Cybersecurity Statistics 2026
By Axis Intelligence Research
Co-authors: Marcus Chen | Last updated: October 28, 2026 | License: CC BY 4.0
Cyber risk outran cyber defense this year. Axis Intelligence Research’s Threat-Defense Gap Index (TDGI) reads 164.7: seven attacker-side indicators rose a weighted 39.3% year over year, while five defender-side measures slipped 15.5%. Breaches now cost a record $4.99 million on average, and exploited software flaws open 31% of them.
Quick Answer
- Average cost of a data breach: $4.99 million worldwide, a record and 12% higher than last year; $11.5 million in the United States (IBM Cost of a Data Breach 2026).
- Top way attackers get in: exploiting software vulnerabilities, now 31% of breaches, overtaking stolen credentials at 13% (Verizon 2026 DBIR).
- Ransomware: present in 48% of breaches; 69% of victims did not pay; median payment $139,875.
- Third parties: involved in 48% of breaches, up 60% in a year.
- Reported U.S. cybercrime losses: $20.877 billion across 1,008,597 FBI complaints in 2025, about 2,763 complaints a day (FBI IC3 2025).
- Known exploited vulnerabilities: CISA added 276 to its KEV catalog between January 1 and October 27, 2026, 31.4% more than in the same window of 2025 (Axis count of the official KEV data).
Key Findings
- Axis Intelligence Research’s Threat-Defense Gap Index stands at 164.7 for 2026, meaning attacker-side indicators grew 64.7% faster than defender-side performance year over year.
- CISA added 276 vulnerabilities to its Known Exploited Vulnerabilities catalog between January 1 and October 27, 2026, already more than the 245 added in all of 2025, according to an Axis Intelligence Research count of CISA’s catalog data.
- 68.5% of the vulnerabilities CISA confirmed as exploited in 2026 were CVEs published in 2026 itself, up from 57.6% in the same window of 2025, Axis Intelligence Research found.
- Axis Intelligence Research calculates a 50-day patch exposure window in 2026: organizations take a median 43 days to fully fix known exploited flaws, while attackers now exploit vulnerabilities on average 7 days before a patch is available.
- A U.S. data breach costs 2.30 times the global average in IBM’s 2026 data, exactly the same multiple as in 2025, Axis Intelligence Research calculates.
What does the 2026 cyber threat landscape look like in numbers?
Every major primary dataset published in the last ten months points the same way: more entry points, faster exploitation, slower repair. The table below is the one-glance view; each figure links to its section.
| Indicator | 2026 edition | Prior edition | Direction | Source |
|---|---|---|---|---|
| Breaches starting with vulnerability exploitation | 31% | 20% | ▲ | Verizon DBIR |
| Breaches with third-party involvement | 48% | 30% | ▲ | Verizon DBIR |
| Breaches involving ransomware | 48% | 44% | ▲ | Verizon DBIR |
| Global average breach cost | $4.99M | $4.44M | ▲ | IBM |
| Active ransomware and extortion groups | 109 | 73 | ▲ | IBM X-Force |
| Global median attacker dwell time | 14 days | 11 days | ▲ | Mandiant M-Trends |
| KEV flaws fully remediated by organizations | 26% | 38% | ▼ | Verizon DBIR |
| Reported U.S. internet-crime losses | $20.877B | $16.6B | ▲ | FBI IC3 |
Editions: DBIR covers incidents from November 2024 to October 2025; IBM covers breaches from March 2025 to February 2026; X-Force, Mandiant and IC3 cover calendar 2025.
Marcus Chen, Cybersecurity & Privacy: The shift that matters is not any single number but the alignment. When Verizon’s breach forensics, Mandiant’s incident response caseload and IBM’s cost survey all move the same direction in the same year, you are looking at a structural change in how intrusions start, not sampling noise. The center of gravity has moved from “who clicked” to “what was left unpatched, and whose software was it.”
The Axis Threat-Defense Gap Index (TDGI): is security improving as fast as threats are growing?
