches. They were considered separatelyfrom the study’s other 553 breaches,
each including no more than 101,200
lost or compromised records. For a full
explanation of the research methodology,
see the data breach FAQs at the endof this report.

Previous section

Next section

46

02

Complete findings

Figure 37. The cost of mega breaches fellin the 2023 report.
Across all breach size cohorts, the average
cost of a mega breach fell to varying
degrees. The highest percentage decrease
occurred in the 1 million to 10 million
cohort, with a 26.5% decrease from USD
49 million in the 2022 report to USD 36
million in the 2023 report. The smallest
percentage decrease occurred in the 30
million to 40 million cohort, with a 3.8%
decrease from USD 316 million in the2022 report to USD 304 million in the2023 report. In the 50 million to 60 million
cohort, the 2022 reported cost of USD 387
million decreased by USD 55 million
or 14.2% to equal USD 332 million in
the 2023 report.

Cost of a mega breach by number of records lost

$400

$387

$379

$350

$316

$300
$241

$250
$200

$180

$304

$328

$332

40M–50M

50M–60M

$225

$166

$150
$100
$50

$49

$36

$0
1M–10M2022

10M–20M

20M–30M

30M–40M

2023

Figure 37. Measured in USD millions

Previous section

Next section

47

02

Complete findings

Security investments
This section examines the security
investment strategies that organizations
adopted after experiencing a data breach.
We’ll explore how often organizations
increased spending after a breach as well
as how they chose to allocate funds.

Previous section

Next section

51%
Percentage oforganizations increasing
security investments
after a breach

48

02

Figure 38. Respondents were split on
increasing security investment after
a breach.
Even as the global cost of a data breachincreased, research participants reported
divided perspectives on increasing security
investments after an incident. 51% of
respondents indicated they planned
for additional security spending after
the breach.

Complete findings

Following the data breach, will
your organization increase its
security investment?

49%

51%

Will increase security investment
Won’t increase security investment

Figure 38. Percentage of all organizations

Previous section

Next section

49

02

Complete findings

Figure 39. IR planning and testing andemployee training saw significant
post-breach investment.
Of the 51% that increased spending after
a breach, organizations’ most common
investment was in IR planning and testing at
50%, followed closely by employee training
at 46%. Threat detection and response
technologies placed third at 38%, making
them the top-ranked technology or tool
investment considered in this section.
Notably, these three investments map
closely to top factors associated with lower
data breach costs that are explored in thisyear’s key cost factors section. At only 18%
of respondents, insurance protection was
the least common investment after a breach.

Most common investment types among those increasing security
investments following a breachIR plan and testing50%

Employee training

46%

Threat detection and response technologies

38%

Offensive security testing

35%

IAM

32%

Managed security services

31%

Data security or protection tools

25%

Insurance protection

18%
0%

10%

20%

30%

40%

50%

Figure 39. Share among organizations that are increasing investment; more than one response permitted

Previous section

Next section

50

02

Complete findings

Security AI and automation
With security AI and automation use
cases for the security industry advancing,
this report examines the impact of thesetechnologies on data breach costs andtimelines. Examples include the use ofAI, machine learning, automation andorchestration to augment or replace humanintervention in detection and investigationof threats as well as the response andcontainment process. On the opposite
end of the spectrum are processes driven
by manual inputs, often across dozens oftools and complex, nonintegrated systems,
without data shared between them.
Though this is the sixth year of investigating
the impact of AI and automation on
cybersecurity, this year we’re introducing
new criteria that considered AI’s permeation
throughout an organization’s security

processes as opposed to its level of
deployment—ranging from not deployed
to partially or fully deployed—in prioryears’ data.
– “Extensive use” refers to the integrationof security AI and automation throughout
operations, including several different
tool sets and capabilities.
– “Limited use” refers to applying AI
to just one or two use cases withinsecurity operations.
– “No use” refers to security processes
that are driven solely by manual inputs.

108 days
Organizations with extensive use of security AI
and automation identified and contained a data
breach 108 days faster than organizations
with no use.

Previous section

Next section

51

02

Complete findings

Figure 40. A 61% majority oforganizations employ some level of
security AI and automation.
Only 28% of organizations extensively
used security AI and automation tools intheir cybersecurity processes, while 33%
had limited use. That leaves nearly 4 in
10 relying solely on manual inputs in theirsecurity operations.

