Contents
IBM’s 2026 Cost of a Data Breach Report is the most detailed public accounting of what a serious breach costs a large organization, and its headline number cannot tell a forty-person firm anything useful about its own risk. The $4.99 million average is a mean over 602 breaches, self-reported by organizations large enough to have a security program worth studying. A mean is the wrong statistic for a decision about your own tail.
I use the report every year: cost per record, the split between detection and lost business, the relationship between containment time and total cost. I don’t use the average, and I no longer let clients write it into a risk register. The number I build instead looks like the model further down this page, and it usually lands between one-fortieth and one-sixth of IBM’s figure.
What the report actually measures
The edition published 29 July 2026 is the current one. It studies 602 organizations across 16 countries and 17 industries, with 3,558 interviews by Ponemon Institute. The breaches occurred between March 2025 and February 2026 and ranged from 2,590 to 115,380 compromised records. The US accounts for 10 percent of the sample, roughly sixty organizations.
Cost here is a specific construct: detection and escalation, notification, post-breach response, and lost business, including “the extrapolated value of customer loss resulting from turnover or diminished customer acquisition rates.” A portion of every average is a model of future customer behavior, not an invoice.
The methodology section is candid in a way most summaries skip. Ponemon calls the sample “representative, nonstatistical,” and says margins of error and confidence intervals cannot be applied. Nonresponse bias was not tested, and the sampling frame “was biased toward organizations with more mature privacy or information security programs.” The report also warns that respondents may not have been accurate or truthful, and that cost extrapolation can introduce bias.
The average is then a reasonable estimate of one thing: what a studied, mid-to-large organization with an established security function spent on a breach it was willing to describe. It is a reasonable benchmark for a hospital chain’s security budget. It is not a forecast for a 40-person architecture firm.
The average hides the distribution
IBM leads with a mean. I could not find a median or a quartile for total cost anywhere in the edition, which leaves the reader unable to see how concentrated the sample is. The record range gives a hint: the smallest incident still involved 2,590 records. A compromised mailbox with 400 client records, a small firm’s bad day, sits below the study’s floor.
The UK government measures the other end of the same distribution. In its 2025/2026 Cyber Security Breaches Survey, published 30 April 2026, DSIT stopped reporting mean costs altogether, citing a distribution that is “highly skewed and subject to high sampling error.” It reports medians instead. For UK businesses, the median perceived cost of the most disruptive breach was £0. The middle half of cases fell between £0 and £200. The 95th percentile was £4,000 for micro and small businesses and £10,000 for medium and large ones.
Those figures answer a different question: perceived cost of the worst incident in a year, in pounds, across 2,000 businesses, most of them small. They are not comparable to IBM’s, but they show the shape of the thing. Most incidents cost almost nothing, and a small minority cost a great deal. An average over the whole population describes nobody in it.
Where the money goes
The four cost components are the most useful part of the report; they hold their shape even when the total doesn’t transfer.
| Component | 2026 average | Share of total |
|---|---|---|
| Detection and escalation | $1.64M | 33% |
| Lost business | $1.54M | 31% |
| Post-breach response | $1.36M | 27% |
| Notification | $0.45M | 9% |
| Total | $4.99M | 100% |
Detection and lost business together are 63 percent of the total. Fines sit inside post-breach response, alongside credit monitoring, call centers, and legal fees, and they are not what makes the number large. The clock and the customer base are.
That ordering should change what a small company buys. A firm that spends its security budget on compliance paperwork and skips offline backups has funded the smallest line and left the two largest ones exposed.
The clock is the lever
Mean time to identify and contain a breach rose to 247 days, split into 183 days to identify and 64 to contain. That is a 2.5 percent increase and the first reversal after five years of improvement.
Breaches that ran longer than 200 days averaged $5.65 million. Those that closed faster averaged $4.32 million. The gap is $1.33 million, about 31 percent, and it is the most actionable relationship in the report, with one caveat. Duration is partly a marker of difficulty. Supply-chain breaches and criminal intrusions take longer to find and cost more for reasons that have nothing to do with the calendar. Fixing speed helps; it will not turn a supply-chain case into a phishing case.