No. The Threat-Defense Gap Index (TDGI) is an original Axis Intelligence Research measure that answers one question: did defensive performance keep pace with attacker activity this year? A reading of 100 means parity. Above 100, attackers gained ground.
TDGI 2026 = 164.7. Threat Momentum reads 139.3; Defense Momentum reads 84.5.
How the TDGI is built
Formula: TDGI = 100 × (Threat Momentum ÷ Defense Momentum), where each momentum score is a weighted geometric mean of year-over-year ratios, multiplied by 100.
| Threat-side input (higher = worse) | Prior → 2026 edition | Ratio | Weight | Source |
|---|---|---|---|---|
| Breaches starting with exploitation | 20% → 31% | 1.550 | 20% | Verizon DBIR |
| Breaches with third-party involvement | 30% → 48% | 1.600 | 15% | Verizon DBIR |
| Breaches involving ransomware | 44% → 48% | 1.091 | 15% | Verizon DBIR |
| Reported U.S. internet-crime losses | $16.6B → $20.877B | 1.258 | 15% | FBI IC3 |
| KEV additions, Jan 1–Oct 27 | 210 → 276 | 1.314 | 15% | CISA KEV (Axis count) |
| Active ransomware groups | 73 → 109 | 1.493 | 10% | IBM X-Force |
| AI-driven attacks | +56% | 1.560 | 10% | IBM |
| Defense-side input (performance ratio, higher = better) | Prior → 2026 edition | Ratio | Weight | Source |
|---|---|---|---|---|
| KEV flaws fully remediated | 38% → 26% | 0.684 | 25% | Verizon DBIR |
| Median days to fully remediate KEV flaws (inverted) | 32 → 43 days | 0.744 | 20% | Verizon DBIR |
| Median attacker dwell time (inverted) | 11 → 14 days | 0.786 | 20% | Mandiant |
| Intrusions first detected internally | 43% → 52% | 1.209 | 20% | Mandiant |
| Breach lifecycle (inverted) | 241 → 247 days | 0.976 | 15% | IBM |
Worked example: Threat Momentum = 100 × exp(0.20·ln1.550 + 0.15·ln1.600 + 0.15·ln1.091 + 0.15·ln1.258 + 0.15·ln1.314 + 0.10·ln1.493 + 0.10·ln1.560) = 139.3. Defense Momentum = 100 × exp(0.25·ln0.684 + 0.20·ln0.744 + 0.20·ln0.786 + 0.20·ln1.209 + 0.15·ln0.976) = 84.5. TDGI = 100 × 139.3 ÷ 84.5 = 164.7.
Robustness: With equal weights, the TDGI is 162.4. Removing any single input keeps it between 153.5 and 180.1. No plausible re-weighting brings it near 100.
What the TDGI says
The one defender metric that improved is detection: Mandiant clients spotted 52% of intrusions themselves, up from 43%. Everything downstream of detection got worse. Organizations fully fixed only 26% of known exploited flaws, down from 38%, and took a median 43 days to do it, up from 32. That is the gap the index captures: security teams are seeing more, and closing less.
Marcus Chen: Read the TDGI as a remediation story. Detection budgets have been the default answer for a decade, and the Mandiant number shows they work. But the DBIR remediation figures say the bottleneck has moved to patch operations and vendor management, which rarely get the same funding conversation.
How do attackers get in now? Initial access statistics for 2026
Vulnerability exploitation is the single most common way breaches begin, according to every frontline dataset published this year.
| Initial access measure | Value | Source |
|---|---|---|
| Breaches starting with vulnerability exploitation | 31% (20% prior year) | Verizon DBIR 2026 |
| Breaches starting with credential abuse | 13% (22% prior year) | Verizon DBIR 2026 / 2025 |
| Breaches starting with phishing | 16% | Verizon DBIR 2026 |
| Breaches starting with pretexting | 6% | Verizon DBIR 2026 |
| Intrusions starting with an exploit | 32%, top vector for a sixth straight year | Mandiant M-Trends 2026 |
| Intrusions starting with voice phishing | 11%, now second | Mandiant M-Trends 2026 |
| Intrusions starting with email phishing | 6% | Mandiant M-Trends 2026 |
| Increase in attacks exploiting public-facing applications | 44% | IBM X-Force 2026 |
| Disclosed vulnerabilities exploitable without authentication | 56% of nearly 40,000 tracked | IBM X-Force 2026 |
Exploitation is happening before patches exist
Mandiant estimates the mean time to exploit at minus 7 days: attackers typically use a flaw a week before a fix is released. On the defender side, the DBIR puts the median time to fully fix a known exploited vulnerability at 43 days.