Figure 41. Extensive security AI and
automation use delivered cost savingsof nearly USD 1.8 million.
Organizations with extensive use of security
AI and automation demonstrated thehighest cost savings comparatively, withan average cost of a data breach at USD
3.60 million, which was USD 1.76 million
less and a 39.3% difference compared to
no use. Even organizations with limited useof security AI and automation measured
an average cost of a data breach of USD
4.04 million, which was USD 1.32 million
less or a 28.1% difference compared to nouse. However, organizations with no use of
security AI and automation experienced
an average cost of a data breach of USD
5.36 million. This is 18.6% more than the2023 average cost of a data breach of
USD 4.45 million.

Previous section

Next section

State of security AI and automationcomparing three usage levels

Cost of a data breach by security AI
and automation usage level

45%

$6.00
$5.00

33%

35%
30%

$5.36

39%

40%

28%

$4.00

25%

$4.04
$3.60

$3.00

20%
15%

$2.00

10%

$1.00

5%
0%

$0.00
Extensive use

Limited use

No useFigure 40. Percentage of organizations per usage level

Extensive use

Limited use

No useFigure 41. Measured in USD millions

52

02

Complete findings

Figure 42. Extensive security AI and
automation reduced the time to identify
and contain a breach by more than
100 days.
Respondents from organizations
that extensively used security AI and
automation were able to identify andcontain a breach in 214 days, which was
108 days shorter than those with no use.
This means identifying and containing abreach with extensive use of security AI
and automation took just 66% of the timeit took organizations with no use. Limited
use also made a significant impact, withan average time to identify and contain abreach in 234 days, which was 88 days
shorter than organizations with no use.
It’s clear that even a limited effort tointegrate security AI and automation into
security workflows can offer a significant
acceleration in the time to identify andcontain a breach as well as a sizable
reduction in costs.

Time to identify and contain a data breach by security AI and automation use level

Extensive use

167

Limited use

172

234

62

No use

237
0

MTTI

214

47

25

50

75

100

125

322

85
150

175

200

225

250

275

300

325

MTTC

Figure 42. Measured in days

Previous section

Next section

53

02

Complete findings

Incident response

54 days

IR strategies and tactics have been
instrumental in reducing the impact of data
breaches. The most effective IR strategy
for reducing the duration of a data breach
was to combine formation of an IR teamwith testing of the IR plan. However, someorganizations pursued only one of those
two strategies. As a standalone effort, IR
plan testing was more effective than only
forming an IR team in reducing the total
time to identify and contain the breach.

Organizations with both an IR team and IR plan
testing identified breaches 54 days faster thanthose with neither.

Previous section

Next section

54

02

Complete findings

Figure 43. The combined IR strategy
saved 54 days in identifying andcontaining a breach.
The dual strategy of forming an IR teamand testing an IR plan demonstrated ashorter time, 252 days, to identify andcontain a data breach compared to 306
days of employing neither approach, adifference of 54 days or 19.4%. Testing the
IR plan without forming a team was nearly
as effective, resulting in a difference of48 days or 17%.

Time to identify and contain a data breach by IR team formation and testing

306

Neither IR team nor IR plan testing216

Formation of an IR team

208

Testing of the IR plan

196

62

258

Both IR team and IR plan testing

194

58

252

0
MTTI

50

100

90

288

80

150

200

250

300

MTTC

Figure 43. Measured in days

Previous section

Next section

55

02

Complete findings

Threat intelligence
New to the report this year is the impactof threat intelligence services on themean time to identify a breach. Threat
intelligence services provide security
leaders with information and insights
about cyberthreats and vulnerabilities tohelp them improve their organization’s
security posture.

28 daysOrganizations using threat
intelligence identified
breaches 28 days faster.

Previous section

Next section

02

Complete findings

Time to identify a data breach using threat intelligence
Figure 44. MTTI measured in days

Figure 44. Threat intelligence reduced
breach identification time.
This year’s research showed that threat
intelligence users uncovered breaches
in 13.9% less time than those withouta threat intelligence investment, adifference of 28 days. Compared tothis year’s global MTTI of 204 days,organizations employing threat intelligence
services were able to identify breaches in
8.2% or 16 days less time. Respondents
that did not use threat intelligence took
5.7% or 12 days longer than the global
average to identify breaches.

