Information Risk Insight Study 2025

Key Findings

• Incidents Are Increasing Rapidly
  The average number of significant security incidents reported each quarter has grown by 650% over the last 15 years. This highlights a pressing need for organizations to proactively manage their exposure and preparedness.

• Probability of Experiencing a Cyber Event Is Much Higher
  The annual likelihood that an organization will experience a cyber event has almost quadrupled since 2008. For small and midsize businesses, this probability has more than doubled. Business leaders should recognize that risk is widespread and rising across the board.

• Financial Impact of Incidents Has Risen Sharply
  The median loss from a security incident has increased 15-fold, from $190,000 to nearly $3 million. Losses from extreme events have grown to $32 million. Cyber risk now represents a major financial exposure for organizations of all sizes.

• Large Enterprises Are Disproportionately Targeted
  While small businesses see the largest number of incidents in absolute terms, the rate of incidents among the largest corporations is 620 times higher when adjusted for the number of organizations. The scale and complexity of large organizations attract more targeted and persistent attacks.

• Attack Methods and Threat Vectors Are Evolving
  Credential compromise remains the most common entry point, but attacks exploiting web applications have increased sixfold for smaller firms, and incidents involving third-party relationships have doubled for large organizations. Leaders should ensure that security programs address the most current and relevant attack methods.