Cost of a Data Breach
Report 2022

Contents

2

03

Executive summary

47

Security recommendations

04

What’s new in the 2022 report05

Key findings

49

Organization demographics

08

Complete findings

50

Geographic demographics

51

Industry demographics

09

Global highlights

52

Industry definitions

14

Data breach lifecycle

17

Initial attack vectors

19

Key cost factors

53

Research methodology

22

Security AI and automation

54

How we calculate the cost of a data breach25

XDR technologies

55

Data breach FAQ

27

Incident response

56

Research limitations

29

Risk quantification

30

Zero trust

32

Ransomware and destructive attacks

57

About Ponemon Institute and IBM Security

34

Supply chain attacks

58

Take the next steps

36

Critical infrastructure

39

Cloud breaches and cloud model

44

Remote work

45

Skills gap

46

Mega breaches

Executive summary

The Cost of a Data Breach Report offers IT, risk management
and security leaders a lens into factors that can increase or help
mitigate the rising cost of data breaches.
Now in its 17th year, this research — conducted independently
by Ponemon Institute, and sponsored, analyzed and publishedby IBM Security® — studied 550 organizations impacted by data
breaches that occurred between March 2021 and March 2022.
The breaches occurred across 17 countries and regions and in
17 different industries.
We conducted more than 3,600 interviews with individuals fromorganizations that were impacted by the data breaches. During
the interviews, we asked questions to determine the cost toorganizations across different activities related directly to boththe immediate and prolonged response to the data breaches.
As in previous years’ reports, this year’s data provides a viewof how dozens of factors impact the costs that keep adding up
after a data breach occurs. Additionally, the report examines
root causes, short-term and long-term consequences of data
breaches, and the mitigating factors and technologies thatallowed companies to limit losses.

3

Significantly, for the first time, the researchshows the following insights:

83%
of organizations studied have had morethan one data breach.

60%of organizations’ breaches led to increases
in prices passed on to customers.

79%
of critical infrastructure organizations didn’t
deploy a zero trust architecture.

19%of breaches occurred because of acompromise at a business partner.

45%of the breaches were cloud-based.

4What’s new in the 2022 report
With each year’s edition, we aim to build upon past researchto keep up with changing technology and events. We also try
to form a more relevant picture of the risks and strategies
for securing data and responding to a breach, from artificial
intelligence (AI) to zero trust. Covering some of the technologies
most companies focused on in the past year, the 2022 edition ofthis report has new analysis related to the value of the following:– Extended detection and response (XDR)– The use of risk quantification techniques– Impacts of individual technologies that contribute to azero trust security framework, such as identity and accessmanagement (IAM) and multifactor authentication (MFA)
Furthermore, the report takes a broader look at some leading
contributors to higher data breach costs. For the first time, thereport looks at the effects of supply chain compromises andthe security skills gap.
The report examines areas of security vulnerability from thecloud to critical infrastructure. And we take a deeper dive thanpast years into the impacts of ransomware and destructive
attacks. Also studied is the phenomenon of remote work that
continues to be a reality for many organizations past the peakof the COVID pandemic.
As companies experience more breaches and costs continue
to climb, this report can serve as a tool to help your teams
better manage risk and limit potential losses.
The report is divided into the following five major sections:– The executive summary with key findings and what’s
new in the 2022 edition– In-depth analysis on the complete findings, including
breach costs by geographic region and industry– Security recommendations from IBM Security experts
based on this report’s results– Demographics of organizations and industry definitions– The study’s methodology, including how costs
were calculated
IBM Security and Ponemon Institute are pleased to present
the results of the 2022 Cost of a Data Breach Report.

Key findings
The key findings described here are based on IBM Security
analysis of research data compiled by Ponemon Institute.1

USD 4.35 million
Average total cost of a data breach

83%
Percentage of organizations that have
had more than one breach

USD 4.82 million
Average cost of a critical infrastructure
data breach

USD 3.05 million
Average cost savings associated with fully
deployed security AI and automation

1. Cost amounts in this report are measured in US dollars (USD).

5

Reaching an all-time high, the cost of a data breach averaged
USD 4.35 million in 2022. This figure represents a 2.6%
increase from last year, when the average cost of a breach was
USD 4.24 million. The average cost has climbed 12.7% from
USD 3.86 million in the 2020 report.

Eighty-three percent of organizations studied have experienced
more than one data breach, and just 17% said this was theirfirst data breach. Sixty percent of organizations studied statedthat they increased the price of their services or products
because of the data breach.

The average cost of a data breach for critical infrastructureorganizations studied was USD 4.82 million — USD 1 million
more than the average cost for organizations in other industries.
Critical infrastructure organizations included those in thefinancial services, industrial, technology, energy, transportation,communication, healthcare, education and public sector
industries. Twenty-eight percent experienced a destructive or
ransomware attack, while 17% experienced a breach becauseof a business partner being compromised.

Breaches at organizations with fully deployed security AI
and automation cost USD 3.05 million less than breaches atorganizations with no security AI and automation deployed. This
65.2% difference in average breach cost — between USD 3.15
million for fully deployed versus USD 6.20 million for not
deployed — represented the largest cost savings in the study.
Companies with fully deployed security AI and automation also
experienced on average a 74-day shorter time to identify andcontain the breach, known as the breach lifecycle, than those
without security AI and automation — 249 days versus 323 days.
The use of security AI and automation jumped by nearly one-fifth
in two years, from 59% in 2020 to 70% in 2022.

USD 4.54 million
Average cost of a ransomware attack, notincluding the cost of the ransom itself

19%Frequency of breaches caused by stolenor compromised credentials

59%
Percentage of organizations that don’t
deploy zero trust

USD 1 million
Average difference in cost where remote
work was a factor in causing the breachversus when it wasn’t a factor

45%
Share of breaches that occurred in the cloud6

Eleven percent of breaches in the study were ransomware attacks,
an increase from 2021, when 7.8% of breaches were ransomware,
for a growth rate of 41%. The average cost of a ransomware
attack went down slightly, from USD 4.62 million in 2021 to
USD 4.54 million in 2022. This cost was slightly higher than theoverall average total cost of a data breach, USD 4.35 million.

Use of stolen or compromised credentials remains the mostcommon cause of a data breach. Stolen or compromised
credentials were the primary attack vector in 19% of breaches in
the 2022 study and also the top attack vector in the 2021 study,
having caused 20% of breaches. Breaches caused by stolen orcompromised credentials had an average cost of USD 4.50 million.
These breaches had the longest lifecycle — 243 days to identify
the breach, and another 84 days to contain the breach. Phishing
was the second most common cause of a breach at 16% andalso the costliest, averaging USD 4.91 million in breach costs.

Just 41% of organizations in the study said they deploy azero trust security architecture. The other 59% percent oforganizations that don’t deploy zero trust incur an average of
USD 1 million in greater breach costs compared to those that
do deploy. Among critical infrastructure organizations, an evenhigher percentage of 79% doesn’t deploy zero trust. These
organizations experienced on average USD 5.40 million in breachcosts, more than USD 1 million higher than the global average.

When remote working was a factor in causing the breach, costs
were an average of nearly USD 1 million greater than in breaches
where remote working wasn’t a factor — USD 4.99 million versus
USD 4.02 million. Remote work-related breaches cost on average
about USD 600,000 more compared to the global average.

Forty-five percent of breaches in the study occurred in the cloud.
Yet breaches that happened in a hybrid cloud environment costan average of USD 3.80 million, compared to USD 4.24 million
for breaches in private clouds and USD 5.02 million for breaches
in public clouds. The cost difference was 27.6% between hybrid
cloud breaches and public cloud breaches. Organizations witha hybrid cloud model also had shorter breach lifecycles thanorganizations that solely adopted a public or private cloud model.

USD 2.66 million
Average cost savings associated with anincident response (IR) team and regularly
tested IR plan

29 days
Savings in response time for thosewith extended detection and response(XDR) technologies

12 yearsConsecutive years the healthcare industry
had the highest average cost of a breach

USD 9.44 million
Average cost of a breach in the United States,
the highest of any country

7

Nearly three-quarters of organizations in the study said they had
an IR plan, while 63% of those organizations said they regularly
tested the plan. Having an IR team and an IR plan that was
regularly tested led to significant cost savings. Businesses withan IR team that tested its IR plan saw an average of USD 2.66
million lower breach costs than organizations without an IR teamand that don’t test an IR plan. The difference of USD 3.26 million
versus USD 5.92 million represents a 58% cost savings.

XDR technologies were implemented by 44% of organizations.
Those organizations with XDR technologies saw considerable
advantages in response times. Those organizations with XDR
deployed shortened the breach lifecycle by about a month,
on average, compared to organizations that didn’t implement
XDR. Specifically, organizations took 275 days to identify andcontain a breach with XDR deployed versus 304 days without
XDR deployed. This figure represents a 10% difference in
response times.

Healthcare breach costs hit a new record high. The average
breach in healthcare increased by nearly USD 1 million to reach
USD 10.10 million. Healthcare breach costs have been the mostexpensive industry for 12 years running, increasing by 41.6%
since the 2020 report. Financial organizations had the second
highest costs — averaging USD 5.97 million — followed bypharmaceuticals at USD 5.01 million, technology at USD 4.97
million and energy at USD 4.72 million.

The top five countries and regions for the highest average costof a data breach were the United States at USD 9.44 million, theMiddle East at USD 7.46 million, Canada at USD 5.64 million, theUnited Kingdom at USD 5.05 million and Germany at USD 4.85
million. The United States has led the list for 12 years in a row.
Meanwhile, the country with the fastest growth rate over lastyear was Brazil, a 27.8% increase from USD 1.08 million to
USD 1.38 million.

Complete findings

In this section, we provide the detailed
findings of this report, in 16 themes. Topics
are presented in the following order:– Global highlights– Data breach lifecycle– Initial attack vectors– Key cost factors– Security AI and automation– XDR technologies– Incident response– Risk quantification– Zero trust– Ransomware and destructive attacks– Supply chain attacks– Critical infrastructure– Cloud breaches and cloud model– Remote work
– Skills gap– Mega breaches

8

USD 4.35 million

Global highlights
The Cost of a Data Breach Report is a global report, comprisingdata from 17 countries and regions and 17 industries. In thissection, we look at several key metrics at the level of global
average, as well as comparative costs between countries andbetween industries.

