Business security spans cyber incidents, fraud, physical violence, injuries, and fatal work events. The figures below distinguish observed reports from study estimates, identify their populations and periods, and keep incident counts separate from prevalence rates.
Key Business Security Statistics
The most useful headline figures include:
- 22,052 security incidents were analyzed in Verizon’s 2025 DBIR for organizations in 139 countries from November 1, 2023, through October 31, 2024.
- 12,195 confirmed data breaches were included in that same Verizon DBIR period among organizations in 139 countries.
- Credential abuse appeared in 22% of confirmed breaches in the 2025 DBIR’s global organization dataset from November 1, 2023, through October 31, 2024.
- Vulnerability exploitation appeared in 20% of confirmed breaches in the 2025 DBIR period among global organizations.
- Human involvement remained present in nearly 60% of confirmed breaches in Verizon’s 2025 DBIR period among global organizations.
- Ransomware or extortion appeared in 44% of confirmed breaches in the 2025 DBIR period among global organizations.
- The median ransomware or extortion loss was $46,000 per breach in Verizon’s 2024 DBIR analysis of global cases with FBI IC3 loss data.
- The median ransom paid was $115,000 per business ransomware incident in Verizon’s 2024 analysis of business ransomware incidents.
- The estimated global average data-breach cost was $4.88 million per breach in IBM’s 2024 study of breached organizations.
- Global organizations averaged 194 days to identify a breach in IBM’s 2024 study.
- IC3 recorded 305,033 business-email-compromise incidents from October 2013 through December 2023 in domestic and international reports.
- BEC exposed loss totaled $55,499,915,582 from October 2013 through December 2023 in domestic and international IC3 and financial-institution reports.
- US private-industry employers reported 2.6 million nonfatal workplace injuries and illnesses in 2023.
- The private-industry total-recordable-case rate was 2.4 cases per 100 FTE workers in the United States in 2023.
- Workplace violence caused 57,610 nonfatal DART cases in US private industry over 2021–2022.
- The United States recorded 5,283 fatal work injuries across all workers in 2023.
- Private industry recorded 4,838 fatal work injuries in the United States in 2023.
Contents
- Business security incident and breach scale
- Business cybersecurity access paths and attack patterns
- Ransomware and extortion business statistics
- Business security costs, detection, and recovery
- Business email compromise and reported cybercrime losses
- Workplace safety and violence data
- Business-sector injury and fatality statistics
Business Security Incident and Breach Scale
Verizon’s 2025 Data Breach Investigations Report analyzed 22,052 real-world security incidents involving organizations in 139 countries from November 1, 2023, through October 31, 2024. Of these, 12,195 were confirmed data breaches.
The DBIR is an incident-response and publicly disclosed case dataset, not a census of every business or a prevalence rate. Its confirmed-breach count should therefore remain distinct from its broader incident count.
| Verizon DBIR measure | Period and population | Count |
|---|---|---|
| Security incidents | Nov. 1, 2023–Oct. 31, 2024; organizations in 139 countries | 22,052 |
| Confirmed data breaches | Same period and population | 12,195 |
| Security incidents | 2023; global organizations | 30,458 |
| Confirmed breaches | 2023; global organizations | 10,626 |
The 2025 figures come from Verizon’s 2025 DBIR Small- and Medium-Sized Business Snapshot, while the prior-year figures come from the 2024 Data Breach Investigations Report. The 2024 DBIR figures are confirmed cases in Verizon’s dataset, not all global breaches.
Business Cybersecurity Access Paths and Attack Patterns
The 2025 DBIR classified credential abuse as the initial access vector in 22% of confirmed breaches and vulnerability exploitation in 20% for global organizations during November 1, 2023–October 31, 2024. Vulnerability exploitation increased 34% from the prior DBIR, while the 2024 DBIR reported a 180% increase from 2022 to 2023, partly tied to the MOVEit campaign.
| Access or involvement measure | Period | Share or change |
|---|---|---|
| Credential abuse as initial access | 2025 DBIR period; global organizations | 22% |
| Vulnerability exploitation as initial access | 2025 DBIR period; global organizations | 20% |
| Vulnerability exploitation year-over-year change | 2025 DBIR versus 2024 DBIR | +34% |
| Human involvement | 2025 DBIR period; global organizations | Nearly 60% |
| Third-party involvement | 2023; global organizations | 15% |
These measures are not mutually exclusive: Verizon’s 2025 DBIR release notes that DBIR classifications can overlap. The 2024 report also found that phishing accounted for 14% of breaches involving credentials in 2023, a denominator limited to credential-involved breaches.
In Verizon security-awareness simulations during 2023, 20% of participating users reported the simulated phishing message. Among users who clicked, 11% also reported it; these partner-contributed simulations are not a representative workforce survey.
The relevant source is the 2024 Data Breach Investigations Report.
Ransomware and Extortion Business Statistics
Ransomware or extortion appeared in 44% of confirmed breaches in the 2025 DBIR period, an increase of 37% from the prior DBIR. Verizon combines ransomware with related extortion activity in this measure, so it is not identical to a count of ransomware-only events.