Axis cross-source calculation, the patch exposure window: 43 − (−7) = 50 days between first exploitation and full repair in the typical case. For deeper remediation benchmarks, see our patch management statistics.
Social engineering moved to the phone
Phishing simulations show mobile-centric lures (voice and text) draw a 40% higher median click rate than email, according to the DBIR. Mandiant independently ranks voice phishing as the second most common intrusion vector at 11%, while email phishing fell to 6%. Full phishing loss data lives on our phishing statistics page.
Marcus Chen: Credential abuse falling from 22% to 13% is not a sign stolen passwords stopped mattering. It reflects attackers no longer needing them: when 56% of disclosed flaws require no authentication at all, the internet-facing appliance becomes the front door.
How many known exploited vulnerabilities did CISA add in 2026? (Dated snapshot: October 27, 2026)
Axis Intelligence Research counted every entry in CISA’s Known Exploited Vulnerabilities (KEV) catalog, version 2026.10.27, retrieved from CISA’s official GitHub mirror on October 27, 2026.
| KEV measure | 2026 (Jan 1–Oct 27) | 2025 (same window) | Source |
|---|---|---|---|
| New KEV entries | 276 | 210 | CISA KEV (Axis count) |
| Change | +31.4% | — | Axis calculation |
| Entries that are same-year CVEs | 68.5% (189) | 57.6% (121) | CISA KEV (Axis count) |
| Entries flagged for known ransomware use | 9.8% (27) | 13.8% (29) | CISA KEV (Axis count) |
| Distinct vendors | 106 | 89 | CISA KEV (Axis count) |
| Top vendor | Microsoft, 40 entries | Microsoft, 37 entries | CISA KEV (Axis count) |
- Total catalog size: 1,760 entries as of October 27, 2026.
- Full-year 2025: 245 entries. 2026 passed that total before November.
- Busiest month of 2026: September, with 43 additions.
- Pace: 0.92 new confirmed-exploited vulnerabilities per day. At this pace 2026 would close near 336 additions (Axis linear run-rate, 276 × 365 ÷ 300).
Federal patch deadlines collapsed from 21 days to 3
In 2025, 226 of 245 KEV additions (92.2%) carried the standard 21-day federal remediation window. In 2026, 148 of 276 additions (53.6%) carry a deadline of three days or less. Since June 10, 2026, when CISA issued Binding Operational Directive 26-04, which revokes BOD 22-01 (the 2021 directive behind the 21-day rule) and ties deadlines to exposure, KEV status, exploit automation and technical impact, 115 of 143 additions (80.4%) carry a 3-day due date; the rest carry 14 days. Our CISA KEV statistics page and live KEV Tracker carry the full history.
Marcus Chen: The same-year share is the number to watch. When more than two-thirds of confirmed-exploited flaws were disclosed this calendar year, quarterly patch cycles stop being a strategy and become a liability.
How much does a data breach cost in 2026?
$4.99 million on average worldwide, a record and a 12% increase, per IBM’s 2026 Cost of a Data Breach Report (602 organizations, breaches from March 2025 to February 2026). U.S. organizations averaged $11.5 million.
| Breach cost measure | 2026 report | 2025 report | Source |
|---|---|---|---|
| Global average cost | $4.99M | $4.44M | IBM 2026 / IBM 2025 |
| U.S. average cost | $11.5M | $10.22M | IBM report |
| U.S. multiple of global average | 2.30× | 2.30× | Axis calculation |
| Healthcare average cost | $6.64M | $7.42M | IBM report |
| Financial services average cost | $6.29M | $5.56M | IBM report |
| Energy average cost | $5.24M | $4.83M | IBM report |
| Average cost of an AI-enabled breach | $6.0M | — | IBM 2026 |
| Breach lifecycle (identify + contain) | 247 days | 241 days | IBM report |
| Savings from extensive security AI and automation | $1.93M | — | IBM report |
- AI-enabled breaches: one in four malicious breaches, up 56%, mostly deepfake impersonation and AI-enabled malware.