Global average total cost of a data breachFigure 1: The average cost of a data breach reacheda record high in 2022.
The global average total cost of a data breach increased by
USD 0.11 million to USD 4.35 million in 2022, the highest it’s
been in the history of this report. The increase from USD 4.24
million in the 2021 report to USD 4.35 million in the 2022 report
represents a 2.6% increase. In the last two years, the average
total cost has increased 12.7% from USD 3.86 million in the2020 report.
Average total cost of a data breach
$4.50
$4.24

$4.30
$4.10

$4.00

$3.86

$3.90

$4.35

$3.92
$3.86

$3.70
$3.62

$3.50
$3.30
$3.10
$2.90
$2.70
$2.50

2016

2017

2018

2019

2020

2021

2022

Figure 1: Measured in USD millions

Average per record cost of a data breach
$170
$165
$160

$161

$158

$155
$148

$150

$164

$150

$145

$146

$140

$141

$135
$130
$125
$120

2016

2017

Figure 2: Measured in USD

9

2018

2019

2020

2021

2022

Figure 2: The per record cost of a data breach hit
a seven-year high.
The global per record cost of a data breach in 2022 was
USD 164, a 1.9% increase from USD 161 in 2021. The increase
from USD 146 in 2020 is an increase of 12.3%. This study
examines breaches sized between 2,200 and 102,000 records.
It’s not consistent with this research to use the per record
cost to calculate the cost of single or multiple breaches above
102,000 records. For more information, see the “Researchmethodology” section.

Average cost of a data breach by country or region

#15
#3

#4

Canada2022 $5.64
2021 $5.40

United Kingdom
2022 $5.05
2021 $4.67

South Korea
2022 $3.57
2021 $3.68#17Turkey2022 $1.11
2021 $1.91#5France2022 $4.34
2021 $4.57

#6
#14
India
2022 $2.32
2021 $2.21

Germany2022 $4.85
2021 $4.89

#7

#1

#9

Scandinavia
2022 $2.08
2021 $2.67

Japan2022 $4.57
2021 $4.69#8United States
2022 $9.44
2021 $9.05

Italy2022 $3.74
2021 $3.61#13Latin America
2022 $2.80
2021 $2.56#16Brazil2022 $1.38
2021 $1.08#2
Middle East
2022 $7.46
2021 $6.93

#11

#12
#10
South Africa
2022 $3.36
2021 $3.21

ASEAN
2022 $2.87
2021 $2.71

Australia
2022 $2.92
2021 $2.82

Figure 3: Measured in USD millions

Figure 3: The United States was the costliest country for
average total cost of a data breach for the 12th year in a row.
The top five countries or regions with the highest average
cost of a data breach were:
1.
2.
3.
4.
5.

The United States — USD 9.44 million
The Middle East — USD 7.46 million
Canada — USD 5.64 million
The United Kingdom — USD 5.05 million
Germany — USD 4.85 million

The United States had the highest average total cost of a data
breach at USD 9.44 million, a 4.3% increase of USD 0.39 million,
up from USD 9.05 million in 2021. Similar to last year, the Middle
East region again had the second highest average total costof a data breach, increasing from USD 6.93 million in 2021 to
USD 7.46 million in 2022. This average cost was an increase of
USD 0.53 million, or 7.6%. Canada was again the third highest
cost country at USD 5.64 million, an increase of USD 0.24 million
or 4.4%. The United Kingdom climbed to number four fromeighth out of the 17 countries or regions, surpassing Germany,
Japan and France in the ranking. The average total cost of abreach in the United Kingdom was USD 5.05 million, up from
USD 4.67 million, an increase of USD 0.38 million, or 8.1%.
Out of the 17 countries or regions studied, six — Germany,
Japan, France, South Korea, Scandinavia and Turkey — saw adecrease in the average total cost of a data breach. Brazil, 16th
on the list at USD 1.38 million, saw the largest relative cost
increase, up USD 0.3 million or 27.8%. Turkey, 17th on the list,
saw the largest relative cost decrease, falling from USD 1.91
million to USD 1.11 million, a decrease of USD 0.8 million or
42%. Broad swings in currency valuations, such as occurred in
Turkey, can play a role in cost variations from year to year.

10Average cost of a data breach by industry
Healthcare
Financial
Pharmaceuticals
Technology
EnergyServices
Industrial
Research
Consumer
Education
Entertainment
Communications
Transportation
RetailMedia
Hospitality
$2.07
$1.93

Public sector
$0.00
2022

$2.00

$5.01
$5.04
$4.97
$4.88
$4.72
$4.65
$4.70
$4.65
$4.47
$4.24
$3.88
$3.60
$3.86
$3.70
$3.86
$3.79
$3.83
$3.80
$3.62
$3.62
$3.59
$3.75
$3.28
$3.27
$3.15
$3.17
$2.94
$3.03

$4.00

$9.23

$5.97
$5.72

$6.00

$8.00

$10.10$10.002021

Figure 4: Measured in USD millions

Figure 4: Healthcare was highest cost industry for the
12th year in a row.
The average total cost of a breach in healthcare increased from
USD 9.23 million in the 2021 report to USD 10.10 million in
2022, an increase of USD 0.87 million or 9.4%. Healthcare is oneof the more highly regulated industries and is considered criticalinfrastructure by the US government.

Healthcare is one of the more
highly regulated industries and isconsidered critical infrastructureby the US government.

11

The top five industries by cost were unchanged in the order ofranking from the 2021 report. Following healthcare were thefinancial, pharmaceuticals, technology and energy industries.
The financial industry saw an increase from USD 5.72 million
in 2021 to USD 5.97 million in 2022, an increase of USD 0.25
million or 4.4%. The industrial industry, comprised of chemical,
engineering and manufacturing organizations, saw an increase
from USD 4.24 million to USD 4.47 million in 2022, an increaseof USD 0.23 million or 5.4%. The average total cost decreasedslightly in four industries — pharmaceuticals, transportation,
media and hospitality.

Figure 5: Detection and escalation costs surpassed lost
business costs as the largest of four cost categories comprising
the cost of a data breach, for the first time in six years.
Broken down into four cost categories — lost business, detectionand escalation, notification and post breach response — thelargest share of data breach costs in 2022 was detection andescalation. Detection and escalation costs increased from
USD 1.24 million in 2021 to USD 1.44 million in 2022, anincrease of USD 0.2 million or 16.1%. Detection and escalation
costs include activities that enable a company to reasonably
detect a breach. These costs include forensic and investigative
activities; assessment and audit services; crisis management;
and communications to executives and boards.
For the first time in at least six years, lost business, at USD 1.42
million in 2022, wasn’t the largest share of data breach costs. Lost
business costs decreased from USD 1.59 million in 2021, a decreaseof 10.7%. Lost business costs include activities that attempt tominimize the loss of customers, business disruption and revenue
losses. These costs include business disruption and revenue losses
from system downtime; cost of lost customers and acquiring newcustomers; and reputation losses and diminished goodwill.
Notification costs and post breach response costs remained
relatively unchanged from 2021 to 2022. See “How we calculate
the cost of a data breach” in the “Research methodology”
section for definitions of each of the four cost categories.

Average cost of a data breach divided into four segments
$4.50
$0.27
$4.00

$0.16
$0.19

$3.50

$0.21

$1.02

$1.07

$1.23

$1.22

$1.45

$1.42

$0.24

$1.14

$0.31

$1.18

$0.99

$0.93
$3.00

$2.50

$0.99

$1.24

$1.44

$1.11

$2.00

$1.50

$1.51

$1.52

$1.59

$1.42

$1.00

$0.50

$0.00
2017
Notification

2018
Post breach response

Figure 5: Measured in USD millions

12

2019
Detection and escalation

2020
Lost business cost

2021

2022

Was this your first data breach?

Yes

17%

No

83%

Figure 6

Figure 6: Most organizations in the study have experienced
more than one data breach.
Of the 550 organizations in the study, just 17% said this wastheir first data breach. Eighty-three percent said this wasn’t theirfirst data breach. With security teams handling more incidents
every year and considering the impact of remote work on
security, it’s likely the recurrence of breaches is climbing.

Did the data breach result in yourorganization increasing the price of
products and services?

Figure 7: A majority of organizations in the study said they
increased the price of their products and services as a resultof the data breach.
In response to the question, 60% said they increased prices,and 40% said they didn’t increase prices.

Yes
60%

No
40%
Figure 713277 days
Average time to identify and containa data breach

Data breach lifecycle
The time elapsed between the first detection of the breachand its containment is referred to as the data breach lifecycle.
The time to identify a breach describes the time it takes todetect that an incident has occurred. The time to contain abreach refers to the time it takes for an organization to resolve asituation when it’s been detected and ultimately restore service.
These metrics can be used to determine the effectiveness of anorganization’s incident response and containment processes.
Figure 8: The mean or average time to identify and containa data breach fell from 287 days in 2021 to 277 daysin 2022, a decrease of 10 days or 3.5%.
In 2022 it took an average of 207 days to identify the breach and
70 days to contain the breach. In 2021 it took an average of 212
days to identify the breach and 75 days to contain the breach.
The 277-day average in 2022 means that if a breach occurred on
January 1, it would take until October 4 of that year to identify
and contain the breach. The 277-day average is consistent
with the average over the past seven years, with a maximum
difference of 11% between the lowest total, 257 days in 2017,
and the highest total, 287 days in 2021.

Average time to identify and contain a data breach
207

2022

212

2021

277

75

287

2020

207

73

280

2019

206

73

279

197

2018

191

2017

0

69

266

66

257

201

2016
50

100

Mean time to identify

Figure 8: Measured in days

14

70

70
150

200

Mean time to contain

250

271
300

Figure 9: A shorter data breach lifecycle continues to be
associated with lower data breach costs.
A data breach lifecycle of less than 200 days was associatedwith an average cost of USD 3.74 million in 2022, compared to
USD 4.86 million for breaches with a lifecycle of greater than
200 days. This difference represents an average cost savingsof USD 1.12 million, or 26.5%, for breaches with the shorter
than 200-day lifecycle.
The cost gap between a lifecycle longer than 200 days and alifecycle shorter than 200 days was smaller in 2022 than in
2021, when it was USD 1.26 million. The cost gap in 2022 —USD 1.12 million — is the same size as the cost gap in 2020. The
cost gap has grown slightly over the past seven years, while theaverage cost of a data breach has also grown incrementally. The
2021 cost gap of USD 1.26 million was the largest of the pastseven years.

