2025 Ripples Across the Risk Surface
Partner: RiskRecon by Mastercard
The 2025 edition of Ripples Across the Risk Surface examines more than 1,500 multi-party incidents to see how breaches spread to third parties and who pays. Firms that generate these ripple events take a median loss of $4.7M, about 10x more than incidents contained to a single firm. The analysis with RiskRecon by Mastercard covers 2008 to 2024 and more than 12,000 receiving firms.
Ripple events are much rarer than single-party incidents, which makes them easy to underweight in a risk assessment. The firm at the center still carries most of the total cost, but the firms caught downstream have been losing more over time and now take per-firm losses on par with the originator. Size matters too, though not the way raw counts suggest. Most ripple victims are small firms simply because most firms are small, and once that’s accounted for, the largest organizations turn out to be the most likely to be involved.
For third-party risk teams, the full report maps how ripple impacts flow between revenue bands and sectors, relative to what random connections would produce, and models which kinds of firms are most likely to generate or receive them. It also compares the threat actors and incident patterns behind ripple events with those behind single-party incidents.
Key Findings
- 10x Generator Losses: Firms that generate ripple events have median per-firm losses of $4.7M, 10x the $469.1K median for single-party incidents.
- 14x Extreme Losses: At the 95th percentile, generator losses reach $371.0M per firm, 14x the $26.5M for single-party incidents.
- Receivers Catching Up: Per-firm losses for downstream ripple receivers have risen over time and now roughly match those of generators.
- 2x Likelihood for $10B+ Firms: Adjusted for firm counts by revenue band, $10B+ organizations are about twice as likely to generate and receive ripples.
- Sector Exposure Differs: Finance, Healthcare and Education receive more than their share of ripples; Finance, Public and Utilities generate more than theirs.
- Different Threat Profile: Hacktivists, nation-states and criminal individuals appear far more often in ripple incidents, as do DoS attacks, fraud and defacement.
Collaborative analysis by Cyentia Institute and RiskRecon by Mastercard of more than 1,500 multi-party ripple incidents from Cyentia’s incident and loss dataset, involving over 12,000 receiving firms from 2008 to 2024.
Key Risk Insight
A breach at a vendor or partner can now cost each affected downstream firm about as much as it costs the firm that was breached. Third-party risk budgets and loss scenarios should reflect that, especially for large organizations.
Cite this report: Cyentia Institute and RiskRecon by Mastercard (2025). 2025 Ripples Across the Risk Surface. https://www.cyentia.com/publication/2025-ripples-across-the-risk-surface/