- AI systems as targets: 21% of organizations reported an AI-related breach, up from 13%; 92% of them lacked proper AI access controls.
- Shadow AI: incidents involving unapproved AI tools more than doubled to 43% of organizations (20% a year earlier) and cost $5.39 million on average.
- Encryption gap: only 37% of breached organizations encrypt sensitive data both at rest and in transit.
Country-by-country costs sit on our cybercrime cost by country page; sector detail on data breach statistics.
Marcus Chen: The 2025 dip to $4.44 million was widely reported as a turning point. It was a pause. Costs are now higher than before the dip, and the U.S. multiple has not moved at all, which tells you the American premium is structural: litigation, notification regimes and business disruption, not detection speed.
How many cyberattacks happen per day? Separating measured figures from myth
The most-repeated answer, “a hacker attack every 39 seconds,” comes from a University of Maryland study published February 6, 2007. It measured automated brute-force attempts against four deliberately weak Linux computers, which were hit 2,244 times a day on average. It is a 19-year-old lab observation, not a measure of attacks on organizations.
Measured, current daily equivalents (Axis calculations from primary counts):
| Daily measure | Value | Calculation | Source |
|---|---|---|---|
| Internet-crime complaints filed with the FBI | 2,763 per day | 1,008,597 ÷ 365 | FBI IC3 2025 |
| Confirmed breaches in Verizon’s dataset alone | 60+ per day | 22,000+ ÷ 365 | Verizon DBIR 2026 |
| Publicly reported U.S. data compromises, H1 2026 | 10.0 per day | 1,803 ÷ 181 | ITRC |
| Publicly reported U.S. data compromises, 2025 | 9.1 per day | 3,321 ÷ 365 | ITRC |
| Newly confirmed exploited vulnerabilities | 0.92 per day | 276 ÷ 300 days | CISA KEV (Axis count) |
These are floors, not totals: each counts only what reaches one reporting channel. The U.S. Identity Theft Resource Center found that 70% of 2025 breach notices contained no attack-vector information, up from 45% in 2023 (ITRC 2025 report).
Ransomware statistics 2026: more attacks, fewer payers, bigger outliers
| Ransomware measure | Value | Period | Source |
|---|---|---|---|
| Breaches involving ransomware | 48% (44% prior) | Nov 2024–Oct 2025 | Verizon DBIR |
| Ransomware victims that did not pay | 69% | Nov 2024–Oct 2025 | Verizon DBIR |
| Median ransom paid | $139,875 | Nov 2024–Oct 2025 | Verizon DBIR |
| Active ransomware and extortion groups | 109 (73 in 2024) | 2025 | IBM X-Force |
| On-chain ransomware payments | $820M (−8% vs $892M) | 2025 | Chainalysis |
| Claimed ransomware victims on leak sites | +50% | 2025 | Chainalysis |
| Average ransom payment | $1,880,612 (+176% QoQ) | Q2 2026 | Coveware |
| Median ransom payment | $150,000 (−50% QoQ) | Q2 2026 | Coveware |
| Ransomware complaints to the FBI | 3,611 | 2025 | FBI IC3 |
| Time from initial access to hand-off to a second group | 22 seconds (8+ hours in 2022) | 2025 | Mandiant |
Victim volume and revenue are moving in opposite directions: claimed victims rose 50% while on-chain payments fell 8%. The average payment spiking while the median halves signals a market where a few large victims pay a lot and most pay nothing. Sector-level costs and recovery data sit on our ransomware statistics and ransomware attack cost pages.
Marcus Chen: The 22-second hand-off is the operational headline. Access brokers now pre-stage the ransomware crew’s tooling during the first infection, so a “low-severity” malware alert can be the last warning before encryption.