Average cost of a data breach based on data breach lifecycle
$6.00

$4.87

$5.00

$4.56
$4.15

$4.00

$3.61
$3.21

$3.00
$2.54

$4.33

$3.75

$3.61

$3.34

$4.86

$3.74

$3.21

$2.79

$2.00

$1.00

$0.00
2016

2017

Lifecycle < 200 days

2018

2019

2020

2021

Lifecycle > 200 days

Figure 9: Measured in USD millions. Sum of days to identify and days to contain equals the breach lifecycle.

15

2022

Figures 10a and 10b: Data breaches in high data protection
regulatory environments, such as the healthcare, financial,energy, pharmaceuticals and education industries, tended tosee costs accrue in later years following the breach.
The difference between low and high regulatory environments
showed up in a pronounced way two years or more after the data
breach — the “longtail” costs. In highly regulated industries, anaverage of 24% of data breach costs were accrued more than
two years after the breach occurred. This result compares toan average of 8% of costs accrued more than two years after abreach in low regulatory environments.
Time elapsed

In low regulatory environments, data breach costs tended to
accrue in the first three to six months — where an average of
24% of data breach costs accrued. In the overall average for2022, 52% of costs were incurred in the first 12 months, 29% in
the second year after the breach and 19% more than two years
after the breach. For highly regulated industries, 45% of costs
accrued in the first year, 31% in the second year and 24% morethan two years after the breach.

Percentage of total cost2022 average

Low

High

1st year

52%

66%

45%

2nd year

29%

26%

31%

2+ years

19%

8%

24%

Figure 10a

In the analysis of industries in the high regulation categories, weconcluded that regulatory and legal costs may have contributed
to higher costs in the years following a breach.
Note: This analysis was comprised of a subset of 218 companies
with historical data from previous breaches.

Average distribution over time of data breach costs in low vs. high data regulation environments
25%

24%

24%

21%
20%

19%

19%
17%

15%
15%

16%
13%
9%
9%

10%

9%
9%
6%
6%

5%

6%

7%
7%

12%
12%

9%
8%

4%

8%

4%
4%

3%

0%
0–3
months2022 average

3–6
monthsLow regulation

6–9
monthsHigh regulation

Figure 10b: Percentage of total costs accrued in three-month intervals

16

9–12
months12–15
months15–18
months18–21
months21–24
months>2
years

USD 4.91 million

Initial attack vectors
This section looks at the prevalence and cost of initial attack
vectors of data breaches. The breaches in the study are divided
into 10 initial attack vectors, ranging from accidental data loss
and cloud misconfiguration to phishing, insider threats andstolen or compromised credentials. This section also compares
the average time it takes to identify and contain breaches basedon their initial attack vector.

Average cost of data breach with a phishinginitial attack vector

Figure 11: The most common initial attack vector in 2022
was stolen or compromised credentials, responsible for 19% ofbreaches in the study, at an average cost of USD 4.50 million.
In 2022, the most common initial attack vectors werecompromised credentials at 19% of breaches, phishing at
16% of breaches, cloud misconfiguration at 15% of breaches
and vulnerability in third-party software at 13% of breaches.
The 2021 report saw the same order of the top four initialattack vectors.
The costliest initial attack vector in 2022 on average wasphishing at USD 4.91 million. Following phishing was businessemail compromise at USD 4.89 million and 6% of breaches,
vulnerability in third-party software at USD 4.55 million andcompromised credentials at USD 4.50 million.

Average cost and frequency of data breaches by initial attack vector
Phishing$4.91

Business email compromise
$4.89
$4.90

Vulnerability inthird-party software
$4.55

$4.70

Stolen or compromised
credentials
$4.50

$4.50

Malicious insider
$4.18

$4.30
Social engineering
$4.10
$4.10

Physical security compromise
$3.96

$3.90

Cloud
misconfiguration$4.14

Accidental
data loss orlost device System
$3.94
error

$3.70

$3.82

$3.50
0%

5%

Figure 11: Measured in USD millions

17

10%

15%

20%

25%

Figure 12: Attack vectors with longer mean times to identify
and contain, such as phishing or business email compromise,
were also among the most expensive types of breaches.
Stolen or compromised credentials were the initial attack vector
with the longest mean time to identify and contain the breach, at
327 days. That time is 16.6% greater than the overall mean time
to identify and contain a data breach. Compromised credentials
were also the most common — 19% — initial attack vector
leading to data breaches in the study.
Breaches caused by business email compromise had the second
highest mean time to identify and contain, at 308 days. Businessemail compromise was also the second costliest initial attack
vector, with breaches costing an average of USD 4.89 million.
Breaches caused by phishing had the third highest mean time toidentify and contain, at 295 days, and had the highest average
cost by initial attack vector, at USD 4.91 million. Vulnerability inthird-party software had the fourth highest mean time to identify
and contain a breach, with an average that was above the overall
average — 284 days versus 277 days.

Average time to identify and contain a data breachby initial attack vector
Stolen or compromised
credentials

243

Business email
compromise

234

Phishing

219

76

295

Vulnerability inthird-party software

214

70

284

Malicious insider

216

68

284

Physical security
compromise

217

63

280

Social engineering

201

69

270

Accidental data loss
or lost device

189

69

258

Cloud misconfiguration

183

61

244

Other technicalmisconfiguration

149
0

50

84
74

18

308

67
100

150

Mean time to identify
Figure 12: Measured in days

327

216
200

250

300

350

Mean time to contain

USD 5.57 million
Average cost of a breach for organizations
with high levels of compliance failures

Key cost factors
This section looks at a multitude of factors that influence
the cost of a data breach, including various types of security
technologies and practices. A special analysis of 28 cost factors
examines their impact on the mean cost of a data breach. We
look at how these 28 factors were associated with either lowerthan-average breach costs stemming from a cost mitigating
influence, or a higher-than-average cost of a breach resulting
from a cost amplifying influence.
The following cost factors are new to the report this year: IAM;
XDR technologies; MFA; and crisis management teams.
These cost factors aren’t additive, so it’s not consistent with thisresearch to add multiple cost factors together to calculate thecost of a breach.

19

Figure 13 shows the impact of 28 factors on the average
cost of a data breach.
The chart shows the average cost difference of breaches atorganizations with these cost-influencing factors compared tothe mean cost of a data breach of USD 4.35 million. The chart isdivided into those factors that are associated with a lowerthan-average breach cost, which are cost mitigators, and thosefactors that are associated with a higher-than-average breachcost, or cost amplifiers.
AI platforms, a DevSecOps approach and use of an incident
response (IR) team were the three factors associated with thehighest cost decrease compared to the mean cost of a breach.
For example, breaches at organizations with AI platforms had
an average cost that was USD 300,075 less than the mean costof a data breach of USD 4.35 million — which is approximately
USD 4.05 million.

On the other hand, security system complexity, occurrenceof cloud migration when the organization is in the process of
migrating to the cloud and compliance failures were the threefactors associated with the highest net increase in the averagecost. For example, breaches at organizations with security
system complexity had an average cost of USD 290,655 morethan the mean cost of a data breach of USD 4.35 million —which is approximately USD 4.64 million.
For the first time, this year’s report measured the impact of
the following four new cost factors: IAM; XDR technologies;
MFA; and crisis management teams. Each of these factors was
associated with lower-than-average breach costs, led by IAM.

Impact of key factors on the average total cost of a data breach
Artificial intelligence platform
DevSecOps approach
Formation of IR team
Extensive use of encryption
Employee training
Extensive tests of the IR plan
Business continuity
Insurance protection
Participation in threat sharing
Identity and access management
Security analytics
Board-level oversight
Red team testing
XDR technologies
Multifactor authentication
Pen and vulnerability testing
CISO appointed
Extensive use of DLP
Crisis management teamManaged security services
Remote workforce
IoT or OT environment impacted
Security skills shortage
Lost or stolen devices
Third-party involvement
Compliance failures
Cloud migration
Security system complexity-$500,000

Figure 13: Measured in USD

20-$300,075-$276,124-$252,897-$252,088-$247,758-$246,889-$243,299-$240,488-$237,355-$224,396-$217,317-$216,707-$204,375-$190,622-$186,765-$156,659-$144,915-$136,992-$136,244-$69,100$152,465$201,354$206,843$227,420$247,624$258,293$284,292$290,655-$300,000-$100,000$100,000$300,000Average cost of a data breach for organizations with ahigh level vs. low level of three cost amplifying factors
$6.00

$5.63

$5.57

$5.49

$5.00
$4.00

$3.36

$3.31

$3.02

$3.00
$2.00
$1.00
$0.00

Cloud
migration
High level

Compliance
failures

Security systemcomplexity

Low level

Figure 14: Measured in USD millions

Average cost of a data breach for organizations withhigh level vs. low level of three cost mitigating factors
$7.00
$5.78

$6.00
$5.00
$4.00

$5.52

$4.96
$3.79

$3.66

$3.00

$3.13

$2.00
$1.00
$0.00

DevSecOps
High level

Formation of the
IR teamLow level

Figure 15: Measured in USD millions

21

AI platform

Figure 14 looks at the three cost factors — out of 28 measured— with the greatest level of impact in potentially amplifying
the average cost of a data breach.
This chart compares organizations with a high level of the cost
factor to those with a low level of the cost factor. There was adifference of USD 2.47 million, or 58%, between high levels
and low levels of security system complexity. A difference of
USD 2.27 million, or 50.5%, occurred between high levels
and low levels of cloud migration. There was a difference of
USD 2.26 million, or 50.9%, between high levels and low levelsof compliance failures. These data points showed that having
high levels of these cost factors present was also associatedwith a significantly higher than average cost of a data breach.
Organizations with a high level of cloud migration had a USD 5.63
million average cost that was USD 1.28 million higher than the
average cost of a data breach, a difference of 25.7%.
Figure 15 looks at the three cost factors — out of 28 measured— with the greatest level of impact in potentially mitigating thecost of a data breach.
The chart compares organizations with a high level of thecost factor to those with a low level of the cost factor. Thoseorganizations with high levels of use of security platforms that
use AI had an average cost of a breach that was USD 2.39
million, or 55.3%, lower than those with low levels of use of an
AI platform. Organizations with high levels of use of an IR team
had an average cost of a breach that was USD 2.12 million, or
44.9%, lower than those with a low level of use of an IR team.
Those organizations with a high level of use of a DevSecOps
approach had an average cost of a breach that was USD 1.17
million, or 26.7%, lower than those with a low level of use of
DevSecOps. Organizations with high levels of these cost factors
present had a significantly lower than average cost of a data
breach. Those organizations with high level use of an AI platform
had an average cost of USD 3.13 million that was USD 1.22
million lower than the overall average cost of a data breach, a
32.6% difference.

