Top Cybersecurity Statistics for 2025

Our 2025 cybersecurity statistics show a continuation of trends we identified in our top cybersecurity statistics for 2024, with AI accelerating existing tendencies. As cybercriminals diversify and optimize their tactics, the cost of cybercrime keeps rising, on track to reach a staggering $15.63 trillion by 2029. Increasing ransomware attacks on key industries, sophisticated phishing schemes, and regulatory tightening serve as stark reminders of the need for vigilance and adoption of advanced technologies to stay ahead of emerging threats.

Below are over 100 cybersecurity statistics to provide a look at what we can expect in 2025 if current trends hold.

Cost and Frequency of Cyber Attacks

Worldwide cybercrime costs are estimated to hit $10.5 trillion annually by 2025, emphasizing the need for enhanced cybersecurity measures (Statista).
Cybercrime losses reported to the FBI's Internet Crime Complaint Center (IC3) increased 22% between 2022 and 2023 (Federal Bureau of Investigation).
In 2024, the global average cost of a data breach was $4.88 M.(IBM).
Breach costs increased 10% from 2023, the highest increase since the pandemic. (IBM)
The second quarter of 2024 saw a 30% increase in cyberattacks compared to Q2 2023, the highest increase in the last two years (Check Point Research).
70% of data breaches caused significant or very significant disruptions. (IBM)
Global cyber insurance premiums are projected to grow from $14 billion in 2023 to $29 billion by 2027 (Munich RE)
When remote work is a factor in causing a data breach, the average cost per breach is $173,074 higher, underscoring the cybersecurity challenges in the evolving work landscape (IBM).

Ransomware Statistics

59% of all organizations were hit by ransomware attacks over the last year (Sophos).
Ransomware costs are projected to reach around $265 billion USD annually by 2031, significantly up from $20 billion in 2021 (Cybersecurity Ventures).
Ransomware attacks increasingly target organizations of all sizes, with 47% of organizations with revenue under $10 million reporting attacks over the past year (Sophos).
Industries targeted by ransomware attackers are led by healthcare, financial services, industrial, technology, and energy (IBM).
Ransomware attacks targeting manufacturers rose to 29% of publicly extorted victims globally in Q2 2024, a 56% year-over-year increase (Check Point).
Nearly half (47%) of companies have a policy to pay ransoms associated with cybersecurity threats (CFO).
62% of C-suite leadership see ransomware as the number one concern (CFO).
Ransomware recovery costs averaged $3.58 million (Sophos).
63% of ransomware attackers demanded $1 million or more, and 30% demanded over $5 million (Sophos).
Ransomware bills increased five times over the last year (Sophos).
Exploited vulnerabilities represented the most common ransomware attack vector, followed by compromised credentials and malicious emails (Sophos).
63% of organizations that involve law enforcement avoid paying ransomware costs (IBM).
Organizations that involve law enforcement save an average $1 million in ransomware payments (IBM).

Phishing Statistics

Phishing represents the most common email attack method, accounting for over a third of cyberattacks (Hornetsecurity).
Phishing accounts for 33% of cloud-related security incidents, which typically deploy adversary-in-the-middle (AitM) attacks (IBM).
Attackers most frequently impersonate shipping brands such as DHL and FedEx, with other brands seeing increased impersonations including DocSign, Facebook, Mastercard, and Netflix (Hornetsecurity).
Malicious file types are led by HTML, PDFs, and archive files (Hornetsecurity).
Use of malicious file types has decreased as attackers have shifted to reverse-proxy credential theft attacks that redirect users to fake log-in pages (Hornetsecurity).
25% of business email compromise (BEC) attacks in Q1 2024 targeted organizations that did not have multi-factor authentication (MFA), compared to 58% in 2023, reflecting both increased security measures by organizations and increasing attacker reliance on reverse-proxy credential theft to bypass MFA (ArcticWolf).

Business Interruption and Security Investments

Cybersecurity is part of the core transformation team in 53% of organizations, indicating integration of cybersecurity in strategic business initiatives (Accenture).
53% of organizations require cybersecurity clearance before deploying any solution, showing a proactive approach to cyber risk management (Accenture).
35% of organizations embed security controls in all transformation initiatives from the beginning, while 18% deployed security after the event, indicating varying approaches to cybersecurity in digital transformation (Accenture).
44% of business leaders emphasize the importance of CISOs in translating technical aspects of cybersecurity to CEOs and Boards, reflecting the growing strategic importance of cybersecurity in organizational decision-making (Accenture).
Business email compromise targets 70% of organizations and accounts for 25% of incidents, making it the top attack vector (Arctic Wolf).
The rise of business email compromise attacks reflects attackers shifting tactics in response to law enforcement crackdowns on ransomware attacks (Arctic Wolf).
Incidents involving data exfiltration doubled between 2019 and 2022 and continued to increase in 2023(Allianz).