Which industries and regions are most exposed in 2026?
The DBIR shows exploitation and third-party exposure concentrate in different sectors. Retail and manufacturing combine both at high levels.
| Sector (DBIR 2026) | Exploitation as initial access | Third-party involvement | Source |
|---|---|---|---|
| Retail | 42% | 68% | Verizon DBIR |
| Public Administration | 40% | 36% | Verizon DBIR |
| Manufacturing | 38% | 61% | Verizon DBIR |
| Education | 34% | 40% | Verizon DBIR |
| Small and mid-sized businesses | 26% | 55% | Verizon DBIR |
| Financial & Insurance | 22% | 34% | Verizon DBIR |
| Healthcare | 20% | 32% | Verizon DBIR |
- Most-attacked sector (IBM X-Force): manufacturing, 27.7% of incidents, the fifth consecutive year at the top; finance and insurance follow at 27%.
- Most-attacked region (IBM X-Force): North America, 29% of attacks, up from 24%, the first time in six years it ranks first. Asia Pacific fell from 34% to 27%.
- SMBs: 7,152 confirmed breaches in the DBIR dataset.
- Utilities: 71% of breaches were espionage-motivated, the highest share of any sector.
Full sector rankings are on cybersecurity statistics by industry.
How is AI changing cyberattacks and cyber defense?
| AI measure | Value | Source |
|---|---|---|
| Malicious breaches that were AI-enabled | 1 in 4 (+56%) | IBM 2026 |
| AI-driven attacks aimed at critical-infrastructure sectors | 62% | IBM 2026 |
| Techniques where the median threat actor used AI assistance | 15 | Verizon DBIR |
| ChatGPT credentials exposed by infostealers in 2025 | 300,000+ | IBM X-Force |
| Employees regularly using AI on corporate devices | 45% (15% prior year) | Verizon DBIR |
| Users reaching AI through non-corporate accounts on work devices | 67% | Verizon DBIR |
| FBI complaints tagged AI-related | 22,364 ($893.3M losses) | FBI IC3 |
| Organizations applying AI agents to vulnerability management | 18% | IBM 2026 |
Two readings coexist. Most AI-assisted malware in the DBIR reproduces known techniques; fewer than 2.5% of observations involved rare techniques. Mandiant’s frontline view is that 2025 breaches still stemmed from human and systemic failures rather than AI itself. The acceleration is real, but it amplifies old playbooks. Deeper coverage: AI cyberattack statistics.
Marcus Chen: The IBM figure that should worry boards is the 18%. More than half of organizations already use agents for detection, yet fewer than one in five point them at vulnerability management, the exact step the TDGI shows is failing.
Is there still a cybersecurity skills shortage?
Yes, but it is now measured as a skills gap rather than a headcount gap. ISC2’s 2025 Cybersecurity Workforce Study, the largest annual survey of the profession (16,029 respondents), stopped publishing a global workforce-gap estimate.
| Workforce measure | Value | Source |
|---|---|---|
| Respondents with at least one skills need | 95% | ISC2 2025 |
| Respondents citing critical or significant skills needs | 59% (44% in 2024) | ISC2 2025 |
| Respondents with a significant consequence from a skills deficiency | 88% | ISC2 2025 |
| Organizations lacking budget to staff adequately | 33% | ISC2 2025 |
| Respondents reporting budget cuts | 36% | ISC2 2025 |
| Respondents reporting layoffs | 24% | ISC2 2025 |
Job-market data (open roles, salaries) is on cybersecurity jobs statistics.
What changes in cybersecurity in 2027?