USD 3.05 million
Average savings from fully deployed
security AI and automation versus nosecurity AI and automation

Security AI and automation
This was the fifth year we examined the relationship between
data breach cost and security AI and automation. In thiscontext, security AI and automation refers to enabling security
technologies that augment or replace human intervention in
the identification and containment of incidents and intrusion
attempts. Such technologies depend upon AI, machine learning,
analytics and automated security orchestration.
On the opposite end of the spectrum are processes driven
by manual inputs, often across dozens of tools and complex,
nonintegrated systems, without data shared between them.
Figure 16: The share of organizations with fully or
partially deployed security AI and automation increasedby five percentage points, from 65% to 70%, between
2021 and 2022.
Fully deployed security AI and automation increased by six
percentage points, from 25% to 31%, between 2021 and 2022
and by 10 percentage points, from 21% to 31%, between 2020
and 2022. The share of organizations with no security AI and
automation deployed decreased from 35% in 2021 to 30% in
2022 and has decreased from 41% in 2020, a difference of 11
percentage points.

State of security AI and automation comparing threelevels of deployment
45%
40%

41%

40%

38%

39%

35%

35%

31%

30%

30%

25%

25%

21%

20%
15%
10%
5%
0%

2020
Not deployed

2021
Partially deployed

2022
Fully deployed

Figure 16: Percentage of organizations per deployment level

22Figure 17: Fully deployed security AI and automation was
associated with average breach costs that were USD 3.05
million lower than with no security AI and automation
deployed, a difference of 65.2%, the largest cost savingsin the study.
Organizations with fully deployed security AI and automation
had an average total cost of a data breach of USD 3.15 million.
This average total cost compared to USD 6.20 million fororganizations without security AI and automation deployed. The
difference between average cost of a breach with fully deployed
security automation and no security AI and automation deployed
was smaller in 2022 than in 2021, when the gap was USD 3.81
million, or in 2020, when the savings was USD 3.58 million.

Average cost of a data breach by security AI and automation deployment level
$8.00

$7.00

$6.00

$6.71
$6.20

$6.05

$5.00

$4.11

$4.00

$3.85

$3.70
$3.15
$2.90

$3.00
$2.45
$2.00

$1.00

$0.00

2020
Not deployed

Figure 17: Measured in USD millions

23

Partially deployed

2021
Fully deployed2022

Average time to identify and contain a data breach by level of security AI and automation
Total days
Not deployed

88

235

323

Partially deployed

76

223

299

Fully deployed181
Mean time to identify

68

249

Mean time to contain

Figure 18: Measured in days

Figure 18: Organizations with fully deployed security AI
and automation were able to detect and contain a breachmuch more quickly than organizations with no security
AI and automation deployed.
Organizations with fully deployed security AI and automation
took an average of 181 days to identify and 68 days to containthe data breach, for a total lifecycle of 249 days. Thoseorganizations with no security AI and automation deployed took
an average 235 days to identify and 88 days to contain a breach,for a total lifecycle of 323 days, which was 74 days longer thanorganizations with fully deployed security AI and automation.
The average time to identify and contain a breach was a total of
299 days with partially deployed security AI and automation.

24

29 days

XDR technologies

Organizations with XDR technologies identified
and contained a breach 29 days faster thanthose without XDR

For the first time, the study examined the effects of XDRtechnologies on the cost of a data breach. This section looks
at the prevalence of XDR in the organizations studied,plus its impact on average total cost and the average time
to contain data breaches.
Significantly, XDR impacted average breach costs with a savingsof 9.2%. While these savings may appear humble at first sight,
the true impact comes in the amount of time organizations savedin breach duration when they use XDR — nearly one month. Extratime to identify and contain a breach can add a lot to the overall
cost of a breach and its consequences.

Is your organization implementing XDR technologies?

Yes
44%

No
56%

Figure 19

25

Figure 19: XDR capabilities were commonly used
but not yet by a majority of organizations.
According to the survey of 550 organizations in the study,
44% are implementing XDR technologies, while 56% aren’t
implementing XDR technologies.

Figure 20: The use of XDR technologies was associated witha lower-than-average cost of a data breach.
Those organizations that are implementing XDR technologies
experienced an average cost of a data breach of USD 4.15
million. Organizations that weren’t implementing XDRtechnologies experienced an average cost of a data breachof USD 4.55 million. This cost was above the global average
and USD 0.40 million more than breaches at organizations
implementing XDR technologies, a difference of 9.2%.
Figure 21: The average time to identify and contain a data
breach was significantly lower with XDR technologies.
Breaches at organizations with XDR technologies deployed
took an average of 275 days to identify and contain the breach,
which was 29 days less than breaches at organizations without
XDR technologies deployed, at 304 days. That represents a
10% difference in mean time to identify and contain a breach
between organizations with XDR technologies and those with
no XDR technologies.

Impact of XDR technologies on average costof a data breach
$5.00

$4.55

$4.35

$4.15
$4.00

$3.00

$2.00

$1.00

$0.00

XDR technologies
deployed

Globalaverage

XDR technologies
not deployed

Figure 20: Measured in USD millions

Average time to identify and contain a breach basedon use of XDR technologies

Without
XDR

223

Globalaverage

207

70

277

With XDR

203

72

275

0

50

100

Mean time to identify
Figure 21: Measured in days

26

81

150

200

250

Mean time to contain

304

300

350

USD 2.66 million
Average breach cost savings at organizations
with an IR team that tested an IR planversus those with no IR team and had nottested an IR plan

Incident response
In previous years, this research has shown that the use of
IR teams and testing of an IR plan significantly reduced theaverage cost of a data breach. In this year’s analysis, weagain looked at how IR teams, capabilities and processes
impacted the cost of a breach.
Figure 22: A majority of organizations in the study had
IR plans and testing of IR plans on a regular basis.
Nearly three-quarters of organizations in the study said they
had an IR plan, with 73% saying they did have an IR plan and
27% saying they didn’t have a plan. At organizations with an
IR plan, 63% said they regularly tested the IR plan, with 37%
saying they didn’t regularly test the IR plan.

Does your organization have an incident response (IR)plan and is it tested?
80%

73%

70%

63%

60%
50%
37%

40%
27%

30%
20%
10%
0%

Does your organization
have an IR plan?
Yes

Figure 22

27

No

Is the IR plan tested
on a regular basis?

Average cost of a data breach with incident response (IR) team and IR plan testing
$7.00

$5.92

$6.00

$5.71

$5.09
$5.00
$4.47
$3.88

$4.00
$3.63

$4.01
$3.74

$3.62
$3.32

$3.25

$3.26

$3.00

$2.00

$1.00

$0.00
Formation of an IR team
2020

2021

2022

Extensive testingof the IR plan

Both IR team andIR plan testing

Neither IR teamnor IR plan testing

Figure 23: Measured in USD millions

Figure 23: IR teams and extensive IR plan testing continued
to mitigate data breach costs in 2022.
The gap between the average data breach cost at organizations
with both IR teams and IR plan testing and those with neither IR
teams or IR plan testing continued to grow between the 2020
report and the 2022 report. Breaches at organizations with IR
capabilities saw an average cost of a breach of USD 3.26 million
in 2022, compared to USD 5.92 million at organizations without
IR capabilities. This average cost was a difference of USD 2.66
million, or 58%. Those savings were an increase over 2021,
when the average cost of a breach at organizations with IR
capabilities saved USD 2.46 million, and in 2020, when the costdifference was USD 1.77 million. This finding indicates a growing
cost-saving effectiveness of IR capabilities.

28

USD 2.10 million
Cost savings of breaches at organizations
that use risk quantification techniques
versus those that don’t

Risk quantification
Risk quantification looks at impacts, including financial impacts,
availability of data and data integrity. Using risk quantification
can highlight financial loss types by impact, including thefollowing examples: loss of productivity; cost of response or
recovery; reputation impact; and fines and judgments.
Chief information security officers (CISOs), risk managers andsecurity teams can use benchmark research like the Cost of a
Data Breach Report to infer general trends and cost averages intheir industry or geography. However, using data specific to theorganization, rather than industry averages, can clarify potential
security gaps and how to reduce overall risk by quantifying
security risk into financial terms.
This section looks at how many organizations are using risk
quantification techniques to prioritize risks, threats and impacts
and reviews the average cost impact of risk quantification
techniques.

Does your organization prioritize risks, threats andimpacts based on risk quantification techniques?

Yes
47%

No
53%

Figure 24: Less than half, 47%, said they prioritize risks,
threats and impacts based on risk quantification techniques.
Meanwhile, out of the 550 organizations studied, 53% don’t
prioritize risks, threats and impacts based on risk quantification
techniques.
Figure 25: Risk quantification had a considerable effect ondata breach costs, saving up to USD 2.10 million on average.
Organizations that prioritized risks, threats and impacts basedon risk quantification techniques had an average breach cost of
USD 3.30 million. That cost was USD 2.10 million less than thosethat didn’t use risk quantification, at USD 5.40 million, a savingsof 48.3%. Risk quantification was associated with breach costs
that were more than USD 1 million lower than the global averageof USD 4.35 million.
Impact of risk quantification techniques on average
cost of a data breach
$6.00

$5.40

$5.00
$4.00
Figure 24

$4.35
$3.30

$3.00
$2.00
$1.00
$0.00
Prioritizing based on risk
quantification techniques
Figure 25: Measured in USD millions

29

Globalaverage

Not prioritizing basedon risk quantification

USD 1.51 million
Average breach cost savings associatedwith a mature zero trust deployment versus
early adoption of zero trust

Has your organization deployed a zero trust
security architecture?