The report also offers a per-hour figure, $1,100, which does not survive division. Take $4.99 million, divide by 247 days, then by 24 hours, and you get about $842 an hour. I can’t reproduce it from the report’s own figures, so treat it as a headline rather than a rate to multiply by your outage length. Your restore time is what matters, and you can measure it this month.
Three datasets, three questions
The annual reports get quoted as if they describe the same world. They don’t. IBM says phishing led initial attack vectors for the fourth consecutive year. Verizon’s 2026 DBIR, released 19 May 2026, says vulnerability exploitation overtook stolen credentials for the first time, at 31 percent of breaches. Both can be right. IBM surveys organizations that know they were breached and will discuss it; Verizon analyzes incident data contributed by insurers, incident response firms, and telecom carriers.
| Dataset | Population | Unit measured | 2026 headline | Question it answers |
|---|---|---|---|---|
| IBM Cost of a Data Breach | 602 breached organizations, 16 countries | Total organizational cost of one breach | $4.99M mean; $11.5M in the US | What a large, studied breach costs |
| Verizon DBIR | Incident data from contributors | Share of breaches by entry point | 31% start with exploitation | How breaches start |
| FBI IC3 | 1,008,597 victim complaints | Money reported lost | $20.877B total; $20,699 per complaint | What victims reported losing |
| DSIT Breaches Survey | About 2,000 UK businesses | Perceived cost of worst incident | Median £0; 95th percentile £4,000 | What a typical small organization spends |
The IC3 figure is the one most often misquoted. The FBI’s 2025 Internet Crime Report, published in April 2026, records $20.877 billion in losses across 1,008,597 complaints, a 26 percent increase over 2024. That total is victim-reported and dominated by fraud: cyber-enabled fraud is 85 percent of all losses, investment fraud alone $8.65 billion. Data breach complaints numbered 3,963. The $20,699 average is what a complainant reported losing, not what an organization spent responding.
If you set priorities from one of these datasets, you are adopting its population. A small firm should read IC3 for the fraud it will actually meet, the DBIR for how intrusions start, and IBM for the shape of a large incident’s cost. None of them will hand you a planning number.
What a breach would cost a 40-person firm
Here is the model I build instead. The company: 40 employees, $8 million in revenue, 12,000 client records, 3,000 of them containing Social Security or tax identification numbers that belong to 1,200 people. The scenario is ransomware with data theft, the case that produces both downtime and notification duties.
The assumptions are mine; replace them with your own quotes. Revenue per operating hour is $4,000 ($8 million over 2,000 hours), and I cost downtime at $2,400 an hour: about $1,600 of revenue at risk after accounting for work that gets made up, plus roughly $800 of net idle payroll. Forensics runs $300 to $350 an hour. Notification runs $2.50 to $3.00 per letter including the 82-cent First-Class stamp that took effect on 12 July 2026. Credit monitoring is $120 per person for twelve months at a group rate; an individual retail plan runs higher.
| Line | Low case | High case | What drives it |
|---|---|---|---|
| Downtime, 16 or 96 hours | $38,400 | $230,400 | Restore time |
| Forensics and incident response | $12,000 | $70,000 | 40 or 200 hours |
| Breach counsel | $12,000 | $75,000 | States, regulators, contracts |
| Notification, 500 or 3,000 letters | $1,250 | $9,000 | Record count |
| Call center | $0 | $12,000 | Volume and languages |
| Credit monitoring, 0 or 1,200 people | $0 | $144,000 | Identifiers in scope |
| Regulatory response | $0 | $40,000 | State attorney general inquiry |
| Extra labor and temporary tooling | $8,000 | $35,000 | How long email is down |
| Customer churn, 0.5% or 2% of revenue | $40,000 | $160,000 | Modeled, not invoiced |
| Insurance deductible | $5,000 | $25,000 | Policy terms |
| Management time, 60 or 200 hours | $12,000 | $40,000 | Who owns the response |
| Total | $128,650 | $840,400 |
The low case is a contained incident: one day down, backups work, 500 people notified, no identifiers exposed. The high case is a bad week with 1,200 identities in scope and a regulator asking questions. Neither resembles $4.99 million. The high case is about 17 percent of it; the low case about 2.6 percent.
One IBM number does transfer. At $192 per customer record, 3,000 records imply $576,000, which lands inside my range. That is the right way to use the report: as a marginal cost per record for a mid-size breach, not as a total. If you want a single figure for a board packet, multiply the per-record cost by your exposed record count, then check it against a bottom-up model like this one.
