Information Risk Insights Study: Xtreme Edition, 2026

The IRIS Xtreme examines the costliest 5% of security incidents from the past five years to help organizations weather the storm of extreme cyber events. The 136 incidents in this edition account for $26.4 billion in reported financial losses, with 3 out of 10 costing more than the affected company’s annual revenue.

It’s tempting to treat extreme events as ordinary breaches with more zeros, but the data says they’re structurally different. Data exposure defines most security incidents, while extreme events are far more often about disruption and fraud. The number of records stolen tells you essentially nothing about the eventual cost. Third parties rarely act as the attacker, yet they’re tied up in a large share of the worst losses, and stolen credentials open the door far more often than novel exploits. A program built around the most common incidents can leave the costliest ones underweighted.

The full report adds loss benchmarks by revenue band, simulations of how likely an organization is to face an extreme loss, a breakdown of secondary impacts such as supply chain disruption and bankruptcy, and a first look at 205 incidents disclosed in SEC 8-K filings. It closes with a practitioner’s guide to using these numbers for loss planning, threat prioritization and cyber insurance.

Key Findings

19x Growth in Tail Losses: The 95th percentile of incident losses rose from $14.7M in 2008 to $281.3M today, adjusted for inflation.
29% Exceed Annual Revenue: Nearly 3 in 10 extreme events cost more than the victim’s annual revenue; crypto exchange hacks produce the most lopsided ratios.
5x Disruption Surge: Disruption is the primary outcome for 43% of extreme events versus 8% of all incidents; data exposure drops from 91% to 33%.
91% of Losses via Valid Accounts: Compromised credentials were the initial access vector in 58% of extreme events and tied to 91% of losses.
61% of Records via Known CVEs: Known vulnerabilities were exploited in just 18% of extreme events but account for 61% of stolen records.
Third Parties in Half of Losses: Third parties directly caused 2% of extreme events but contributed indirectly to a third of events and half of losses.
Only 6% of 8-K Incidents Material: Of 205 cyber incidents disclosed in SEC 8-K filings, filers assessed just 6% as material or likely material.

Independent analysis by Cyentia Institute of 136 extreme cyber events over five years from Zywave Cyber Loss Data, enriched with Feedly threat intelligence and Board Cybersecurity’s SEC 8-K data.

Key Risk Insight

Extreme cyber losses are growing faster than typical ones, and they skew toward disruption and fraud (often with a third party involved) rather than the data breaches most security programs are built around. Loss scenarios and insurance limits set a few years ago likely understate today’s tail.

Cite this report: Cyentia Institute (2026). Information Risk Insights Study: Xtreme Edition, 2026. https://www.cyentia.com/publication/iris-xtreme-2026/

Download

Figure 2: Trend analysis of median (50th) and 95th percentile losses for all incidents. Tail losses have grown about 19x since 2008 after adjusting for inflation, faster than typical losses (about 12x). A loss estimate that looked reasonable a few years ago probably understates today’s tail.
Figure 8: Extreme event losses as a percentage of annual revenue. Nearly 3 in 10 extreme events cost more than the victim’s annual revenue. Crypto exchange hacks produce the most lopsided ratios, but plenty of non-crypto events land above 100% too.
Figure 9: Proportion of all incidents (left) and extreme events (right) by primary outcome. Data exposure dominates incidents overall, but disruption and fraud make up about two-thirds of extreme events. Defenses tuned to the most common incidents won’t necessarily cover the costliest ones.
Figure 13: Frequency of secondary impacts. Nearly half of extreme events reached into the victim’s supply chain, and those events account for 55% of associated losses. The damage often doesn’t stay with the organization that was hit first.
Figure 17: Third parties as indirect contributors to extreme events. Third parties were the primary actor in only 2% of extreme events, but stolen third-party credentials, trusted access and shared infrastructure played a part in a third of events and half of all losses.
Table 3: Initial access techniques observed in extreme events; multiple techniques may apply to an incident, so columns may not sum to 100%. Compromised credentials opened the door in 58% of extreme events and tie to 91% of losses, which puts identity and access management at the center of preventing them.
Figure 20: Common threat observations among extreme events. Exploits of known vulnerabilities showed up in only 18% of extreme events but account for 61% of stolen records, and most of those CVEs had patches available.

Get exclusive content, sector-specific updates, and expert commentary

Testimonials

“Cyentia delves into cyber risk, helping companies assess the frequency and severity they may face by providing industry data, averages, highs/lows and much more. This is crucial for any risk leader starting on a risk quantification journey. The Cyentia report has also become incredibly valuable for the Cyber Insurance industry.”
Isabelle Dumont, Tech B2B Leader
“One of the few reports I read cover to cover. IRIS 2025 from the Cyentia Institute team is, once again, a standout contribution. I’ve always appreciated their commitment to letting the data speak for itself. No hype, no sensationalism—just a clear-eyed attempt to map the cyber loss landscape using what’s actually observable.”
James Hanbury, Global Lead Director, Cyber Risk Insights at KPMG
“The latest Cyentia Institute IRIS 2025 report is out now! It’s a goldmine of data for quantitative risk work. Evidence-based incident probabilities, empirical loss distributions, attack pattern intelligence—this is what mature risk management looks like. Cyentia’s research gives us the statistical foundation our quantitative models need.”
Tony Martin-Vegue, Technology Risk Management at Netflix
“Just finished the Cyentia Institute’s IRIS and again I find myself in awe at the elite level of objective risk insight this report continuously provides. Beginning with base rate information before taking a plunge into the unique details of our individual case improves the quality of our risk assessment outcomes in multiple ways.”
Zach Cossairt, Decision Support at Equinix

Need an IRIS Focused on Your Organization?

That’s exactly what our Retina risk intelligence service provides. You get a report on key cyber risk factors for your peer group, along with monthly data and analysis to monitor prevailing trends.

Learn More