Yes
41%

No
59%

Figure 26

30

Zero trust
For a second year, this study examined the prevalence andfinancial impact of data breaches based on deployment of a zerotrust security framework. The zero trust approach operates on
the assumption that user identities or the network itself may
already be compromised, and instead relies on AI and analytics
to continuously validate connections between users, data andresources. As the data in this section shows, zero trust has a net
positive impact on data breach costs.
Figure 26: In the 2022 study, 41% of organizations
said they have deployed a zero trust security architecture,
while 59% said they haven’t.
This finding compares to the 2021 report when 35% said they
had partially or fully deployed a zero trust architecture.

Figure 27: Organizations with zero trust deployed saved
nearly USD 1 million in average breach costs compared toorganizations without zero trust deployed.
The average cost of a data breach was USD 4.15 million atorganizations with zero trust deployed, while the cost of a breach
was an average USD 5.10 million at organizations without zerotrust deployed. The difference was USD 0.95 million, representing
a 20.5% savings for organizations with zero trust deployed.

Impact of zero trust on average cost of a data breach
$6.00
$5.10

$5.00
$4.15
$4.00
$3.00
$2.00
$1.00
$0.00

Zero trust
deployed

Zero trust not
deployed

Figure 27: Measured in USD millions

Average cost of a data breach by the stageof zero trust deployment
$6.00
$4.96

$5.00
$4.00

$3.96
$3.45

$3.00
$2.00
$1.00
$0.00
Mature (applied consistently across all domains)
Midstage (applied in many areas of the company)
Early adoption (we’re beginning to implement a few practices)
Figure 28: Measured in USD millions

31

Figure 28: Having a mature zero trust deployment was
associated with breach costs that were more than
USD 1.5 million lower than breaches at organizations withearly adoption of zero trust.
Organizations with mature stage deployment of their zero trust
security architecture, when zero trust is applied consistently
across all domains, had an average data breach cost of USD 3.45
million. In midstage, when zero trust was applied in many
areas of the organization, the average cost of a data breachwas USD 3.96 million. For early adoption stage organizations
that were beginning to implement a few practices, the average
cost of a data breach was USD 4.96 million. This cost was
USD 1.51 million more than breaches at mature organizations,a difference of 35.9%.

49 daysRansomware and destructive attacks

Ransomware breaches took 49 days longer
than average to identify and contain.

Types of breaches experienced by organizations

8%

11%

17%

24%

19%
21%

Ransomware attack
Human error

Destructive attack

IT failure

Supply chain attack

Other malicious attack

Figure 29

Average cost of a data breach for ransomware
and destructive attacks
$6.00
$5.00

$5.12
$4.54

$4.35

$4.00
$3.00
$2.00
$1.00
$0.00

GlobalaverageRansomware
attackFigure 30: Measured in USD millions

32

Destructive
attackThis was the second year that we examined the cost of
ransomware and breaches. We also added destructive malware
breaches to this year’s study. Compared to last year, ransomware
breach costs have declined slightly, from USD 4.62 million
to USD 4.54 million. However, the frequency of ransomware
breaches has increased — from 7.8% of breaches in the 2021
report to 11% in the 2022 study.
This year we looked at the lifecycle of these breaches, as well as
what impact paying a ransom had on the non-ransom cost of thebreach. Note: This study doesn’t include the cost of the ransom
itself in calculating the cost of a ransomware attack.
Figure 29: Ransomware was responsible for 11% of breaches,
while destructive attacks were responsible for 17% ofbreaches.
Another 19% of breaches were caused by supply chain attacks,
which were breaches caused due to a business partner being
initially compromised. Human errors, meaning breaches caused
unintentionally through negligent actions of employees orcontractors, were responsible for 21% of breaches.
IT failures, which were caused by a disruption or failure inan organization’s computer systems that led to data loss,
were responsible for 24% of breaches. Such failures included
errors in source code, or a process failure such as automatedcommunication errors. The remaining 8% of breaches wereother malicious attacks.
Figure 30: The average cost of a ransomware attack —not including the cost of the ransom itself — was USD 4.54
million, slightly higher than the overall average total costof a data breach of USD 4.35 million.
The average cost of a destructive or wiper attack was USD 5.12
million, which was USD 0.77 million more than the overall
average, a difference of 16.3%.

Figure 31: The average time to identify and containa ransomware or destructive attack was significantly
higher than average.
A ransomware attack took 237 days to identify and 89 days tocontain, for a total lifecycle of 326 days. A destructive attack
took 233 days to identify and 91 days to contain, for a total
lifecycle of 324 days. Compared to the overall average lifecycleof 277 days, organizations took 49 days longer to identify
and contain a ransomware attack, a difference of 16.3%.
Additionally, organizations took 47 days longer to identify andcontain a destructive attack, a difference of 15.6%.

Average time to identify and contain ransomware
and destructive attacks
Ransomware
attack

237

89

326

Destructive
attack

233

91

324

Globalaverage

207

0

50

100

Mean time to identify

70

150

200

250

Mean time to contain

Figure 31: Measured in days

Average cost of a ransomware attack basedon whether a ransom was paid
$6.00
$5.00

$5.12
$4.49

$4.00
$3.00
$1.00
$1.00
$0.00
Didn’t pay
ransomPaid ransom

Figure 32: Measured in USD millions. Cost of ransom isn’t includedin this calculation.

33

277

300

350

Figure 32: The average cost of a ransomware breach was
higher for those that didn’t pay the ransom.
The cost of the ransom wasn’t included in the calculation of
the cost of a ransomware breach. A ransomware breach’s cost
was based on activities, such as detection of the attack and lossof business due to system downtime. For those organizations
that didn’t pay the ransom, the average cost of the breach was
USD 5.12 million. For organizations that did pay the ransom,
the cost of the breach was USD 4.49 million. The difference inaverage cost was USD 0.63 million, or 13.1%.

26 days

Supply chain attacks

A supply chain breach took on average
26 days longer to identify and contain than
the global average

Was your organization breached as a resultof a supply chain compromise?

Yes
19%

No
81%

Figure 33

Average cost of a data breach for a
supply chain compromise
$5.00
$4.35

$4.46

Globalaverage

Supply chain
compromise

$4.00

$3.00

$2.00

$1.00

$0.00

Figure 34: Measured in USD millions

34

With a number of major supply chain attacks taking placein recent years, this year’s report marked the first year that
we examined data breaches in the context of supply chain
attacks. A supply chain compromise is a breach resulting froma compromise of a business partner such as a supplier. As theresearch found, nearly one-fifth of breaches were caused bya supply chain compromise, and these compromises madebreaches more expensive and resulted in longer lifecycles.
Figure 33: About one-fifth of breaches in the study were theresult of a supply chain compromise.
Nineteen percent of organizations said yes, they were breached
as a result of a supply chain compromise, and 81% said no.
Figure 34: The average total cost of a supply chain
compromise was USD 4.46 million.
That cost was greater than the overall average cost of a data
breach of USD 4.35 million, a difference of USD 0.11 million
or 2.5%.

Average time to identify and contain a supply chain compromise
Supply chain compromise

Total days

235

303

68

Global average

207

277

70
Mean time to identify

Mean time to contain

Figure 35: Measured in days

Figure 35: A supply chain compromise had a longer
lifecycle than the global average.
Organizations took an average of 235 days to identify and 68 days
to contain a supply chain compromise, for a total lifecycle of 303
days. The average lifecycle was 26 days longer than the overall
average data breach lifecycle of 277 days, a difference of 9%.

35

79%

Critical infrastructureThis report marked the first year that we studied the costand containment of data breaches in the context of criticalinfrastructure industries. Based on classification by the US
Cybersecurity and Infrastructure Security Agency (CISA), criticalinfrastructure industries in this study included financial services,
industrial, technology, energy, transportation, communication,
healthcare, education and public sector.

Share of critical infrastructure industries that
didn’t adopt a zero trust security approach

One revelation of this analysis was that critical infrastructureindustries had a much lower prevalence of zero trust security
approaches than the global average. Critical infrastructureindustries without zero trust strategies deployed hadsignificantly higher data breach costs than average.
Figure 36: Ransomware and destructive attacks were
responsible for more than a quarter of breaches in criticalinfrastructure industries.
Ransomware attacks accounted for 12% of critical infrastructure
breaches, while destructive attacks were behind 16% of criticalinfrastructure breaches, for a combined 28%. Another 17% ofbreaches on these industries were supply chain attacks where athird-party business partner was the attack vector. Meanwhile,breaches caused by human error or IT failures accounted
for 22% and 25%, respectively. The remaining 8% of criticalinfrastructure breaches were other malicious attacks.

Types of critical infrastructure breaches

8%

12%

16%

25%

17%
22%

Ransomware attack
Human error

Figure 36

36

Destructive attack

IT failure

Supply chain attack

Other malicious attack

Figure 37: The average cost of a data breach in criticalinfrastructure organizations was USD 4.82 million.
Critical infrastructure organizations had an average cost of adata breach USD 0.99 million higher than USD 3.83 million fororganizations in noncritical infrastructure industries, a differenceof 22.9%. Noncritical infrastructure industries included thoseorganizations in pharmaceuticals, services, entertainment,
consumer goods, media, hospitality, retail and research.

Average cost of a data breach for critical infrastructureindustries vs. other industries
$6.00
$4.82

$5.00

$4.35
$3.83

$4.00
$3.00
$2.00
$1.00
$0.00
Criticalinfrastructureindustries

GlobalaverageOther
industries

Figure 37: Measured in USD millions

Average time to identify and contain a data breachin critical infrastructure industries

Other
industries

211

71

282

Globalaverage

207

70

277

Criticalinfrastructureindustries

204

69

273

0

50

100

Mean time to identify
Figure 38: Measured in days

37

150

200

250

Mean time to contain

300

Figure 38: Critical infrastructure industries identified andcontained data breaches more quickly than other industries.
The lifecycle of a data breach in critical infrastructure industries
took fewer days than the global average or noncriticalinfrastructure industries. The mean time to identify in criticalinfrastructure industries was 204 days, compared to 211
days for other industries. The mean time to contain for criticalinfrastructure industries was 69 days, compared to 71 days forother industries. The combined average of 273 days to identify
and contain a breach in critical infrastructure was four days
shorter than the overall global average of 277 days. Additionally,
the combined average for critical infrastructure industries wasnine days shorter than the 282 days average for other industries.

