Cybersecurity Statistics 2026: $20.9B in Reported Losses, and Vulnerabilities Now Beat Passwords

The FBI's IC3 received 1,008,597 complaints in 2025, with reported losses of $20.877 billion — up 26% from 2024, an average loss of $20,699 per complaint. These are reported losses, not a complete measure of all cybercrime, but they come from a consistent federal reporting channel.

Fraud is where the money goes

Fraud dominated the financial impact: 452,868 cyber-enabled fraud complaints, $17.697 billion in losses — 45% of all 2025 complaints and 85% of all 2025 losses. Phishing and spoofing were the largest crime type by complaint count, at 191,561 complaints.

People age 60 and older filed 201,266 complaints and reported $7.7 billion in losses in 2025. Security is not only an enterprise IT problem — consumer education, fraud detection, and account-protection design matter too.

Breaches still cost $4.4M on average

IBM's 2025 Cost of a Data Breach Report puts the global average cost of a data breach at $4.4 million, down 9% from the previous year. That decline should not be oversold: breach cost varies by region, industry, data type, and detection maturity. Breaches remain expensive even when the global average moves down.

IBM also highlights AI governance risk: 97% of organizations that reported an AI-related security incident lacked proper AI access controls, and 63% lacked AI governance policies. That moves the AI security discussion away from hype and toward controls — inventory, access, approval, monitoring, and accountability.

How breaches start has changed

Verizon's 2026 DBIR says 31% of breaches now start with software vulnerabilities, surpassing stolen passwords as the top initial path. 48% of breaches now involve ransomware. And 15% of attack techniques are being bolstered by generative AI, while mobile threats show 40% higher click rates than traditional email threats.

The practical takeaway: patch by known exploitation, not only by theoretical severity. CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities with evidence of active exploitation — a useful official reference for prioritization.

The full breakdown, with each source's scope explained, is on SaaSStatsHub: https://saasstatshub.com/security/cybersecurity-statistics-2026/

Originally published with full sources at SaaSStatsHub. Free calculators for MRR, churn, CAC and LTV: https://saasstatshub.com/tools/