Cybersecurity Facts and Stats: What the Numbers Mean

An alarming cybersecurity infographic is most useful when it shows the scale of attacks without confusing estimates, survey findings, and confirmed incidents. The figures below draw on named, checkable reports and explain what each measure can—and cannot—tell you about cyber risk.

Why cybersecurity statistics need context

Cybersecurity is not one measurable event. A “breach” may mean unauthorized access to data, while an “incident” can include attempted attacks that did not expose information. Reports also differ in who they survey, what they count, and how much evidence they can verify. A striking number without a date, population, or definition is therefore hard to interpret.

For a dependable infographic, identify the source and publication year beside every statistic. Separate observed records from estimates and survey responses. A survey about how many organizations experienced attacks is not the same as a count of all attacks worldwide, and a rise in reported incidents can reflect improved detection or reporting as well as more criminal activity.

Data breaches: what the major reports measure

Verizon’s 2024 Data Breach Investigations Report (DBIR) analyzed 30,458 security incidents, of which 10,626 were confirmed data breaches. Its cases came from organizations and data contributors across multiple sectors and countries; they are not a census of every cyber event. The report found that the human element was involved in 68% of breaches in its dataset, including errors, misuse, stolen credentials, and social engineering.

That “human element” figure is often misread as proof that people are the problem. It instead points to how attackers exploit routine work and organizational processes. A convincing fake login page, an incorrectly configured system, or credentials reused after a separate service is compromised can turn ordinary activity into an entry point. Training can help, but technical controls—such as multifactor authentication and access restrictions—also matter.

IBM’s 2024 Cost of a Data Breach Report put the global average cost of a breach in its study at US$4.88 million, up 10% from the prior year. This is a modeled average based on a sample of organizations that experienced breaches, not a bill every victim receives or a prediction for a particular company. Costs vary with the organization, incident, recovery needs, and the report’s methodology.

Ransomware and the changing attack surface

Ransomware encrypts or disrupts access to data and systems, often alongside theft and threats to publish stolen information. The FBI’s Internet Crime Complaint Center (IC3) received 3,860 ransomware complaints in 2023, with reported losses exceeding US$59.6 million. IC3 cautions that its figures reflect complaints submitted to the bureau; they do not represent every victim or all losses, and reported losses may not capture the full impact.

Ransomware is not the only way criminals profit. Business email compromise, credential theft, fraudulent payment instructions, and extortion without encryption can cause serious damage. Backups help restore operations, but they need to be protected from attackers and tested. A backup that is connected with the same permissions as everyday systems may be damaged in the same attack.

Cloud services, mobile devices, remote access, suppliers, and internet-connected equipment widen the number of places organizations must secure. This does not mean that using cloud services is inherently unsafe. It means responsibility is shared: providers protect parts of the service, while customers still need to manage accounts, permissions, devices, configurations, and data appropriately.

Phishing, passwords, and human behavior

Phishing messages imitate trusted people or organizations to persuade recipients to open a link, share credentials, or approve a payment. They may arrive by email, text, phone call, or collaboration tools. Generative tools can make messages more fluent, but deception does not depend on perfect writing: urgency, authority, familiar branding, and unexpected requests remain useful warning signs.

Passwords are especially risky when reused. If one service is breached, criminals may try the same credentials elsewhere. Use a password manager to create and store unique passwords, and turn on multifactor authentication where available. Passkeys, when supported, can reduce exposure to password phishing by using cryptographic credentials tied to the service and device.

• Pause before acting on an unexpected request for money, credentials, or a security-code approval.
• Verify sensitive requests through a separate, known contact method rather than replying to the message.
• Use multifactor authentication, preferably a phishing-resistant option when an organization supports one.
• Report suspicious messages through your workplace or service provider’s established process.

How to make an accurate cybersecurity infographic

A strong infographic makes comparisons fair and the source easy to check. Include the report name, publisher, publication year, geography, and a short definition of the metric. If a statistic covers a sample, call it a sample; if it is a complaint count, do not label it the total number of attacks.

• Label the unit: distinguish incidents, confirmed breaches, complaints, affected records, and dollars.
• Keep time periods consistent: do not compare one calendar year with a different-length survey period without saying so.
• Show denominators: “68% of breaches in this report” is more informative than “68% of cyberattacks.”
• Explain uncertainty: estimates and survey answers should not be presented as exact global counts.
• Link to the source: readers should be able to inspect definitions and methodology.

Avoid turning a statistic into an unsupported forecast. For example, a high average breach cost does not establish that a particular organization will lose that amount. Nor does a year-over-year increase automatically prove that security is getting worse; changes in sample composition, detection, and reporting can affect results.

What the numbers mean for practical security

Statistics help prioritize attention, but basic measures can reduce common risks without requiring a prediction about the next attack. Individuals can keep devices and software updated, use unique passwords, enable multifactor authentication, and maintain separate backups of important files. Organizations can apply least-privilege access, patch exposed systems, monitor accounts, prepare incident-response plans, and rehearse recovery.

No single control prevents every incident. Multifactor authentication can be bypassed or socially engineered in some circumstances; backups do not stop data theft; and training cannot compensate for every unsafe system design. Layered defenses make an attack harder and can limit its impact. The right priorities depend on the systems and information being protected.

Frequently Asked Questions

What is the most common cause of cyberattacks?
There is no universal answer because reports classify events differently. Verizon’s 2024 DBIR found a human element in 68% of the confirmed breaches it analyzed, but that category includes several behaviors and is not a global count of attack causes.

How much does a data breach cost?
Costs vary widely. IBM reported a US$4.88 million global average in its 2024 study, but that is a sample-based average, not a reliable estimate for any individual organization.

Are ransomware attacks increasing?
Whether they appear to increase depends on the measure and period. The FBI’s IC3 received 3,860 ransomware complaints in 2023; complaint totals omit incidents that were never reported and should not be treated as a complete global trend.

Does multifactor authentication stop phishing?
It can make stolen passwords less useful, but protection varies by method. Phishing-resistant authentication is stronger against fake sign-in pages than codes that a user can be tricked into sharing.

Can an infographic statistic predict my risk?
No. Population-level figures describe a report’s dataset or sample. Your risk depends on factors such as the accounts, devices, data, safeguards, and threats relevant to you.

Related

• Clear Slicer Filter: What It Is & How to Use
• Document Could Not Be Saved You Don’t Have Permission? Fix
• Count Duplicate Values in Excel Column