Figure 39: Only one-fifth of critical infrastructure organizations
had deployed a zero trust approach to security — half as manyas the overall global average.
Twenty-one percent of critical infrastructure organizations
had deployed a zero trust approach, while 79% had not. That
percentage compares to the overall global average of 41% oforganizations with a zero trust strategy.
Figure 40: Organizations in critical infrastructure industries
that implemented a zero trust approach to security had an
average cost of a data breach of USD 4.23 million.
At those critical infrastructure organizations that didn’t deploy azero trust approach, the average cost of a breach was USD 5.40
million. The result was a difference of USD 1.17 million, or
24.3%, more than those that did implement a zero trust strategy.

Critical infrastructure organizations withzero trust deployed

21%

79%

Zero trust deployed

Zero trust not deployed

Figure 39

Impact of zero trust on average cost of a criticalinfrastructure data breach
$6.00
$5.00

$5.40
$4.23

$4.35

Zero trust
deployed

Globalaverage

$4.00
$3.00
$2.00
$1.00
$0.00

Figure 40: Measured in USD millions

38

Zero trust not
deployed

43%

Cloud breaches and cloud model
For a second year in this report, we’ve taken a close look at the
impact of cloud model and maturity of cloud security on thecost of a data breach. The research found that 45% of breaches
occurred in the cloud, but those in the public cloud costconsiderably more than breaches at organizations with a hybrid
cloud model. However, analysis of the research also showsthat organizations still need a mature cloud security posture,
regardless of cloud model.

Share of organizations that were in early stages
or had not started applying security practices
to safeguard their cloud environments

Figure 41: A plurality of study participants had ahybrid cloud IT operating model, with 45% indicating
they had a hybrid cloud model.
Meanwhile, 28% said their IT model was fully on-premises,
and 27% said their IT model was completely cloud-based.
Figure 42: Nearly half of organizations experienced
a data breach in the cloud.
Forty-five percent said the data breach occurred in the cloud,
whereas 55% said the data breach didn’t occur in the cloud.

What best describes your IT operating model?

Did the data breach occur in the cloud?

Yes
45%

27%
27%

45%
45%

No
55%
28%

Hybrid cloud
Figure 41

39

Completely on-premises

Completely cloud
Figure 42

State of security maturity in the cloud environment

Not started
17%

Early stage(we have begun applying a few
cloud security practices)
26%

Midstage
Midstage(we apply
apply many
many cloud
cloud
(we
security practices)
practices)
security
34%
34%

Mature stage(we apply security practices
consistently across all domains)
23%

Figure 43

Figure 43: Nearly half, or 43%, of organizations had notstarted or were in early stages of applying practices to secure
their cloud environments.
Meanwhile, 34% were at the midstage and were applying
many cloud security practices, and 23% were in the mature
stage and were applying security practices consistently
across all domains. Another 26% of organizations said thatthey were in the early stage, meaning that they had begun
applying a few cloud security practices. Finally, 17% oforganizations said that they had not started their journey insecuring their cloud environments.

40

Figure 44: Organizations with mature cloud security had alower-than-average cost of a data breach.
At mature organizations, breach costs were on average
USD 0.66 million less than organizations in the early stages of
securing their cloud environments. Breaches at mature-stageorganizations cost an average of USD 3.87 million, compared to
USD 4.39 million at midstage organizations, USD 4.53 million at
early-stage organizations and USD 4.59 million at organizations
that had not started their cloud security journey. The costdifference between mature stage and early stage represented
a 15.7% savings for mature stage organizations. Note: Breachcosts in this analysis refer to any type of breach, not just cloudbased breaches.

Average cost of a data breach by cloud security
maturity level
$5.00
$4.00

$4.59

$4.53

$4.39
$3.87

$3.00
$2.00
$1.00
$0.00
Mature stage (we apply security practices consistently
across all domains)
Midstage (we apply many security practices)
Early stage (we have begun applying a few security practices)
Not started

Figure 44: Measured in USD millions

Average time to identify and contain a data breachby cloud security maturity levelNot started

244

Early stage (we havebegun applying a few
security practices)

220

Midstage (we apply
many security
practices)212

Mature stage(we apply security
practices consistently
across all domains)

176

0

50

41

81

65

61

345

301

277

237

100 150 200 250 300 350 400

Mean time to identify
Figure 45: Measured in days

101

Mean time to contain

Figure 45: Organizations in the mature stage of securing theircloud environments were able to identify and contain the data
breach much more quickly than organizations in the early stage.
Mature stage organizations took an average of 176 days toidentify and 61 days to contain a breach, or 237 days combined.
This lifecycle was 40 days less than the global average of 277
days and 64 days less than early-stage organizations — morethan two months, or a 23.8% difference. Those organizations
who had not started their cloud security journey took much
longer to identify and contain the breach. The average for thoseorganizations was 345 days, more than 100 days longer thanmature-stage organizations. For midstage organizations, theaverage time to identify and contain the data breach was 277
days, the same as the overall global average.

Average cost of a cloud-based data breach basedon breach responsibility
$6.00
$5.00

$4.98
$4.10

$4.00

$3.98

$3.00
$2.00
$1.00
$0.00

Cloud
providerYour own IT or
security teamSharedFigure 46: Measured in USD millions

Average cost of a cloud-based data breachbased on cloud model
$6.00
$5.00

$5.02
$4.24

$4.00

$3.80

$3.00
$2.00
$1.00
$0.00

Public cloud

Figure 47: Measured in USD millions

42

Private cloudHybrid cloud

Figure 46: Breaches that were deemed the responsibilityof the cloud provider had the highest average total cost of abreach based on cloud provider.
Breaches that were the responsibility of the cloud provider
had an average total cost of USD 4.98 million. Breaches deemed
the responsibility of the organization’s own IT or security teamcost an average of USD 4.10 million. Those breaches thatwere the shared responsibility of the cloud provider and theorganization’s IT or security team cost an average of USD 3.98
million. This shared responsibility average cost is USD 1 million
less than for those breaches where the cloud provider had
responsibility, a difference of 22.3%.
Figure 47: Breaches in the public cloud were costliest.
Breaches in a public cloud cost an average USD 5.02 million,
whereas breaches within a private cloud cost an average
USD 4.24 million. Within a hybrid cloud model, breaches cost an
average USD 3.80 million, about USD 1.2 million less costly thanbreaches within a public cloud, for a difference of 27.7%.

Average time to identify and contain a data breach by cloud model

Public231

Private79

198

Hybrid

72

190

0

50

Mean time to identify

310

270

72

100

150

200

262

250

300

350

Mean time to contain

Figure 48: Measured in days

Figure 48: Organizations with a hybrid cloud model were able
to identify and contain a breach significantly faster on averagethan those with public or private cloud models.
The average time to identify and contain a breach with a hybrid
cloud model was 262 days. This lifecycle was 15 days less than
the global average of 277 days and eight days less than private
cloud. Breaches at organizations with a public cloud model took
an average of 310 days to identify and contain the breach. This
lifecycle was 48 days longer than hybrid cloud, or a differenceof 16.8%. Note: Since hybrid cloud implementations vary, thisanalysis included on-premises breaches, not just purely cloudbased breaches.

43

USD 1 million

Remote work
This is the third time this report has been published since thestart of the COVID-19 pandemic. In the context of the pandemic,
starting with last year’s report, we’ve examined the impacts ofwork-from-home arrangements on data breach costs. Remote
working has had considerable effects on the cost of a breachwhen remote work was a factor in causing the breach, such as aremote-working employee having credentials stolen. The study
also found that breach costs were highest for organizations withmost of their employees working remotely.

Breach costs where remote working
was a factor in causing the breach wereabout USD 1 million more than breaches
where remote work wasn’t a factor

Average cost of a data breach based on share of
employees working remotely
$6.00

$5.54

$4.00

$5.10

$4.89

$5.00

$4.28 $4.39$3.93 $3.99 $4.02 $4.04
$3.15

$3.00
$2.00
$1.00
$0.00

1–20%
2021

12–40%

41–60%

61–80%

81–100%2022

Figure 49: Measured in USD millions

Average cost of a data breach where remote working
was a factor in causing the breach
$4.99

$5.00
$4.00

$4.02

$4.35

$3.00
$2.00
$1.00
$0.00
Remoteworking wasn’t
a factor
Figure 50: Measured in USD millions

44

Globalaverage

Remoteworking wasa factor

Figure 49: There was a strong correlation between
remote working and cost of a data breach, where more
employees working remotely was associated withhigher data breach costs.
For those organizations with the largest share of employees
working remotely — 81% to 100% — the average cost of a data
breach was USD 5.10 million. That cost was a slight decrease inthis category from last year. For organizations with the smallest
share of employees working remotely — less than 20% — theaverage cost was USD 3.99 million. The difference between
highest and lowest share of employees working remotely was
USD 1.11 million, a difference of 24.4%.
Figure 50: The average total cost of a data breach wasnearly USD 1 million greater when remote work was a factor
in causing the data breach.
Organizations that indicated remote work was a factor in thebreach experienced an average cost of a data breach of USD 4.99
million. In contrast, the average cost of a data breach was
USD 4.02 million when remote work wasn’t a factor in causing
the breach, a difference of USD 0.97 million or 21.5%. Whenremote work was a factor, the cost was also USD 0.64 million
more than the overall global average, a difference of 13.7%.

USD 550,000

Skills gap
Many organizations struggled to fill positions on their security
teams. Those organizations that said they were sufficiently
staffed saw considerable cost savings in terms of data breachcosts, compared to those without enough employees to staff
their teams. This was the first year of this report that we took adeeper look at the security skills gap.

