Executive Summary

The annual edition of IBM’s Cost of a Data Breach Report is critical to IT, risk management and security leaders. This 19th edition conducted by Ponemon Institute and sponsored by IBM demonstrates significant technology shifts such as the rise of shadow data and escalating costs for disrupted business operations caused by data breaches.

Mental Notes:

• Worldwide Average Expenses: USD 4.88 million, a rise of 10% from the prior year.
• AI and Automation Savings: Organizations that utilized AI in their security measures saved approximately $2.2 million per breach.
• Skills Shortage: Over half of the breached organizations reported severe security staffing shortages, an increase by 26.2% last year.

Major Findings

Average Total Cost of a Breach

The average cost of data breaches has soared to USD 4.88 million due to business disruption and post-breach responses. Lost business and post-breach activities incurred total costs amounting to $2.8 million, which were the highest over six years.

Impact of AI and Automation

Sixty-six percent of surveyed companies now use AI or automation to conduct their cybersecurity operations; this represents an increment by ten percentage points compared to last year. Using AI extensively in prevention workflows resulted in average savings of $2.2m per breach.

Cyber Skills Gap

This year’s security staffing shortage saw a 26.2% rise since the last year. It also resulted in a $1.76 million increase in breach costs. Despite generative AI (gen AI) being used by some organizations to improve productivity, the skills gap remains.

Breach Lifecycle

It took an average of 292 days to identify and control breaches involving stolen credentials. Similarly, phishing attacks took an average of 261 days while social engineering attacks had an average resolution time of up to 257 days.

Customer Data Breaches

Almost half of all breaches involved customer PII which significantly impacted breach costs. Intellectual property (IP) records breaches saw costs escalate from $156 to $173 per record this year.

Shadow Data

Shadow data made up for 35% of all the statistics related to breaching that increased its cost by nearly16%. The other common thing was storing data across multiple environments that accounted for about 40% of all breaching incidents consequently extending the duration required for identifying and containing them.

Insights for Specific Industries

In all the industries, it is the industrial sector that had the highest cost increase with an average of USD 830,000 per breach. In this case, the most costly were malicious insider attacks at an average of $4.99 million.

Ransomware Response- Law enforcement involvement

When law enforcement was involved in ransomware attacks, on average they saved nearly $1 million and decreased time taken to identify and contain breaches.

Highlights Across The Globe

Regional Costs

• United States: This country has been named as having the highest average breach cost at USD 9.36 million.
• Middle East: It goes up to USD 8.75 million.
• Benelux: A new addition with an average cost of USD 5.90 million.

Industry Costs

• Healthcare: Despite a decrease of 10.6% it still holds its position as being the most expensive industry for breaches at USD 9.77 million.

Detection and Containment of Breaches

The length of time taken from discovery to containment has dropped to the lowest levels in seven years, down to 258 days on average.

Employee Training and Security System Complexity

According to this X post shown below:

This implies that companies that concentrate on enhancing employee training can considerably bring down costs linked to data breaches. Well trained employees are better placed in sensing and repulsing security threats, hence averting or minimizing their impacts. Conversely, challenging security setups raise the cost of doing business by making it hard to administer them leading to loopholes and wastage.

Final Thoughts

The 2024 Cost of a Data Breach Report highlights the increasing financial impact of data breaches, the critical role of AI and automation in reducing costs, and the persistent challenge of security staffing shortages. Organizations must continue to innovate and invest in security measures to mitigate these risks and manage the rising costs effectively.

If you would like to view the full report, please use the link here.