Previous section

Next section

216
Doesn’t use threat intelligence

188
Uses threat intelligence02Complete findings

Vulnerability and risk
management
New this year, the research examined
how organizations prioritized risks andvulnerabilities and how this impacted thecost of a data breach. Organizations withmore proactive and risk-based vulnerability
management, such as vulnerability
testing, penetration testing or red teaming,
experienced lower than average data
breach costs compared to organizations
that relied solely on the industry standard
Common Vulnerabilities and Exposures(CVE) glossary and the Common
Vulnerability Scoring System (CVSS).
Generally, proactive risk management
efforts involve the organization’s IT
security team adopting the perspective ofa potential attacker to determine which
vulnerabilities are exploitable and cancause the most harm.

USD 3.98M
Cost of a data breach for organizations that
deployed robust risk-based analysis

02Complete findings

Figures 45 and 46. Organizations thatprioritize activities beyond CVE scoreexperienced less costly breaches.
More than one-third of organizations
or 36% relied solely on CVE scoring toprioritize vulnerabilities, while the majorityof organizations or 64% used more involved
risk-based analysis. The 2023 researchshowed a significant differencein the cost of data breaches between these
two groups. Organizations that deployed
more intensive, risk-based analysis
experienced an average cost of a data
breach of USD 3.98 million, a differenceof 18.3%, compared to USD 4.78 million
for organizations that relied on CVE
scores only.

How does your organization manage
vulnerability prioritization?

$5.00

$3.98

36%

$3.00
$2.00
64%

$1.00
$0.00
CVE score only

Figure 45. Percentage of all organizations

Next section

$4.78

$4.00

Other risk-based analysis

Previous section

Cost of a data breach by vulnerabilitymanagement prioritization approach

CVE score only

Other risk-based
analysis, for example,
based on real-world
attacks

Figure 46. Measured in USD millions

59

02

Complete findings

Attack surface management
ASM is a set of processes that aids inthe discovery, analysis, remediation andmonitoring of an organization’s potential
attack surfaces or vulnerabilities.
Organizations that deployed an ASM
solution were able to identify and containdata breaches in 75% of the time of those
without an ASM solution.

Figure 47. ASM helped accelerate total
time to identify and contain a data breachby nearly 12 weeks.
Without an ASM solution, organizations
took 260 days to identify a data breachand another 77 days to contain it, for a
total of 337 days or about 11 months.
Organizations with an ASM solution
identified the breach in 193 days andcontained it in 61 days. The 254-day total
time to identify and contain a breach
represented an acceleration of 83 days or
about 12 weeks so the data breaches wereidentified and contained in 75% of the time
taken by data breaches at organizations
without ASM solutions.

Previous section

Next section

Time to identify and contain a data breach by use of an ASM solution

Has ASM solution

50

100

150

200

337

254

61

193

0
MTTI

77

260

Doesn’t have ASM solution

250

300

350

MTTC

Figure 47. Measured in days

60

02

Complete findings

Managed security
service providers
For the first time, our research exploredthe impact that partnering with an MSSP
had on the time to identify and containa breach. MSSPs offer organizations theability to outsource security monitoring andmanagement, often using high-availability
security operations centers to provide
around-the-clock services. MSSPs canhelp organizations enhance their security
posture without increasing head count orinvesting in training for internal resources.

Figure 48. Organizations with
MSSPs experienced a 21% shorter
breach lifecycle.
In the 2023 report, organizations that had
an MSSP were able to identify and containbreaches in 80% of the time of those
without. Organizations that worked with
an MSSP identified breaches 16 days fasteror an 8.2% shorter identification time thanthe 2023 reported global average of 204
days. Those that didn’t took 28 days longer
or 12.8% longer. Containment times with
no MSSP were five days longer or 6.6%
longer than the 2023 reported global
average of 73 days. Containment times
with MSSP assistance were 10 days fasteror 14.7% faster.

Previous section

Next section

Time to identify and contain a data breach when using an MSSPNo MSSP

232

Using MSSP

188

0
MTTI

50

100

310

78

251

63

150

200

250

300

MTTC

Figure 48. Measured in days

61

03
Recommendations to help
reduce the cost of a data breachsecurity into every stage
1 Buildof software development andIn this section, IBM Security outlines steps
organizations can take to help reduce the financial
and reputational impacts of a data breach. Our
recommendations include successful security
approaches that are associated with reduced costs
and lower times to identify and contain breaches.

deployment—and test regularly

data protection
2 Modernize
across hybrid cloud3

Use security AI and automation
to increase speed and accuracy

resiliency by
4 Strengthen
knowing your attack surface
and practicing IR

Previous section

Next section

62

03

Recommendations to help reducethe cost of a data breach1
Build security into every stage of softwaredevelopment and deployment—andtest regularly
Regulatory requirements continue tobecome more intricate, especially astechnology becomes more intertwinedwith everyday activities and software
becomes more feature rich and complex.
A DevSecOps approach—the top cost
mitigator in a special analysis of 27 factors
in the 2023 report—will be essential tobuilding security into any tools or platforms
an organization depends on to engage its
workforce or its customers.