Geopolitical Influences in Cybersecurity

97% of organizations saw an increase in cyber threats since the start of the Russia-Ukraine war in 2022, demonstrating the profound effect of geopolitical tensions on cybersecurity (Accenture).
Following the escalation of the Russia-Ukraine conflict, 51% of organizations updated their business continuity and enterprise risk plans, indicating the need for revised strategies in the face of changing geopolitical dynamics (Accenture).
In Q2 2024, cyberattacks increased most in Latin America (53% year-over-year), Africa (37%), and Europe (35%) (Check Point Research).
North American experienced the majority of ransomware attacks (58%) (Check Point Research).

Industry-Specific Cybersecurity Statistics

Healthcare Industry Cybersecurity

Healthcare data breaches have increased steadily over the last 14 years, with each year since 2021 exceeding the previous year's records (The HIPAA Journal).
Healthcare was the third most targeted industry for cyberattacks in the second quarter of 2024 (Check Point Research).
Data breach severity continues to increase, with 2023 seeing a record 133 million records exposed, stolen, or otherwise disclosed without authorization (The HIPAA Journal).
2023 breaches included 26 data breaches of over 1 million records and four breaches of over 8 million records, the largest affecting 11,270,000 individuals and representing the second-biggest healthcare breach ever. (The HIPAA Journal).
Hacking has become the leading cause of healthcare breaches, accounting for 79.7% of all data breaches in 2023 (The HIPAA Journal).
Healthcare breaches cost $10.93 million in 2023 (The HIPAA Journal).
The average cost of a healthcare breach fell to $9.77 million in 2024, and 10.6% year-over-year decline from $10.93 million in 2023 (The HIPAA Journal).
An estimated 90% of healthcare facilities will have migrated to the cloud by 2025 (DuploCloud).

Manufacturing

Manufacturing was the most targeted industry in the first half of 2024, seeing a 41% increase in attacks (Ontinue).
Manufacturing led all other industries in ransomware and database leak attacks in the first half of 2024. (Critical Start),
Manufacturing accounted for 29% of global ransomware attacks in Q2 2024, a 56% year-over-year increase (Check Point Research).
Attackers targeting manufacturing industry victims typically gained initial access through spearphishing attachments and exploitation of remote services and public-facing applications (Critical Start).

Finance and Insurance

System intrusion, miscellaneous errors, and social engineering represent the top attack vectors in the finance and insurance industries (Verizon).
Business email compromise attacks increasingly target the financial services industry, which led other industries in BEC attacks in the first quarter of 2024 (Arctic Wolf).
The financial services industry reported 122 ransomware attacks in 2023 (Federal Bureau of Investigation).
78% of financial services organizations experienced ransomware attacks over the past year (Bridewell).
The financial industry accounted for 7% of published ransomware attacks in the second quarter of 2024, a decline of 8% year-over-year (Check Point Research).
Financial service providers have become prime targets for deepfake audio voice cloning attacks (Critical Start).
75% of financial and insurance attacks compromised clients' personal details (Verizon).
Three in ten financial organizations face problems with cyberattack prevention (Picus).
Cyberattack prevention effectiveness for financial organizations scored 68%, lagging behind the healthcare and manufacturing industries. (Picus).
100% of financial service organizations plan on adopting AI-driven tools (Bridewell).

Education

Education experienced more cyberattacks than any other industry in the second quarter of 2024 (Check Point Research).
System intrusion, social engineering, and miscellaneous errors account for 90% of educational breaches (Verizon).
Over the past year, Microsoft Defender for Office 365 blocked over 15,000 emails per day targeting educational institutions with malicious QR codes (Microsoft).
In the second quarter of 2024, the educational industry accounted for 6% of ransomware attacks, a decline of 3% year-over-year (Check Point Research)
83% of attacks on educational institutions target personal data (Verizon).
Preparedness, staffing, and zero-trust implementation rank as the highest concerns for security professionals in the education industry (CDW).

Other Industries

The top three targets for cyberattacks in the second quarter of 2024 were education/research, government/military, and healthcare (Check Point Research).
In the retail industry, system intrusion, social engineering, and basic web application attacks account for 92% of breaches (Verizon).
58% of retail attacks start with phishing (Trustwave).
47% of stolen retail user sessions leverage Amazon domains (Trustwave).
92% of retail credential access techniques use brute force attacks (Trustwave).
67% of third-party energy sector breaches stem from software and IT vendors, making this the biggest threat in the energy industry (SecurityScorecard).