The tail you cannot average away
The two cost studies describe the tail badly, and that is the trouble: their published numbers stop where the interesting cases begin. IBM reports a mean of $4.99 million and no median, so the incidents near the top of its 2,590-to-115,380 record range are free to drag the figure everyone quotes. DSIT’s 95th percentile of £4,000 for small businesses marks where its reporting stops, not where the loss stops.
For a forty-person firm the tail has four lines in this model, and they scale with the people you must notify and the days your revenue stops. Downtime at 96 hours is $230,400; credit monitoring for 1,200 identities is $144,000; a regulatory inquiry is $40,000; a 2 percent churn assumption is $160,000, and that one never appears on an invoice. Together they are roughly two-thirds of the high case. Each is fixed mostly before the incident, by what data you kept, how fast you can restore, and what the policy says.
The claims studies I have read pool forty-person firms with mid-market ones, so they cannot show this tail at your scale. What they do confirm is that insurance changes who pays, not what the incident costs. The deductible, the sub-limit for ransomware and social engineering, the waiting period on business interruption, and the treatment of regulatory fines decide how much of the tail stays with you. A policy built for a $5 million event and a policy built for yours can look identical on the declarations page.
What this means for operators
The report is worth reading for its structure, not its total. The order of its cost components, time first and notification last, tells you where a dollar of prevention buys the most. Offline backups with a tested restore shorten the largest line. Data mapping and retention limits shrink the third. Neither requires an enterprise budget.
Your distribution is not the population’s. Most small-firm incidents cost little, and the DSIT median of £0 is real. A minority cost more than the firm earns in a year. Planning for the median leaves you unprepared for the case that ends the company. Planning for IBM’s average spends money you don’t have on a scenario you won’t face.
The useful target is a bad-but-plausible case: the high column of the model, with your own inputs. That is the number to insure against and the number to put in front of your board.
What to do
- Build the two-column model before you read another report. Downtime hours times cost per hour; exposed records times per-record cost. If you cannot fill those four cells, you have found the gap that matters more than any benchmark.
- Time a restore this month. Not a backup success message: a full restore of your file server and your line-of-business application, on hardware you can actually get, with a stopwatch running.
- Count the records that trigger notification. Social Security and tax identification numbers, driver’s licence numbers, financial account numbers, health data. Most firms guess high on total records and low on the ones that create duties.
- Get quotes for notification and monitoring now. A mail vendor and a monitoring vendor will price 1,000 and 3,000 identities within a week. Put quoted numbers in the model instead of assuming them.
- Read the policy for the four clauses that decide your retention. Deductible, ransomware sub-limit, business interruption waiting period, and the treatment of regulatory fines and contractual penalties.
- Write the first hour down. Who isolates the network, who calls counsel, who calls the insurer, who speaks to staff. The sequence is covered in the first 72 hours after a breach.
- Put the range in the risk register and report it quarterly. A range with its assumptions survives scrutiny better than a single number borrowed from a global study.
This quarter, decide which number your organization will plan against. Replace the $4.99 million line in your risk register with your own modelled range and the three inputs behind it: hours to restore, records that trigger notification, and your deductible. If one of those is blank, the blank is the finding. The controls that keep a small firm out of most breaches cost less than the incident, the argument in The Threat Floor, and the budget question gets easier once the exposure has a number. For the notification duties behind it, start with the state-by-state map; the cybersecurity archive has the rest.
Sources
- Cost of a Data Breach Report 2026 — IBM and Ponemon Institute, 2026-07-29.
- IBM Study: One in Four Malicious Breaches are AI-Enabled — IBM Newsroom, 2026-07-29.
- AI-powered adversaries and the enterprise risk challenge — IBM Think, 2026-07-29.
- 2025 Internet Crime Report — FBI Internet Crime Complaint Center, April 2026.
- Vulnerability exploitation top breach entry point, 2026 DBIR finds — Verizon, 2026-05-19.
- Cyber security breaches survey 2025/2026 — UK Department for Science, Innovation and Technology, 2026-04-30.
- USPS recommends new prices effective July 12 — United States Postal Service, 2026-04-09.
An earlier version appeared on LinkedIn.
Filed under benchmarks, breach-cost, smb