Organizations of all types should look toensure that security is at the forefront of
the software they’re developing as wellas commercial off-the-shelf software thatthey’re deploying. Application developers
must continue to accelerate the adoptionof the principles of secure by design andsecure by default to ensure that security
is a core requirement that’s consideredduring the initial design phase of digitaltransformation projects and not simply
addressed after the fact. The same
principles are being applied to cloudenvironments to support cloud-native app
development that makes a serious effort toprotect user privacy and minimize attack
surfaces.

Previous section

Next section

Application testing or penetration testingfrom the perspective of an attacker canalso give organizations the opportunity toidentify and patch vulnerabilities before
they turn into breaches. No technology
or application will ever be fully secure,and adding more features introduces new
risks. Ongoing application testing can helporganizations identify new vulnerabilities.

63

03

Recommendations to help reducethe cost of a data breach2
Modernize data protection acrosshybrid cloud
Data is being created, shared and accessedat unprecedented scale across multicloudenvironments. Fast-paced adoption of
new cloud applications and services
is compounding the risk of “shadowdata”—sensitive data not being tracked
or managed—increasing security andcompliance risks. The majority (82%) ofdata breaches in this report involved datastored in cloud environments, and 39%
of breaches included data that spanned
multiple types of environments. The
cost and risk of these data breaches arecompounded by an ever-evolving matrixof regulations and stiff penalties fornoncompliance.

In the wake of these challenges, gaining
visibility and control of data spread acrosshybrid cloud should be a top priority fororganizations of all types and should
include a focus on strong encryption,
data security and data access policies.
Companies should seek data security andcompliance technologies that work on all
platforms, allowing them to protect data
as it moves across databases, applications
and services deployed across hybrid cloudenvironments. Data activity–monitoring
solutions can help ensure proper controls
are in place while actively enforcing
these policies—such as early detection of
suspicious activity and blocking real-timethreats to critical data stores.

Previous section

Next section

Additionally, newer technologies such asdata security posture management canhelp find unknown and sensitive data
across the cloud, including structured
and unstructured assets within cloudservice providers, software as a service(SaaS) properties and data lakes. This canhelp identify and mitigate vulnerabilities
in underlying data store configurations,entitlements and data flows.

As organizations continue to move further
into hybrid multicloud operations, it’s
essential to deploy strong identity andaccess management (IAM) strategies that
include technologies such as multifactor
authentication (MFA), with particular focus
on managing privileged user accounts thathave an elevated access level.

64

03

Recommendations to help reducethe cost of a data breach3
Use security AI and automation toincrease speed and accuracy
In the 2023 report, only 28% oforganizations used security AI and
automation extensively in their operations,which means many organizations have asignificant opportunity to improve their
speed, accuracy and efficiency. Extensive
use of security AI and automation delivered
nearly USD 1.8 million in data breachcost savings and accelerated the time toidentify and contain a breach by morethan 100 days compared to organizations
with no use.

using security AI and automation acrossthreat detection and response tools canhelp analysts detect new threats moreaccurately and contextualize and triage
security alerts more effectively. These
technologies can also automate portionsof the threat investigation process orrecommend actions to speed response.
Additionally, AI-driven data security andidentity solutions can help drive a proactive
security posture by identifying highrisk transactions, protecting them withminimal user friction and stitching together
suspicious behaviors more effectively.

When applying AI within your security
operations, look for technologies thatoffer trusted and mature use cases withdemonstrated accuracy, effectiveness andtransparency to eliminate potential bias,
blind spots or drift. Organizations shouldplan an operational model for AI adoptionthat supports continuous learning as
threats and technology capabilities evolve.

Organizations can also benefit from anapproach that tightly integrates core
security technologies for smootherworkflows and the ability to shareinsights across common data pools. Chief
information security officers (CISOs) andsecurity operations (SecOps) leaders canalso use threat intelligence reports to help
with pattern recognition and threat visibility
for emerging threats.