Average data breach cost savings of a
sufficiently staffed organization versus
insufficiently staffed

Figure 51: There was a widespread security skills
shortage among organizations in the study.
Only a little more than one-third of organizations had
sufficiently staffed security teams. Just 38% of organizations
said their security teams were sufficiently staffed to meet theirsecurity management needs, while 62% said they weren’t
sufficiently staffed.

Is your security team sufficiently staffed?

Yes
38%

Figure 52: Organizations that said their security
teams had a skills shortage had a higher-than-average
cost of the data breach.
At organizations with a sufficiently staffed security team, theaverage cost of a data breach was lower than average. The
average cost of a data breach at sufficiently staffed organizations
was USD 4.01 million. In contrast, the average cost of a data
breach was USD 4.56 million at organizations with insufficiently
staffed security teams, a difference of USD 0.55 million, or 12.8%.

No62%

Figure 51

Impact of security staffing level on average
cost of a data breach
$5.00
$4.35
$4.00

$4.56

$4.01

$3.00

$2.00

$1.00

$0.00

Sufficiently
staffedFigure 52: Measured in USD millions

45

Globalaverage

Security skills
shortage

USD 387 million

Mega breaches
Mega breaches — those with more than 1 million compromised
records — aren’t normal experiences for most businesses.
But mega breaches have an outsized impact on consumers
and industries.

Average total cost for breaches of 50 million
to 60 million records

This study included 13 companies that experienced a data
breach involving the loss or theft of 1 million to 60 million
records. The study of the mega breaches involved a distinct
methodology from the other 550 breaches in this study, eachof which had no more than 102,000 lost records. For a full
explanation of the research methodology, see the “Data breachFAQ” at the end of this report.

Average cost of a mega breach by number of records lost
$450
$400
$364

$381 $379

$392

$401

$387

$350
$311

$318 $316

$300
$250
$220
$200

$176

$230

$241

$184 $180

$150
$100
$50

$50 $52 $49$0
1M–10M2020

10M–20M
2021

30M–40M

40M–50M

50M–60M

2022

Figure 53: Measured in USD millions

46

20M–30M

Figure 53: In 2022, the average cost of a mega breachdecreased slightly.
Mega breach costs saw a decrease from 2021 in six of sevenbreach size cohorts. The cost of the largest mega breaches of
50 million to 60 million records decreased from USD 401 million
in 2021 to USD 387 million, a drop of USD 14 million or 3.6%. The
cohort for 20 million to 30 million records was the only cohort
where the average increased from last year. In that cohort, theaverage total cost of a mega breach increased from USD 230
million to USD 241 million, an increase of USD 11 million or 4.8%.

Recommendations to
help minimize financial
impacts of a data breachIn this section, IBM Security outlines steps organizations can taketo help reduce the financial cost and reputational consequencesof a data breach. These recommendations include successful
security approaches taken by organizations in the study.
Adopt a zero trust security model to help prevent unauthorizedaccess to sensitive data.
Results from the study showed that while just 41% oforganizations had implemented a zero trust security approach,they had a potential breach cost saving of USD 1.5 million with amature deployment. As organizations incorporate remote workand hybrid multicloud environments, a zero trust strategy canhelp protect data and resources by limiting their accessibility andrequiring context.
Security tools that can share data between disparate systems
and centralize data security operations can help security
teams detect incidents across complex hybrid multicloudenvironments. You can gain deeper insights, mitigate risks andaccelerate response with an open security platform that canadvance your zero trust strategy. At the same time, you can use
your existing investments while leaving your data where it is,
helping your team become more efficient and collaborative.

47

Protect sensitive data in cloud environments using policy
and encryption.
With the increasing amount and value of data being hosted incloud environments, organizations should take steps to protect
cloud-hosted databases. Mature cloud security practices wereassociated with breach cost savings of USD 720,000 compared
to no cloud security practices. Use data classification schemaand retention programs to help bring visibility into and reducethe volume of sensitive information that’s vulnerable to a breach.
Protect sensitive information using data encryption and fully
homomorphic encryption. Using an internal framework for audits,evaluating risk across the enterprise and tracking compliancewith governance requirements can help improve your ability todetect a data breach and escalate containment efforts.
Invest in security orchestration, automation and response(SOAR) and XDR to help improve detection and response times.
Along with security AI and automation, XDR capabilities canhelp significantly reduce average data breach costs and breachlifecycles. According to the study, organizations with XDR
deployed shortened the breach lifecycle by 29 days on averagecompared to organizations that didn’t implement XDR, with acost savings of USD 400,000. SOAR and security information andevent management (SIEM) software, managed detection andresponse services and XDR can help your organization accelerate
incident response with automation, process standardization andintegration with your existing security tools.
Use tools that help protect and monitor endpoints andremote employees.
In the study, breaches where remote work was a factor incausing the breach cost nearly USD 1 million more thanbreaches where remote work wasn’t a factor. Unified endpoint
management (UEM), endpoint detection and response (EDR)
and identity and access management (IAM) products andservices can help provide security teams with deeper visibility
into suspicious activity. This oversight involves bring your own
devices (BYOD) and company laptops, desktops, tablets, mobile
devices and IoT, including endpoints the organization doesn’t
have physical access to. UEM, EDR and IAM speed investigation
and response time to isolate and contain the damage in breaches
where remote work was a factor.

48

Create and test incident response playbooks to increase
cyber resilience.
Two of the most effective ways to mitigate the cost of a data
breach are forming an incident response (IR) team and extensive
testing of the IR plan. Breaches at organizations with IR teams
that regularly test their plan saw USD 2.66 million in savings
compared to breaches at organizations with no IR team or
testing of the IR plan. Organizations can respond quickly tocontain the fallout from a breach by establishing a detailed
cyberincident playbook. Routinely test that plan through tabletop
exercises or run a breach scenario in a simulated environment
such as a cyber range.
Adversary simulation exercises, also known as red teamexercises, can enhance the effectiveness of IR teams by
uncovering attack paths and techniques they might miss andidentifying gaps in their detection and response capabilities.
An attack surface management solution can help organizations
improve their security posture by locating previously unknown
exposure points through simulations of an authentic attack
experience.
Recommendations for security practices are for educational
purposes and don’t guarantee results.

Organization
demographics

This year’s study comprised 550 organizationsof various sizes, geographies and industries.
This section shows the breakdown oforganizations in the study by geography andindustry and includes definitions used forclassifying the organizations by industry.

49

17 years

Geographic demographics
The 2022 study was conducted in 17 countries
or regional samples.

The United States has been a part of the study
for the longest time at 17 years

Global study at a glance
Countries

2022 sample

Percent

Years studied

Currency

United States

64

12%

17

USD

India

49

9%

11

INR

United Kingdom

43

8%

15

GBP

Brazil

43

8%

10

BRL

Germany

38

7%

14

EUR

Japan

35

6%

11

JPY

France

33

6%

13

EUR

Middle East1

31

6%

9

SAR

South Korea

30

5%

5

KRW

Australia

26

5%

13

AUD

Canada

25

5%

8

CAD

Italy

24

4%

11

EUR

23

4%

6

SGD

23

4%

3

MXN

ASEAN

2

Latin America

3South Africa

21

4%

7

ZAR

Scandinavia4

20

4%

4

NOK

Turkey

20

4%

5

TRY

Total

550

100%

1. Middle East is a sample of companies located in Saudi Arabia and the United Arab Emirates
2. ASEAN is a sample of companies located in Singapore, Indonesia, Philippines, Malaysia, Thailand and Vietnam
3. Latin America is a sample of companies located in Mexico, Argentina, Chile and Colombia
4. Scandinavia is a sample of companies located in Denmark, Sweden, Norway and Finland

Figure 54

50

Industry demographics

The largest samples of industries
were in these sectors.

16%
12%
12%
11%

This year’s study was conducted in 17 industries, the same
industries that have been included in the study for multiple years.

Financial

Services

Distribution of the sample by industry
Industrial
1%

2%

Technology

2%

1%

2%

2%

16%
4%

5%

5%

12%

5%

5%
12%
7%

8%

Financial

Services

PublicTransportation

RetailPharmaceuticals

Entertainment

Figure 55

51

Media

Industrial

11%

Technology

Consumer
Education
HealthEnergyCommunication
Hospitality

Research

Industry definitions
Healthcare
Hospitals, clinics
Financial
Banking, insurance,
investment companies
EnergyOil and gas companies,
utilities, alternative energy
producers and suppliers
Pharmaceuticals
Pharmaceutical, including
biomedical life sciences
Industrial
Chemical processing,engineering andmanufacturing companies
Technology
Software and hardware
companies
Education
Public and private
universities and colleges,
training and development
companies
Services
Professional services suchas legal, accounting andconsulting firms
Entertainment
Movie production, sports,
gaming and casinos
Transportation
Airlines, railroad, trucking
and delivery companies

52

Communication
Newspapers, bookpublishers, public relations
and advertising agencies
Consumer
Manufacturers anddistributors of consumer
products
Media
Television, satellite, social
media, internet
Hospitality
Hotels, restaurant chains,
cruise lines
RetailBrick and mortar ande-commerce
ResearchMarket research, think tanks,
research and development
PublicFederal, state and local
government agencies
and non-governmentalorganizations (NGOs)

Research methodology

To preserve confidentiality, the benchmark instrument didn’t
capture any company-specific information. Data collection
methods excluded actual accounting information and instead
relied upon participants estimating direct costs by marking a
range variable on a number line. Participants were instructed tomark the number line in one spot between the lower and upper
limits of a range for each cost category.
The numerical value obtained from the number line, rather thana point estimate for each presented cost category, preserved
confidentiality and ensured a higher response rate. The
benchmark instrument also required respondents to provide asecond estimate for indirect and opportunity costs, separately.
To ensure a manageable size for benchmarking, we carefully
limited items to only cost activity centers that we consideredcrucial to measuring data breach costs. Based on discussions
with experts, the final set of items included a fixed set ofcost activities. After collecting benchmark information, we
re-examined each instrument carefully for consistency andcompleteness.
We limited the scope of data breach cost items to known cost
categories that applied to a broad set of business operations that
handle personal information. Our belief was that a study focusedon business process — not data protection or privacy complianceactivities — would yield better quality results.