IoT and DDoS Attacks

Home networks face an average 10 attacks every 24 hours (Bitdefender).
Smart home vulnerability risks are led by TV sets (34% of vulnerabilities), smart plugs (18%), and DVRs (13%) (Bitdefender).
Denial of service attacks represent the most common type of smart home vulnerability, and buffer overflow and denial of service threats have the biggest impact on victims (Bitdefender).
99.3% of smart home attacks exploit common vulnerabilities and exposures (Bitdefender).
The first half of 2024 saw a 111% increase in distributed denial of service mitigations (Imperva).
The second quarter of 2024 saw a 20% year-over-year increase in DDoS attacks (Cloudflare).

AI and Cybersecurity

85% of cybersecurity professionals attribute the increase in cyberattacks to the use of generative AI by bad actors (CFO).
46% of security experts believe the integration of generative AI in business operations will increase vulnerability to cyberattacks (CFO).
By 2027, 17% of cyberattacks will employ generative AI (Gartner).
Concerns about AI in cybersecurity include the potential for increased privacy concerns (39%), undetectable phishing attacks (37%), and a general increase in the volume and velocity of attacks (33%) (CFO).

AI Pentesting

Just 15% of stakeholders feel non-AI tools can detect and stop AI-generated threats (Darktrace).
70% of organizations find AI highly effective in detecting threats that were previously undetectable (Ponemon Institute).
The number of pentest engagements in the U.S. and U.K. increased 31% in 2023 (Cobalt).
75% of U.S. and U.K. security practitioners adopted AI tools in 2024 (Cobalt).
53% of organizations say they're at the early stages of AI adoption, while 18% say they've completed adoption (Ponemon Institute).
57% of U.S. and U.K. security professionals say demand for AI is outpacing their ability to keep up (Cobalt).

GDPR Compliance and Violations

In 2023, the General Data Protection Regulation (GDPR) imposed record fines exceeding €1.6 billion – more than the total fines imposed in 2019, 2020, and 2021 combined (Statista).
Meta was fined $1.3 billion for GDPR violations in 2023 (Reuters).
TikTok was fined $370 million for breaching a number of GDPR rules in 2023 (Forbes).
Spotify was fined $5.4 million in 2023 (CyberNews).
Uber was fined €290m in 2024 (Infosecurity Magazine).

General and Miscellaneous Statistics

55% of cybersecurity experts have reported increased stress levels due to heightened cybersecurity threats and challenges (CFO).
15.1% of organizations plan to increase spending on information security in 2025. (Gartner).
Threat actors and malware families in the first half of 2024 were led by LockBit, Play, Black Basta, Akira, and 8Base, with RansomHub emerging as a major threat (Critical Start).
Cybersecurity incidents now rank among the leading risks for companies of all sizes, including small, mid-size, and large companies (Allianz).
Business email compromise attacks have expanded from large targets to smaller businesses (Critical Start).
48% of organizations report insider attacks becoming more frequent over the past year (Cybersecurity Insiders).
Today's most prominent pro-Russian hacktivist group has focused 96% of its attacks on Europe, primarily Ukraine, Czech Republic, Spain, Poland, and Italy (Orange Cyberdefense).
Ransomware cryptocurrency heists rose 2%, from $449.1 million to $459.8 million (Chainanalysis).

In closing, remember that knowing all the security statistics in the world won’t help you secure your assets. Instead, use these statistics to help receive buy-in from executives and team members trying to understand how investing in security pays dividends.

Cybersecurity Statistics FAQs

How many cyberattacks per day?

Microsoft reports its customers face 600 million attacks daily (Microsoft).

How many cyber attacks occur each year?

600 million attacks daily equates to over 219 trillion attacks each year.

What percentage of cyberattacks include a social engineering aspect versus a technical problem?

In the first quarter of 2024, 90% of attacks involved some type of social engineering (Avast).

Which year had the worst cyberattacks in history?

Cyberattacks grow worse every year. The FBI reports that 2023 set new records, seeing a 10% increase in complaints compared to 2022 and a 22% increase in losses suffered (Federal Bureau of Investigation). 2024 is on track to continue the trend, with a 75% increase in global attacks in the third quarter compared to 2023 (Check Point Research).

How to prepare for a cyberattack?

This is a difficult question to answer without more context but in general, cybersecurity best practices should be followed such as keeping software and operating systems updated, using strong passwords and two-factor authentication, avoiding clicking suspicious links, using encrypted communications, creating backup files, protecting your home Wi-Fi network, using antivirus software, and limiting the personal information you share online.

Read more about how to prepare for a cyberattack with a guide from FEMA.

What is the prediction for cybersecurity in 2025?

Predictions for 2024's cyber landscape include:

Next-gen security awareness programs geared toward generative AI in cyber threats.
Protection against deepfakes in cyber attacks, with attackers expected to use it for social engineering, creating false narratives, and impersonating individuals in videos or voice calls.

Explore more 2025 cybersecurity predictions created by the expert team at Cobalt.

How big is the cybersecurity market in 2025?

Gartner projects that global cybersecurity spending will reach $212 billion in 2025 (Gartner).