Security teams can benefit from having
security AI and automation embedded
throughout their tool sets. For example,

Previous section

Next section

65

03

Recommendations to help reducethe cost of a data breach

4
Strengthen resiliency by knowing
your attack surface and practicing IR
Understand your exposure to the attacks
most relevant to your industry andorganization, and prioritize your security
strategy accordingly. Tools such as ASM or
techniques such as adversary simulation
can help organizations gain an attackerinformed perspective into their unique risk
profile and vulnerabilities, including which
vulnerabilities are readily exploitable.
Additionally, having a team in place that’s
already versed in the right protocols andtools to respond to an incident has beenshown to significantly reduce costs andthe time to identify and contain the breach.

Not only was IR planning and testing
a top 3 cost mitigator in the 2023
report, but the data also showed thatorganizations with high levels of thesecountermeasures in place incurred USD
1.49 million lower data breach costs
compared to organizations with low levels
or none, and they resolved incidents 54
days faster. Form a dedicated IR team,
draft IR playbooks and regularly test IR
plans in tabletop exercises or simulated
environments such as a cyber range.
Having an IR vendor on retainer can also
help speed the time to respond to a breach.

Previous section

Next section

Lastly, organizations should look to
implement network segmentation
practices to limit the spread of attacks
and the extent of damage they can cause,strengthening overall resiliency andreducing recovery efforts.
Recommendations for security practices
are for educational purposes and don’t
guarantee results.

66

04
Organization demographics

18 yearsThis year’s study examined 553 organizations ofvarious sizes across 16 countries and geographic
regions and 17 industries. This section explores
the breakdown of organizations in the study
by geography and industry and defines theindustry classifications.

Previous section

The United States has been a part of
the Cost of a Data Breach Report for
18 years, the longest of all countries
or regions involved.

Next section

04

Organization demographics

Global study at a glance

Geographic demographics
The 2023 study was conducted across
16 different countries and regions.

Countries

2023
samplePercentage

Currency

2023 USD
conversion rate7

Yearsstudied

ASEAN

23

4%

SGD

1.3294

7

Australia

24

4%

AUD

1.4916

14

Brazil

43

8%

BRL

5.0702

11

Canada

26

5%

CAD

1.3525

9

France

34

6%

EUR

0.9198

14

Germany

45

8%

EUR

0.9198

15

India

51

9%

INR

82.19

12

Italy

24

4%

EUR

0.9198

12

Japan

42

8%

JPY

132.7512

Latin America4

23

4%

MXN

18.025

4Middle East5

36

7%

SAR

3.7037

10

Scandinavia6

22

4%

NOK

10.4445

5South Africa

21

4%

ZAR

17.73

8

South Korea

23

4%

ZRW

1303.8

6

United Kingdom

49

9%

GBP

0.8085

16

United States

67

12%

USD

1.00

18

Total

553

100%

Figure 49. Table of all countries studied

Previous section

Next section

68

04

Organization demographics

Distribution of the sample by industry

1% 1%Industry demographics
The selection of 17 industries has been
included in the study for multiple years.

Five industries together
accounted for 55% oforganizations sampled
in this year’s study.

Financial

14%

Consumer

12%
11%
10%
8%

Financial

Professional services
Technology

2%

Industrial

2%

2%
14%

4%

Energy4%

Public sector
5%Retail12%

Transportation
Communications

Services5%

Hospitality
Pharmaceuticals
Entertainment

Technology

6%

Education
11%

Media

Industrial

Research
Healthcare

Energy

7%

7%

10%
8%

Figure 50. Percentage of industries

Previous section

Next section

69

04

Organization demographics

Industry definitions
Healthcare
Hospitals and clinics
Financial
Banking, insurance and investmentcompanies
EnergyOil and gas companies, utilities andalternative energy producers and suppliers
Pharmaceuticals
Pharmaceuticals including biomedical
life sciences
Industrial
Chemical processing and engineeringand manufacturing companies
Technology
Software and hardware companies

Previous section

Next section

Education
Public and private universities and colleges
and training and development companies

Consumer
Manufacturers and distributorsof consumer products

Services
Professional services such as legal,
accounting and consulting firms

Media
Television, satellite, social media
and internet

Entertainment
Movie production, sports, gaming
and casinos

Hospitality
Hotels, restaurant chains and cruise lines

Transportation
Airlines, railroads and trucking anddelivery companies
Communications
Newspapers, book publishers and public
relations and advertising agencies

RetailBrick and mortar and e-commerce
ResearchMarket research, think tanks and researchand development (R&D)
PublicFederal, state and local government
agencies and nongovernmentalorganizations (NGOs)

70

05
Research methodology
To preserve confidentiality, the benchmark
instrument didn’t capture any company-specificinformation. Data collection methods excluded
actual accounting information and instead reliedon participants estimating direct costs by marking
a range variable on a number line. Participants
were instructed to mark the number line in one
spot between the lower and upper limits of a range
for each cost category.