53

How we calculate the costof a data breachTo calculate the average cost of a data breach, this research
excluded very small and very large breaches. Data breaches
examined in the 2022 study ranged in size between 2,200 and
102,000 compromised records. We used a separate analysis
to examine the costs of very large mega breaches, which is
explained further in the “Data breach FAQ” section of the report.

This research used activity-based
costing, which identifies activities
and assigns a cost according toactual use.

This research used activity-based costing, which identifies
activities and assigns a cost according to actual use. Fourprocess-related activities drive a range of expendituresassociated with an organization’s data breach: detection andescalation, notification, post breach response and lost business.
Detection and escalation
Activities that enable a company to reasonably detect thebreach, including the following:– Forensic and investigative activities– Assessment and audit services– Crisis management– Communications to executives and boards
Notification
Activities that enable the company to notify data subjects, dataprotection regulators and other third parties, including thefollowing:– Emails, letters, outbound calls or general notice to data
subjects– Determination of regulatory requirements– Communication with regulators– Engagement of outside experts
Post breach response
Activities to help victims of a breach communicate with thecompany and redress activities to victims and regulators,
including the following:– Help desk and inbound communications– Credit monitoring and identity protection services– Issuing new accounts or credit cards– Legal expenditures– Product discounts– Regulatory fines
Lost business
Activities that attempt to minimize the loss of customers,
business disruption and revenue losses, including the following:– Business disruption and revenue losses from system
downtime– Cost of losing customers and acquiring new customers– Reputation losses and diminished goodwill

54

Data breach FAQ
What is a data breach?
A breach is defined as an event in which an individual’s nameand a medical record, a financial record or both, or debit card
are potentially put at risk. These records can be in electronic or
paper format. Breaches included in the study ranged from 2,200
to 102,000 compromised records.
What is a compromised record?
A record is information that identifies the natural person orindividual whose information has been lost or stolen in a data
breach. Examples include a database with an individual’s
name, credit card information and other personally identifiable
information (PII) or a health record with the policyholder’s nameand payment information.
How do you collect the data?
Our researchers collected in-depth qualitative data through over
3,600 separate interviews with individuals at 550 organizations
that suffered a data breach between March 2021 and March
2022. Interviewees included IT, compliance and information
security practitioners familiar with their organization’s data
breach and the costs associated with resolving the breach.
For privacy purposes, we didn’t collect organization-specificinformation.
How do you calculate the average cost of a data breach?
We collected both the direct and indirect expenses incurred by
the organization. Direct expenses included engaging forensic
experts, outsourcing hotline support and providing free credit
monitoring subscriptions and discounts for future products andservices. Indirect costs included in-house investigations andcommunication, and the extrapolated value of customer loss
resulting from turnover or diminished customer acquisition rates.
This research represented only events directly relevant to thedata breach experience. Regulations such as the General Data
Protection Regulation (GDPR) and the California Consumer
Privacy Act (CCPA) may encourage organizations to increase
investments in their cybersecurity governance technologies.
However, such activities didn’t directly affect the cost of a data
breach for this research.
For consistency with prior years, we used the same currencytranslation method rather than adjusting accounting costs.
How does benchmark research differ from survey research?
The unit of analysis in the Cost of a Data Breach Report was
the organization. In survey research, the unit of analysis is theindividual. We recruited 550 organizations to participate inthis study.

55

Can the average per record cost be used to calculate the costof breaches involving millions of lost or stolen records?
The average cost of data breaches in our research doesn’t apply
to catastrophic or mega data breaches, such as Equifax, Capital
One or Facebook. These events aren’t typical of the breaches
many organizations experience. To draw useful conclusions inunderstanding data breach cost behaviors, we targeted data
breach incidents that didn’t exceed 102,000 records.
It’s not consistent with this research to use the per record costto calculate the cost of single or multiple breaches totaling
millions of records. However, the study uses a simulation
framework for measuring the cost impact of a mega breachinvolving 1 million or more records, based on a sample of 13 verylarge breaches of this size.
Why did you use simulation methods to estimate the cost ofa mega data breach?
The sample size of 13 companies that experienced a mega
breach was too small to perform a statistically significant
analysis using activity-based cost methods. To remedy this issue,
we deployed Monte Carlo simulation to estimate a range ofpossible, meaning random, outcomes through repeated trials.
In total, we performed more than 150,000 trials. The grandmean of all sample means provided a most likely outcome ateach size of data breach, ranging from 1 million to 60 million
compromised records.
Are you tracking the same organizations each year?
Each annual study involves a different sample of companies.
To be consistent with previous reports, we recruit and matchcompanies each year with similar characteristics such as thecompany’s industry, headcount, geographic footprint and sizeof data breach. Since starting this research in 2005, we havestudied the data breach experiences of 5,027 organizations.

Research limitations
Our study used a confidential and proprietary benchmark
method that has been successfully deployed in earlier research.
However, the inherent limitations with this benchmark researchneed to be carefully considered before drawing conclusions fromfindings.

The benchmark didn’t capture any
company-identifying information.

Non-statistical results
Our study drew upon a representative, non-statistical sample
of global entities. Statistical inferences, margins of error andconfidence intervals can’t be applied to these data, given that
our sampling methods weren’t scientific.
Non-response
Non-response bias wasn’t tested, so it’s possible that companies
that didn’t participate are substantially different in terms ofunderlying data breach cost.
Sampling-frame bias
Because our sampling frame was judgmental, the quality of
results was influenced by the degree to which the frame wasrepresentative of the population of companies being studied.
We believe that the current sampling frame was biased toward
companies with more mature privacy or information security
programs.
Company-specific information
The benchmark didn’t capture company-identifying information.
Individuals could use categorical response variables to disclose
demographic information about the company and industry
category.
Unmeasured factors
We omitted variables from our analyses such as leading trends
and organizational characteristics. The extent to which omitted
variables might explain benchmark results can’t be determined.
Extrapolated cost results
While certain checks and balances can be incorporated into thebenchmark process, it’s always possible that respondents didn’t
provide accurate or truthful responses. In addition, the use ofcost extrapolation methods rather than actual cost data may
inadvertently introduce bias and inaccuracies.
Currency conversions
The conversion from local currencies to the US dollar deflated
average total cost estimates in other countries. For purposes ofconsistency with prior years, we decided to continue to use thesame accounting method rather than adjust the cost.

56

About Ponemon
Institute and
IBM Security

Ponemon InstitutePonemon Institute is dedicated to independent research andeducation that advances responsible information and privacy
management practices within business and government. Our
mission is to conduct high-quality empirical studies on criticalissues affecting the management and security of sensitive
information about people and organizations.
Ponemon Institute upholds strict data confidentiality, privacy
and ethical research standards, and doesn’t collect any
personally identifiable information from individuals or company
identifiable information in business research. Furthermore, strict
quality standards ensure that subjects aren’t asked extraneous,
irrelevant or improper questions.

IBM Security
IBM Security offers one of the most advanced and integrated
portfolios of enterprise security products and services. The
portfolio, supported by world-renowned IBM Security X-Force®
research, provides security solutions to help organizations drive
security into the fabric of their business so they can thrive in theface of uncertainty.

57

IBM operates one of the broadest and deepest security
research, development and delivery organizations. Monitoring
more than 4.7 trillion events per month in more than 130
countries, IBM holds over 10,000 security patents. To learn
more, visit ibm.com/security. Join the conversation in the
IBM Security Community.
If you have questions or comments about this research report,
including for permission to cite or reproduce the report, pleasecontact by letter, phone call or email:Ponemon Institute LLC
Attn: Research Department
2308 US 31 North
Traverse City
Michigan 49686 USA
1.800.887.3118
research@ponemon.org

Take the next steps
Zero trust security solutions
Wrap security around every user,
device and connection.
Learn more
Identity and access management
Connect every user, API and device
to every app securely.
Learn more
Data security
Discover, classify andprotect sensitive enterprise data.
Learn more
Security orchestration,
automation and response
Accelerate incident response withorchestration and automation.
Learn more
Security information andevent management
Gain visibility to detect, investigate
and respond to threats.
Learn more
Cloud security
Integrate security into your journey
to hybrid multicloud.
Learn more
Endpoint security
Protect devices, users and organizations
against sophisticated attacks.
Learn more
Cybersecurity services
Reduce risk with consulting, cloud andmanaged security services.
Learn more
Incident response and threat intelligence
Proactively manage and respondto security threats.
Learn more
Schedule a one-on-one consultation
with an IBM Security X-Force expert
Schedule now

View the action guide58© Copyright IBM Corporation 2022
IBM Corporation
New Orchard Road
Armonk, NY 10504
Produced in the
United States of America
July 2022
IBM, the IBM logo, ibm.com, IBM Security, and X-Force are trademarks orregistered trademarks of International Business Machines Corporation, in the
United States and/or other countries. Other product and service names might betrademarks of IBM or other companies. A current list of IBM trademarks is available
on ibm.com/trademark.
This document is current as of the initial date of publication and may be changed
by IBM at any time. Not all offerings are available in every country in which IBM
operates.
The performance data and client examples cited are presented for illustrative
purposes only. Actual performance results may vary depending on specificconfigurations and operating conditions. THE INFORMATION IN THIS DOCUMENTIS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED,INCLUDING WITHOUT ANY WARRANTIES OF MERCHANTABILITY, FITNESSFOR A PARTICULAR PURPOSE AND ANY WARRANTY OR CONDITION OF
NON-INFRINGEMENT. IBM products are warranted according to the terms andconditions of the agreements under which they are provided.
Statement of Good Security Practices: IT system security involves protecting
systems and information through prevention, detection and response to improper
access from within and outside your enterprise. Improper access can result in
information being altered, destroyed, misappropriated or misused or can result indamage to or misuse of your systems, including for use in attacks on others. No IT
system or product should be considered completely secure and no single product,
service or security measure can be completely effective in preventing improperuse or access. IBM systems, products and services are designed to be part of alawful, comprehensive security approach, which will necessarily involve additional
operational procedures, and may require other systems, products or services tobe most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS
OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNEFROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.
The client is responsible for ensuring compliance with laws and regulations
applicable to it. IBM does not provide legal advice or represent or warrant that its
services or products will ensure that the client is in compliance with any law or
regulation. Statements regarding IBM’s future direction and intent are subject tochange or withdrawal without notice, and represent goals and objectives only.