Could we have multiple security incidents in a single year?

Note: This post was initially published on June 6, 2025, for Cyentia Institute members, along with several other posts that provide additional analyses, charts, and statistics related to IRIS 2025. If you’d like access such content when it’s hot off the press, sign up for a FREE Cyentia membership.

Our analysis of probability in the IRIS 2025 focused on the likelihood of experiencing at least one security incident within a year. It’s possible, of course, for organizations to suffer more than one loss event in that timeframe, and veteran IRIS readers may recall that prior studies included a table of probabilities for at least one, two, and three incidents in a 12-month period. Those readers may be disappointed upon realizing updated tables are missing from the latest IRIS. If that describes you, this should ease your disappointment.

For the record, here’s the table presented in the IRIS 2022:

Loss Event Frequency table from IRIS 2022

We decided not to include multi-incident probabilities in this edition because a) it’s already a long report, and b) feedback suggested most cyber risk tools and models focused on the likelihood of having a single event. Once we added the long-term trending element to the IRIS 2025, we just felt the added complexity was detrimental to the whole. Having said that, we continue to believe that accounting for multiple events in a single year in your probability models is more fitting with reality. This post should help demonstrate that and give you some estimates to work with if you’re into that kind of thing like we are.

The table below updates the loss event frequency estimates based on our latest data and models. It’s immediately apparent that the probabilities have gone up substantially, which shouldn’t be too much of a shock if you’ve read the IRIS 2025. It also drops the lower bound estimates for reasons I won’t delve into in this post.

Loss Event Frequency table with updated data as of IRIS 2025 release (June 2025)

I’ll close in the (slightly modified) words of Effie Trinket: “May the odds (of having multiple cyber events in a year) be ever in your favor!”