Previous section

The numerical value obtained from thenumber line, rather than a point estimate
for each presented cost category,preserved confidentiality and ensured
a higher response rate. The benchmark
instrument also required respondents toprovide a second separate estimate forindirect and opportunity costs.

We limited the scope of data breach cost
factors to known categories that apply to abroad set of business operations involving
personal information. We chose to focus
on business processes instead of dataprotection or privacy compliance activities
because we believed the process study
would yield better-quality results.

In the interest of maintaining a manageable
data set for benchmarking, we included
only those cost activity centers with acrucial impact on data breach costs.
Based on discussions with experts, wechose a fixed set of cost activities. After
collecting benchmark information, we
carefully reexamined each instrument forconsistency and completeness.

Next section

71

05

Research methodology

How we calculate the costof a data breachTo calculate the average cost of a data
breach, this research excluded very small
and very large breaches. Data breaches
examined in the 2023 report ranged in size
between 2,160 and 101,200 compromised
records. We used a separate analysis to
examine the costs of mega breaches; thatmethodology is explained further in the“Data breach FAQs” section of this report.

Detection and escalation
Activities that enable a company to detect
the breach, including:This research used activity-based
costing, which identifies activities andassigns a cost according to actual use.
Four process-related activities drive a
range of expenditures associated withan organization’s data breach: detectionand escalation, notification, post-breach
response and lost business.

Notification
Activities that enable the company to notify
data subjects, data protection regulatorsand other third parties, including:– Forensic and investigative activities– Assessment and audit services– Crisis management– Communications to executives
and boards

Post-breach response
Activities to help victims of a breachcommunicate with the company andconduct redress activities to victims
and regulators, including:– Help desk and inbound communications– Credit monitoring and identity
protection services– Issuing of new accounts or credit cards– Legal expenditures– Product discounts– Regulatory fines

Lost business
Activities that attempt to minimize theloss of customers, business disruption
and revenue losses, including:– Business disruption and revenue
losses due to system downtime– Cost of losing customers
and acquiring new customers– Reputational damage anddiminished goodwill– Emails, letters, outbound calls or general
notices to data subjects– Determination of regulatory
requirements– Communication with regulators– Engagement of outside experts

Previous section

Next section

72

05

Research methodology

Data breach FAQs
What’s a data breach?
A breach is defined as an event inwhich records containing personallyidentifiable information (PII); financial or
medical account details; or other secret,confidential or proprietary data arepotentially put at risk. These records canbe in electronic or paper format. Breaches
included in the study ranged from 2,200 to
102,000 compromised records.
What’s a compromised record?
A record is information that reveals
confidential or proprietary corporate,
governmental or financial data, or
identifies an individual whose information
has been lost or stolen in a data breach.
Examples include a database with anindividual’s name, credit card informationand other PII, or a health record withthe policyholder’s name and payment
information.
How do you collect the data?
Our researchers collected in-depth
qualitative data through over 3,475
separate interviews with individuals at 553
organizations that suffered a data breach
between March 2022 and March 2023.
Interviewees included IT, compliance andinformation security practitioners familiar
with their organization’s data breach andthe costs associated with resolving thebreach. For privacy purposes, we didn’t
collect organization-specific information.

Previous section

Next section

How do you calculate the average cost ofa data breach?
We collected both the direct and indirect
expenses incurred by the organization.
Direct expenses included engaging
forensic experts, outsourcing hotline
support and providing free creditmonitoring subscriptions and discounts
for future products and services. Indirect
costs included in-house investigations
and communications along with theextrapolated value of customer loss
resulting from turnover or diminishedcustomer acquisition rates.

This research represented only events
directly relevant to the data breachexperience. Regulations such as theGeneral Data Protection Regulation (GDPR)
and the California Consumer Privacy Act(CCPA) may encourage organizations toincrease investments in their cybersecurity
governance technologies. However, suchactivities didn’t directly affect the costof a data breach for this research.
For consistency with prior years, we used
the same currency translation method
rather than adjusting accounting costs.

73

05

Research methodology

How does benchmark research differ fromsurvey research?
The unit of analysis in the Cost of a Data
Breach Report was the organization. In
survey research, the unit of analysis is theindividual. We recruited 553 organizations
to participate in this study.

each event featured 101,200 or fewer
compromised records. To measure theimpact of mega breaches that involve one
million or more records, the study instead
uses a simulation framework based on asample of 20 events of that size.

