Cybersecurity Statistics (2026): 52+ Data Points on Cybercrime

US cybercrime losses hit $20.9 billion in 2025 — a 26% jump year-over-year and the first time in history the figure crossed $20 billion (FBI Internet Crime Complaint Center, 2025 Annual Report).

That number only counts what was voluntarily reported to the FBI. The real total is believed to be a multiple of that figure. Meanwhile, the average US data breach now costs $10.22 million — an all-time high for any country — ransomware appeared in 44% of all confirmed breaches, and 83% of phishing emails are now AI-generated.

We aggregated data from the FBI Internet Crime Complaint Center 2025 Annual Report, IBM Cost of a Data Breach Report 2025, Verizon 2025 Data Breach Investigations Report, Gartner Information Security Forecast 2026, ISC2 2025 Cybersecurity Workforce Study, World Economic Forum Global Cybersecurity Outlook 2026, Check Point Cyber Security Report 2026, and KnowBe4 2025 Phishing Trends Report. 52 verified data points. Every stat traced to a Tier 1 primary source. Updated May 2026.

Key Takeaways

1 Cybercrime Costs & Financial Impact

The $20.9 billion the FBI recorded in 2025 represents only reported losses from voluntary IC3 complaints. Investment fraud drove the largest single category at $8.6 billion, but the more operationally relevant number for businesses is business email compromise — $3 billion in losses from a threat that requires no sophisticated malware, only a convincing email. For US organizations specifically, the data from IBM is unambiguous: breach costs in this country are in a category of their own, running more than double the global average and climbing every year.

FBI IC3 2025 Annual Report →  |  IBM Cost of a Data Breach 2025 →

The gap between US breach costs and the global average is driven by regulatory fines, higher detection and escalation expenses, and legal exposure. Organizations that reduce detection time through managed security services consistently land below that average.

Explore CNiC’s Cybersecurity Services →

2 Data Breaches: Frequency, Vectors & Root Causes

The 2025 Verizon Data Breach Investigations Report analyzed over 22,000 security incidents — the largest dataset in DBIR history. Phishing has been dethroned as the most common initial access vector by vulnerability exploitation for the first time. That said, the human element still played a role in 60% of all breaches — no technical control eliminates the human variable.

Verizon 2025 DBIR Full Report →

3 Ransomware Statistics

Ransomware is no longer a threat that primarily targets enterprises. The Verizon DBIR 2025 found that 88% of SMB breaches involved a ransomware component — more than double the 39% rate for large organizations. Ransomware-as-a-Service (RaaS) has industrialized attacks, making it profitable to target organizations that were previously too small to pursue manually.

4 Cybersecurity Threats to Small & Medium Businesses

SMBs are not caught in the crossfire of attacks aimed at enterprises — they are increasingly the intended target. Verizon’s 2025 DBIR found that SMBs experienced approximately four times more confirmed breaches than large organizations. RaaS groups rent sophisticated infrastructure, automation handles scale, and SMBs typically lack dedicated security teams to respond.

5 AI-Powered Attacks & AI-Driven Defense

83% of phishing emails are now AI-generated, removing the grammar and spelling errors that training programs relied on for years. Organizations deploying AI on the defensive side see compelling ROI: IBM’s 2025 data shows AI security tool users saved nearly $1.9 million per breach and contained incidents 80 days faster. Only 11% of SMBs have made that investment.

IBM Cost of a Data Breach 2025 →

See CNiC’s AI-Enhanced IT Services →

6 Cybersecurity Spending & Workforce

Global cybersecurity spending accelerates 13.3% in 2026 — the fastest growth rate in years. The workforce story is equally significant: the profession needs to grow 87% to meet current demand, and organizations with understaffed security teams pay an average of $1.76 million more per breach. For companies that can’t hire and retain specialized security talent, managed IT and virtual CIO services represent the operational bridge.

*ISC2 declined to publish a new workforce gap estimate in 2025, noting skills shortages now outweigh headcount shortages as the primary constraint. The 4.76M figure is the most recent published estimate.

Gartner Security Spending Forecast →  |  ISC2 2025 Workforce Study →

Learn about Virtual CIO Services →

Cybersecurity by the Numbers: Summary

Frequently Asked Questions

Methodology & Sources

David McFarlane Founder & CEO

As Founder and CEO of CNiC Solutions, David McFarlane has spent more than 15 years guiding Houston-area organizations through complex IT and cybersecurity challenges. His hands-on leadership ensures technology decisions align with business goals, risk management, and operational efficiency.

See Full Bio

IT Services Network Cabling Cloud Solutions Cybersecurity Data Backup & Recovery Managed IT Services Infrastructure Management Telecommunications Virtual CIO (vCIO) WebRTC