The 2024 DBIR reported ransomware in 32% of confirmed breaches in 2023 and listed ransomware among the top threats in 92% of industries covered. Separately, ODNI-reported ransomware attacks totaled 2,321 globally during January–June 2024; reporting coverage may vary.
| Ransomware measure | Period and population | Result |
|---|---|---|
| Ransomware or extortion in breaches | Nov. 1, 2023–Oct. 31, 2024; global organizations | 44% |
| Ransomware presence change | 2025 DBIR versus 2024 DBIR | +37% |
| Ransomware in breaches | 2023; global organizations | 32% |
| Median loss for ransomware and extortion breaches | 2023; cases with FBI IC3 loss data | $46,000 |
| Median ransom paid | 2024; business ransomware incidents | $115,000 |
The 2024 DBIR placed the central 95% loss range for ransomware and other extortion cases at $3 to $1,141,467 per breach, based on cases with FBI IC3 loss data. These are reported-loss measures and do not describe a guaranteed business outcome.
Sources: 2025 DBIR release and 2024 DBIR.
Business Security Costs, Detection, and Recovery Timelines
IBM estimated the 2024 global average data-breach cost at $4.88 million per breach, up from $4.45 million in 2023. This is a study estimate from interviewed breached organizations, not an accounting total for every business.
Financial-industry organizations averaged $6.08 million per breach in 2024, which IBM stated was 22% higher than the global average. Breaches affecting at least 50 million records averaged $375 million in healthcare and finance, a subset of very large incidents rather than a typical breach.
| IBM 2024 measure | Population | Estimate |
|---|---|---|
| Average breach cost | Global organizations | $4.88 million |
| Average breach cost | Financial industry | $6.08 million |
| Identification time | Global organizations | 194 days |
| Containment time after identification | Global organizations | 64 days |
| Identification time | Financial industry | 168 days |
| Containment time after identification | Financial industry | 51 days |
IBM’s 2024 financial-industry analysis classified 51% of attacks as malicious, 25% as IT failures, and 24% as human error. Historical financial-industry estimates were $5.72 million in 2021, $5.97 million in 2022, and $5.9 million in 2023.
See IBM’s Cost of a Data Breach 2024: Financial Industry.
Business Email Compromise and Reported Cybercrime Losses
The FBI’s Internet Crime Complaint Center recorded 305,033 BEC incidents from October 2013 through December 2023 in domestic and international reports. BEC refers to fraudulent transfer-of-funds requests targeting legitimate accounts, and IC3 figures undercount unreported crime.
| IC3 BEC measure | Period and geography | Reported result |
|---|---|---|
| BEC incidents | Oct. 2013–Dec. 2023; domestic and international reports | 305,033 |
| Exposed dollar loss | Same period; domestic and international reports | $55,499,915,582 |
| US victim exposed loss | Same period; US victims | $20,089,561,364 |
| Non-US victim exposed loss | Same period; non-US victims | $1,638,490,375 |
| US financial-recipient exposed loss | Jun. 2016–Dec. 2023 | $17,499,104,054 |
| Non-US financial-recipient exposed loss | Jun. 2016–Dec. 2023 | $8,953,920,759 |
Exposed loss is not the same as recovered loss, and victim reports can differ from financial-recipient reports. The figures and definition are from the FBI’s Business Email Compromise: The $55 Billion Scam.
In IC3’s 2024 three-year comparison, restricted to complaints with losses of at least $60, reported losses were $385,001,099 for business email compromise, $28,546,213 for data breaches, $254,187,196 for personal-data breaches, $20,202,521 for phishing or spoofing, and $37,882,347 for employment crime. These complaint-based figures come from the 2024 IC3 Annual Report.
Workplace Safety and Violence Data for Businesses
US private-industry employers reported 2.6 million nonfatal workplace injuries and illnesses in 2023, down 8.4% from 2022. The employer-reported total excludes unreported cases and fatalities.
| Private-industry safety measure | US period | Result |
|---|---|---|
| Nonfatal injuries and illnesses | 2023 | 2.6 million cases |
| Illness cases | 2023 | 200,100; down 56.6% |
| Respiratory-illness cases | 2023 | 100,200; down 72.6% |
| Total-recordable-case rate | 2023 | 2.4 per 100 FTE workers |
| Days-away cases | 2023 | 946,500 |
| Days-away case rate | 2023 | 0.9 per 100 FTE workers |
The BLS rate is an incidence-rate measure, not an individual worker’s probability. The 2023 figures are from Employer-Reported Workplace Injuries and Illnesses—2023.
Workplace violence caused 57,610 nonfatal DART cases in US private industry over 2021–2022. The annualized rate was 2.9 cases per 10,000 FTE employees per year; DART means days away, restriction, or transfer, and the measure covers intentional injury by another person.
Source: BLS Workplace Violence, 2021–2022.
Business-Sector Injury and Fatality Statistics
The United States recorded 5,283 fatal work injuries across all workers in 2023, including 4,838 in private industry. Within private industry, violent acts accounted for 627 fatal injuries, using the BLS category that includes violence by persons and self-inflicted injury.
| Industry or category | Fatal work injuries, 2023 | Violent-act fatal injuries, 2023 |
|---|---|---|
| US private industry | 4,838 | 627 |
| Retail trade | 306 | 123 |
| Gasoline stations | 44 | 22 |
| General merchandise retailers | 36 | — |
| Financial activities | 113 | — |
These are BLS CFOI counts, not rates and not measures of all workplace violence. The industry figures are from BLS Table A-1: Fatal occupational injuries by industry and event or exposure, 2023.