Can the average per-record cost be used
to calculate the cost of breaches involving
millions of lost or stolen records?
It’s not consistent with this research to use
the overall cost per record as a basis forcalculating the cost of single or multiple
breaches totaling millions of records. The
per-record cost is derived from our studyof hundreds of data breach events in which

Why did you use simulation methods toestimate the cost of a mega data breach?
The sample size of 20 companies thatexperienced a mega breach was not large
enough to support a statistically significant
analysis using the study’s activity-based
cost methods. To remedy this issue, we
deployed Monte Carlo simulations toestimate a range of possible, meaning
random, outcomes through repeated trials.

Previous section

Next section

In total, we performed more than 250,000
trials. The grand mean of all sample means
provided a most likely outcome at each sizeof data breach, ranging from 1 million to 60
million compromised records.
Are you tracking the same organizations
each year?
Each annual study involves a different
sample of companies. To be consistent
with previous reports, we recruit andmatch companies each year with similar
characteristics, such as the company’s
industry, head count, geographic footprint
and size of data breach. Since starting thisresearch in 2005, we have studied the data
breach experiences of 5,580 organizations.

74

05

Research methodology

Research limitations
Our study used a confidential andproprietary benchmark method that has
been successfully deployed in earlier
research. However, the inherent limitations
with this benchmark research need tobe carefully considered before drawing
conclusions from findings.
Nonstatistical results
Our study drew upon a representative,
nonstatistical sample of global entities.
Statistical inferences, margins of error andconfidence intervals can’t be applied tothis data, given that our sampling methods
weren’t scientific.
Nonresponse
Nonresponse bias wasn’t tested, so
it’s possible that companies that didn’t
participate are substantially different interms of underlying data breach cost.

Sampling-frame bias
Because our sampling frame wasjudgmental, the quality of results was
influenced by the degree to which theframe was representative of the populationof companies being studied. We believethat the current sampling frame was biased
toward companies with more mature
privacy or information security programs.
Company-specific information
The benchmark didn’t capture companyidentifying information. Individuals could
use categorical response variables todisclose demographic information about
the company and industry category.

Previous section

Next section

Unmeasured factors
We omitted variables from our analyses
such as leading trends and organizational
characteristics. The extent to which omitted
variables might explain benchmark results
can’t be determined.
Extrapolated cost results
Although certain checks and balances canbe incorporated into the benchmark
process, it’s always possible that
respondents didn’t provide accurate ortruthful responses. In addition, the useof cost extrapolation methods rather
than actual cost data may inadvertently
introduce bias and inaccuracies.

Currency conversions
The conversion from local currencies tothe US dollar deflated average total costestimates in other countries. For purposesof consistency with prior years, we decided
to continue to use the same accounting
method rather than adjust the cost. It’s
important to note that this issue may
affect only the global analysis because allcountry-level results are shown in local
currencies. The current real exchange rates
used in this research report were publishedby the Federal Reserve on 31 March 2023.

75

06
About Ponemon Instituteand IBM Security
Ponemon InstituteFounded in 2002, Ponemon Institute is
dedicated to independent research andeducation that advances responsible
information and privacy management
practices within business and government.
Our mission is to conduct high-quality
empirical studies on critical issues
affecting the management and securityof sensitive information about people
and organizations.
Ponemon Institute upholds strict data
confidentiality, privacy and ethicalresearch standards and doesn’tcollect any PII from individuals orcompany-identifiable information inbusiness research. Furthermore, strict
quality standards ensure that subjects
aren’t asked extraneous, irrelevant or
improper questions.

IBM Security
IBM Security helps secure the world’s
largest enterprises and governments withan integrated portfolio of security products
and services infused with dynamic security
AI and automation capabilities. The
portfolio, supported by world-renowned
IBM Security X-Force® research, enables
organizations to predict threats, protect
data as it moves, and respond with speed
and precision without holding backbusiness innovation. IBM is trusted bythousands of organizations as their partner
to assess, strategize, implement andmanage security transformations.

If you have questions or comments about
this research report, including requests for
permission to cite or reproduce the report,
please contact by letter, phone call or email:Ponemon Institute LLC
Attn: Research Department
2308 US 31 North
Traverse City
Michigan 49686 USA
1.800.887.3118
research@ponemon.org

Learn more about advancing
your security posture
Visit ibm.com/security.
Join the conversation in the
IBM Security Community.

