Cyber security in 2026: where the risk actually sits

The 200-day line is a budget argument

Breaches whose lifecycle passed 200 days averaged around $5.65m; those resolved inside it averaged about $4.32m. Roughly $1.33m separates the two, against a global average near $4.99m that rose some 12% year on year, and a United States figure closer to $11.5m.

Most security numbers resist being turned into a case for spending. This one does not, because it names a threshold, attaches a cost to crossing it, and the actions that keep you on the right side of it are the unglamorous ones — log retention long enough to reconstruct what happened, an inventory accurate enough to know what to look at, and someone whose job includes looking. A programme that shortens the median lifecycle from beyond the line to inside it is defensible in a language finance departments already speak.

Averages carry the usual warning. They mix industries, jurisdictions and organisations of wildly different size, and no single company will experience the average. Their use is as a scale check: if an internal estimate of breach cost is an order of magnitude away from these, the estimate is probably the thing that needs revisiting.

Two decades of training, and the human share went up

People feature in about 62% of breaches, a shade above the previous year, and identity weaknesses turn up in close to 90% of investigations. Both figures have been broadly stable through twenty years of mandatory training, simulated phishing and posters by the lifts.

Read as a finding about people, this is bleak and useless. Read as a finding about design, it is neither. It says that systems asking a distracted person to distinguish a genuine message from a good forgery, several times a day, at speed, will produce a predictable rate of error — and that the rate is a property of the arrangement rather than of the individuals in it. The engineering response is to remove the decision where possible: authentication that cannot be handed to a stranger, approvals that cannot be granted by a convincing message alone, defaults that fail closed.

Training keeps a role in this account, and it is a narrower one than it is usually sold with. It is good at teaching people how to report, and what happens when they do, which shortens the interval between the first person suspecting something and the first person qualified to check. Given that detection is the slow half, that is a substantial contribution. It is a different claim from expecting training to stop the click.

How do notification deadlines survive a 183-day detection gap?

Disclosure regimes are written in hours and days. Data protection law across much of Europe expects notification to a regulator within 72 hours; listed companies in the United States work to a window of four business days once an incident is judged material; sector rules for finance, health and critical infrastructure add their own clocks, most of them shorter than a week. Set those against a mean of roughly 183 days to identification and the arithmetic looks impossible.

It is not, because nearly all of these clocks start at awareness rather than at occurrence. The six months an intruder spent undetected does not consume the deadline. That resolves the arithmetic and creates a stranger incentive: the moment of discovery is the moment a legal timer begins, and everything before it is untimed. An organisation that improves its detection is, in the narrowest sense, volunteering to start clocks earlier and more often.

Nobody sensible argues against noticing sooner on those grounds, but the incentive shapes behaviour in quieter ways. It rewards ambiguity about when awareness began, which is why the record of who knew what and when matters more than most teams expect, and why that record is usually assembled retrospectively from chat logs and ticket timestamps under conditions of considerable stress. Deciding in advance what constitutes awareness — which alert, reviewed by whom, at what confidence — is cheap, dull, and the single preparation most often skipped.

The related trap is materiality. A deadline that begins when an incident is judged material invites the judgement to be deferred, and a deferral that looks prudent internally reads very differently in an enforcement action reconstructing the timeline afterwards. The workable posture is to fix the criteria while nothing is happening, write down who applies them, and accept that some disclosures will look premature in hindsight. That is a far cheaper error than the alternative.

The three questions a board asks

Boards do not ask about vectors. They ask whether the organisation would survive the thing that happened to somebody else in the news, how much of the budget is buying that survival, and whether anyone would tell them early. Each of those maps onto the figures above, and each has an answer that can be prepared in advance rather than improvised in a meeting.

Would we survive it? The honest answer is a restore time and a scope, both measured rather than estimated. When did we last restore a production system from backup, how long did it take, and what was still missing afterwards. An organisation with recent numbers for that has answered the question; one that describes its backup policy has changed the subject.

Is the money well spent? The comparison worth making is not between products but between the two halves of the lifecycle. If detection is roughly three times the length of containment and receives a fraction of the attention, that imbalance is the finding, and shifting it has a price tag against the $1.33m that crossing 200 days appears to cost.

Would we know early? This is the one most often answered with a tool name. A better answer is the date of the last deliberate test — someone triggering an alert on purpose to see whether it arrived, at whose desk, and how long it sat there. Without that date the detection capability is a purchase rather than a measurement.

Reading the numbers you will be shown this year

Every figure on this page came from an annual study with a method, and the methods differ. Sources put exploitation between 31% and 33%, and stolen credentials between 13% and 16%, depending on what counts as which. Those gaps are not errors; they are the visible edge of a taxonomy decision.

Three questions get most of the way to reading any such report. What population did the sample come from — a supplier's telemetry describes the organisations that bought that supplier's product. Over what window, and is it the same window as last year's edition. And what is the denominator behind the percentage, because a share without one is doing rhetorical work rather than empirical work.

Where credible sources disagree, the disagreement is worth keeping rather than averaging away. Two studies differing by two points on the same question usually means the question was cut differently, and knowing which cut you are looking at is more useful than a tidier number would have been.

One last habit saves more embarrassment than any of the above: never perform arithmetic across two reports. Subtracting one study's quarter from another's year, or expressing one house's figure as a percentage of another's, produces a number that describes nothing at all, and it happens constantly in slide decks because the result looks like analysis. If two figures are to be compared, they need to have come from the same method, and if they did not, the comparison is the finding.