Several dated commitments and forecasts already define next year.
| 2027 signal | Detail | Source |
|---|---|---|
| EU Cyber Resilience Act | Main obligations for products with digital elements apply from December 11, 2027; vulnerability and incident reporting duties have applied since September 11, 2026 | European Commission |
| U.S. CIRCIA reporting rule | Final rule under White House review as of October 2026; 72-hour incident and 24-hour ransom-payment reporting for an estimated ~316,000 entities | CISA, as reported October 2026 |
| Spending intent | 85% of organizations plan to raise security spending after learning of frontier AI cyber capabilities | IBM 2026 |
| Supply chain as top concern | 65% of large companies name third-party risk their greatest challenge (54% a year earlier) | WEF Global Cybersecurity Outlook 2026 |
| Exploited-vulnerability pace | KEV on track for ~336 additions in 2026, the most since the catalog’s 2022 backfill | CISA KEV (Axis run-rate) |
Spending benchmarks by company size are on cybersecurity spending statistics and cybersecurity budget benchmarks.
Marcus Chen: Plan 2027 around two deadlines rather than one forecast. December 11, 2027 turns the CRA’s secure-by-design duties into market-access conditions for anything sold in the EU, and CIRCIA will make U.S. critical-infrastructure incidents reportable within 72 hours. Both reward the same capability: knowing which exploited flaws you run and how fast you can fix them.
Methodology
Collection. Every figure was taken from the issuing organization’s own publication and re-checked on October 27, 2026: Verizon (2026 DBIR and executive summary), IBM and Ponemon Institute (Cost of a Data Breach 2026 and 2025), IBM X-Force (Threat Intelligence Index 2026), Google Cloud/Mandiant (M-Trends 2026), FBI IC3 (2025 annual report), ISC2 (2025 Workforce Study), the Identity Theft Resource Center, Chainalysis, Coveware, the World Economic Forum, the European Commission, and CISA (BOD 26-04). No secondary aggregator is used as a data source.
KEV counts. Axis counted the CISA KEV catalog (catalogVersion 2026.10.27, 1,760 entries) from CISA’s official GitHub mirror. “Same window” compares January 1 to October 27 in each year. A “same-year CVE” is an entry whose CVE ID year equals the year it was added. Deadline windows are the difference between dueDate and dateAdded.
Formulas.
- TDGI = 100 × exp(Σ wᵢ·ln tᵢ) ÷ exp(Σ wⱼ·ln dⱼ), weights and inputs as tabled above. Ratios compare each source’s 2026 edition with its prior edition; defender metrics where lower is better (days) are inverted.
- Patch exposure window = DBIR median days to full KEV remediation − Mandiant mean time-to-exploit = 43 − (−7) = 50 days. The two inputs come from different samples and statistics (median vs mean), so the result is an order-of-magnitude indicator.
- Daily equivalents = annual or half-year count ÷ days in period.
- KEV run-rate = 276 × 365 ÷ 300.
Revisions noted. The 2026 DBIR restates the prior-year median ransom as $150,000; the 2025 DBIR had published $115,000. ITRC revised 2025 compromises from 3,322 to 3,321. IBM’s U.S. cost ($11.5M, 2025: $10.22M), healthcare cost ($6.64M) and lifecycle (247 days = 183 to identify + 64 to contain) were checked against the full 2026 report PDF. IBM’s own text gives the U.S. year-over-year increase as both 11% and 13%; this page reports the two values instead of a percentage.
About this dataset
- File:
cybersecurity-statistics.csv, 314 rows. Every number on this page is a CSV row with value, unit, period, as-of date, geography, source organization, document, URL, retrieval date and source type. - License: CC BY 4.0. Reuse, chart and republish with attribution to Axis Intelligence Research.
- Mirrors: Hugging Face, Kaggle and GitHub (Axis Intelligence Research).
- Update policy: relevance-driven. The page is refreshed when a source it depends on publishes a new edition: X-Force (February), Mandiant M-Trends (March–April), FBI IC3 (April), Verizon DBIR (May), IBM Cost of a Data Breach (July), ISC2 (December). The KEV snapshot is refreshed monthly.
- Next review trigger: publication of the IBM X-Force Threat Intelligence Index 2027, expected February 2027, at which point the TDGI will be recalculated.
Cite this page
- APA: Axis Intelligence Research. (2026, October 28). Cybersecurity statistics 2026: Attackers are pulling away from defenders. Axis Intelligence. https://axis-intelligence.com/cybersecurity-statistics/
- MLA: Axis Intelligence Research. “Cybersecurity Statistics 2026: Attackers Are Pulling Away From Defenders.” Axis Intelligence, 28 Oct. 2026, axis-intelligence.com/cybersecurity-statistics/.
