2025 Information Risk Insights Study: It’s About Time

IRIS 2025 tests a common assumption in security, that cyber risk only ever goes up, against public incident and loss records from 2008 through 2024. Median losses are up 15x since 2008, to almost $3M, but the trend isn’t the same for every firm.

The data mostly supports that assumption, but the details matter for anyone building a risk model. The chance of an incident has climbed sharply for small and midsize firms while easing for the very largest. Loss trends also point in opposite directions depending on incident type and sector (ransomware costs have soared, while the biggest system intrusions cost far less than they used to). The report’s argument is that risk estimates should reflect an organization’s own size, sector and threat profile rather than a single industry-wide trend line.

The full report gives updated likelihood and loss figures by sector and revenue tier and uses MITRE ATT&CK to track how attackers’ initial access methods have shifted. Its final section compares the historical record with 2024 events collected by Feedly, showing what headline-driven sources pick up before official records catch up.

Key Findings

Sixfold Rise in Incidents: About 3,000 significant incidents are publicly reported each quarter, up from roughly 450 per quarter 15 years ago.
Probability Nearly Quadrupled: A typical organization’s modeled annual chance of a significant incident rose from about 2.5% in 2008 to over 9%.
15x Median Loss Increase: The median loss per incident rose from $190K to almost $3M over 15 years, adjusted to 2024 dollars.
8x Loss Relative to Revenue: Median losses as a share of the victim’s annual revenue grew nearly 8x, from 0.08% to 0.65%.
Credentials Still Lead: Valid Accounts (e.g., compromised credentials) has been the top initial access technique since 2016, appearing in 43% to 60% of incidents.
6x Web App Exploitation: Exploits of public-facing applications rose about 6x among firms under $100M, while trusted-relationship attacks doubled among $10B+ firms.

Cover of 2025 Information Risk Insights Study: It's About Time

Independent analysis by Cyentia Institute, with support from CISA, of public incident and loss records from Zywave’s Cyber Loss Data spanning 2008 through 2024, plus 2024 events from Feedly.

Key Risk Insight

Cyber incidents are more frequent and costlier than 15 years ago, but the trends differ by firm size, sector and incident type. Risk estimates built on industry-wide averages can misstate exposure for many organizations.

Cite this report: Cyentia Institute (2025). 2025 Information Risk Insights Study: It’s About Time. https://www.cyentia.com/publication/iris2025/

Download

Number of security incidents publicly reported or discovered each quarter (IRIS 2025 member infographic, based on Figures 1 and 18). About 3,000 significant incidents now reach the public record each quarter, more than six times the rate of 15 years ago.
Figure 6: Historical probability of a firm having an incident in the next year. The chance that a typical firm suffers a significant incident has almost quadrupled in 15 years, though the rest of the report shows how much that varies by size and sector.
Figure 10: Trend analysis of median and 90th percentile losses. Typical losses have grown much faster than extreme ones, so loss estimates anchored on older data likely understate the cost of an ordinary incident.
Incident costs have risen sharply (IRIS 2025 member infographic). The median loss per incident is up 15x since 2008, to nearly $3M in 2024 dollars.
Figure 11: Trend analysis of median and 95th percentile losses as a percent of revenue. The typical loss is still well under 1% of revenue but has grown nearly 8x relative to firm size, and the worst 5% of events continue to exceed the victim’s annual revenue.
Losses relative to revenue are up about 8x (IRIS 2025 member infographic), from a median of 0.08% of annual revenue in 2008 to 0.65%.
Figure 16: Prevalence of ATT&CK Initial Access techniques observed in incidents over time. Compromised credentials have held the top spot for nine years, while web application exploits and exposed remote services have climbed from single digits.
Credentials are the weak link (IRIS 2025 member infographic). Valid Accounts has been the top initial access technique since 2016, showing up in 43% to 60% of incidents with an identified technique.
Figure 17: Prevalence of ATT&CK Initial Access techniques observed by revenue tier. Smaller firms see far more web application exploitation than they used to, while the largest firms see more attacks through trusted third parties, so the techniques worth prioritizing depend on the organization’s size.
Small firms are at greater risk (IRIS 2025 member infographic). The modeled chance of an incident has more than doubled for firms under $1B in revenue while easing for the very largest.
Relative frequency of incident patterns over time (IRIS 2025 member infographic, Figure 2). Ransomware’s rise since 2019 is unprecedented, while accidental disclosure has dropped sharply.
Proportion of all incidents in each revenue tier (IRIS 2025 member infographic, Figure 3). Small and midsize firms make up a growing share of reported incidents.
Distribution of reported losses for security incidents, 2015 to 2024 (IRIS 2025 member infographic, Figure 9). The typical incident costs around $600K, but the long tail pulls the average up to $14M, which is why averages make poor loss estimates.
Sector trends diverge (IRIS 2025 member infographic). Median losses for professional services firms are up 25x over 15 years, while retail has seen a large decrease.
Comparison of reported financial losses from incidents by source (IRIS 2025 member infographic, Figure 19). Headline-driven sources like Feedly pick up mostly the largest events, so their losses run far higher than the full historical record.

Get exclusive content, sector-specific updates, and expert commentary

Testimonials

“Cyentia delves into cyber risk, helping companies assess the frequency and severity they may face by providing industry data, averages, highs/lows and much more. This is crucial for any risk leader starting on a risk quantification journey. The Cyentia report has also become incredibly valuable for the Cyber Insurance industry.”
Isabelle Dumont, Tech B2B Leader
“One of the few reports I read cover to cover. IRIS 2025 from the Cyentia Institute team is, once again, a standout contribution. I’ve always appreciated their commitment to letting the data speak for itself. No hype, no sensationalism—just a clear-eyed attempt to map the cyber loss landscape using what’s actually observable.”
James Hanbury, Global Lead Director, Cyber Risk Insights at KPMG
“The latest Cyentia Institute IRIS 2025 report is out now! It’s a goldmine of data for quantitative risk work. Evidence-based incident probabilities, empirical loss distributions, attack pattern intelligence—this is what mature risk management looks like. Cyentia’s research gives us the statistical foundation our quantitative models need.”
Tony Martin-Vegue, Technology Risk Management at Netflix
“Just finished the Cyentia Institute’s IRIS and again I find myself in awe at the elite level of objective risk insight this report continuously provides. Beginning with base rate information before taking a plunge into the unique details of our individual case improves the quality of our risk assessment outcomes in multiple ways.”
Zach Cossairt, Decision Support at Equinix

Need an IRIS Focused on Your Organization?

That’s exactly what our Retina risk intelligence service provides. You get a report on key cyber risk factors for your peer group, along with monthly data and analysis to monitor prevailing trends.

Learn More