IBM operates one of the world’s broadest
security research, development and deliveryorganizations; monitors more than 150
billion security events each day in more than
130 countries; and has been granted morethan 10,000 security patents worldwide.

Previous section

Next section

76

06

About Ponemon Institute and IBM Security

Take the next steps
AI cybersecurity solutions
Speed up security response times
and boost productivity.
Learn more
Threat detection and response solutions
Empower security teams to outsmart threats
with speed, accuracy and efficiency.
Learn more
Cloud security solutions
Integrate security into your journey tohybrid multicloud.
Learn more
Ransomware solutions
Manage cybersecurity risks
and vulnerabilities to minimize
ransomware’s impact.
Learn more

Identity and accessmanagement solutions
Connect every user, API and device
to every app securely.
Learn more

Attack surface management
Manage the expansion of your digital
footprint and improve your organization’s
cyber resilience quickly.
Learn more

Incident response and threat
detection services
Proactively manage and respondto security threats.
Learn more

Unified endpoint management solutions
Scale your mobile workforce by securingand managing any device.
Learn more

Data security and protection solutions
Protect data and simplify complianceacross hybrid clouds.
Learn more

Previous section

Schedule a one-on-one consultation
Meet with an IBM Security X-Forceexpert to discuss your needs.
Learn more
Request an IBM security and framing
discovery workshop
Get assistance in modernizing yoursecurity program.
Learn more

Governance, risk and compliance services
Increase cybersecurity maturity withan integrated governance, risk andcompliance approach.
Learn more77

1. It’s not consistent with this research to use theper-record cost to calculate the cost of single
or multiple breaches above 102,000 records.
For more information, see the “Researchmethodology” section.

© Copyright IBM Corporation 2023

2. ASEAN is a cluster sample of companies locatedin Singapore, Indonesia, the Philippines, Malaysia,
Thailand and Vietnam.

Produced in the
United States of America
July 2023

3. Destructive attacks are defined as attacks
that render systems inoperable and challenge
reconstitution. They may or may not also
involve a ransom.

IBM, the IBM logo, IBM Security, and X-Force aretrademarks or registered trademarks of International
Business Machines Corporation, in the UnitedStates and/or other countries. Other product andservice names might be trademarks of IBM or othercompanies. A current list of IBM trademarks
is available on ibm.com/trademark.

4. Latin America is a cluster sample of companies
located in Mexico, Argentina, Chile and Colombia.
5. Middle East is a cluster sample of companies
located in Saudi Arabia and the United
Arab Emirates.					6. Scandinavia is a cluster sample of companies
located in Denmark, Sweden, Norway and Finland.
7. Foreign Exchange Rates - H.10, 31 March 2023.

IBM Corporation
New Orchard Road
Armonk, NY 10504

This document is current as of the initial dateof publication and may be changed by IBM at any
time. Not all offerings are available in every country
in which IBM operates.

All client examples cited or described are presented
as illustrations of the manner in which some clients
have used IBM products and the results they may
have achieved. Actual environmental costs andperformance characteristics will vary depending
on individual client configurations and conditions.
Generally expected results cannot be provided as eachclient's results will depend entirely on the client’s
systems and services ordered. THE INFORMATION
IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT
ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDINGWITHOUT ANY WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND ANY
WARRANTY OR CONDITION OF NON-INFRINGEMENT.
IBM products are warranted according to the terms
and conditions of the agreements under which they
are provided.
Statement of Good Security Practices: IT systemsecurity involves protecting systems and information
through prevention, detection and response toimproper access from within and outside yourenterprise. Improper access can result in information
being altered, destroyed, misappropriated or misusedor can result in damage to or misuse of your systems,
including for use in attacks on others. No IT systemor product should be considered completely secureand no single product, service or security measurecan be completely effective in preventing improperuse or access. IBM systems, products and services
are designed to be part of a lawful, comprehensive
security approach, which will necessarily involve
additional operational procedures, and may require
other systems, products or services to be mosteffective. IBM DOES NOT WARRANT THAT ANYSYSTEMS, PRODUCTS OR SERVICES ARE IMMUNEFROM, OR WILL MAKE YOUR ENTERPRISE IMMUNEFROM, THE MALICIOUS OR ILLEGAL CONDUCTOF ANY PARTY.
The client is responsible for ensuring compliance withlaws and regulations applicable to it. IBM does notprovide legal advice or represent or warrant that its
services or products will ensure that the client is incompliance with any law or regulation. Statements
regarding IBM’s future direction and intent are subject
to change or withdrawal without notice, and represent
goals and objectives only.