- Chicago: Axis Intelligence Research. “Cybersecurity Statistics 2026: Attackers Are Pulling Away From Defenders.” Axis Intelligence, October 28, 2026. https://axis-intelligence.com/cybersecurity-statistics/.
FAQ
Is the “hackers attack every 39 seconds” statistic real?
It is real but misapplied. It comes from a University of Maryland press release dated February 6, 2007, describing automated brute-force attempts on four weakly secured Linux computers, which averaged 2,244 attempts a day. It does not measure attacks on businesses. A current, measured equivalent is the FBI’s 2,763 internet-crime complaints per day in 2025.
What is the most common cause of data breaches in 2026?
Exploiting software vulnerabilities. It started 31% of breaches in Verizon’s 2026 DBIR, ahead of phishing at 16% and credential abuse at 13%. Mandiant’s incident data agrees: exploits started 32% of intrusions, the top vector for a sixth straight year.
Why does a breach in the United States cost more than twice the global average?
IBM’s 2026 data puts the U.S. average at $11.5 million versus $4.99 million globally, a 2.30× multiple that is unchanged from 2025. The persistence of the multiple points to structural cost drivers in the U.S., such as regulatory and notification obligations, litigation and business disruption, rather than to slower detection.
Are fewer companies paying ransomware demands?
Yes. In the 2026 DBIR, 69% of ransomware victims did not pay, and Chainalysis estimates on-chain ransomware payments fell 8% to $820 million in 2025 even as claimed victims rose 50%. Payment sizes are polarizing: Coveware’s Q2 2026 average payment jumped to $1.88 million while the median fell to $150,000.
How quickly must known exploited vulnerabilities be patched in 2026?
For U.S. federal civilian agencies, most new KEV entries now carry a three-day deadline. Axis Intelligence Research’s count shows 80.4% of KEV additions since June 10, 2026 have a 3-day due date, against a standard 21 days for 92.2% of 2025 additions. Private companies are not bound by these deadlines, but insurers and auditors increasingly use KEV as a benchmark.
How long do attackers stay inside a network before being detected?
Mandiant’s global median dwell time rose to 14 days in 2025, from 11 days. For espionage operations and North Korean IT worker schemes it was 122 days. IBM measures a full breach lifecycle, from compromise to containment, of 247 days.
What does the Axis Threat-Defense Gap Index (TDGI) measure?
The TDGI compares year-over-year growth in seven attacker-side indicators with year-over-year change in five defender-side performance measures, all from primary sources. A value of 100 means defense kept pace; the 2026 reading of 164.7 means attackers gained ground. Weights, inputs and formula are published on this page and in the CSV, under CC BY 4.0.
Should security plans for 2027 assume costs keep rising?
The primary data supports planning for higher exposure: breach costs hit a record in 2026, KEV additions are on pace for the most since 2022, and 85% of breached organizations told IBM they plan to raise security spending in response to frontier AI threats. Two fixed dates anchor planning: the EU Cyber Resilience Act’s main obligations on December 11, 2027, and the pending U.S. CIRCIA reporting rule.
Correction, October 28, 2026: An earlier version of this page cited 12,195 confirmed breaches for the 2026 DBIR (that figure belongs to the 2025 edition; the 2026 DBIR analyzed more than 22,000 breaches across more than 31,000 incidents); listed the 2024 U.S. average breach cost as $9.77 million (IBM reported $9.36 million); described manufacturing as the most-targeted sector for a fourth consecutive year (X-Force: fifth); reported the ISC2 2024 workforce gap as 4.7 million (ISC2 reported 4.8 million); attributed X-Force ransomware group counts to DBIR editions; and stated that the SEC’s four-business-day breach disclosure rule took effect in 2025 (it took effect December 18, 2023). Estimated component premiums in the former CBCDI table, which no primary source published, have been removed. Breach-cost figures are updated to IBM’s 2026 report.