Key facts at a glance
- US$4.44MGlobal average cost of a data breach in 2025, down 9%
- US$10.22MAverage cost of a breach in the United States, a record high
- 241 daysAverage time to identify and contain a breach, a nine-year low
- 13%Organisations reporting breaches involving AI models or applications
Every year, IBM and the Ponemon Institute study hundreds of real data breaches to estimate what they cost. The 2025 edition offers a mixed picture: organisations are getting faster at detecting and containing attacks, yet the financial stakes remain high and artificial intelligence is opening new doors for attackers.
The headline numbers
The report puts the global average cost of a data breach at US$4.44 million, a 9% decrease on the previous year. The improvement is linked to faster identification and containment: the average breach lifecycle fell to 241 days, the shortest in nine years.
The picture differs by region. In the United States, the average cost rose 9% to a record US$10.22 million, a reminder that regulatory penalties, litigation and detection costs can multiply the impact of an incident.
AI is now part of the attack surface
For the first time, the study looked closely at AI. Thirteen percent of organisations reported breaches involving an AI model or application, and many of those incidents led to broader data compromise and operational disruption. Coverage of the report also highlighted that nearly two-thirds of organisations lacked AI governance policies. As staff adopt AI tools quickly, often without central approval, governance has not kept pace.
What reduces the cost of a breach
The most consistent lesson from years of breach research is that speed matters. The sooner a breach is detected and contained, the lower its cost. That points to a clear set of priorities:
- Know your assets and data. You cannot protect what you cannot see. Maintain accurate inventories of systems, cloud services, AI tools and sensitive data.
- Monitor continuously. A security operations center (SOC), in-house or managed, with well-tuned SIEM and response playbooks shortens detection and containment time.
- Control identities. Multi-factor authentication, privileged access management and zero trust principles limit how far an attacker can move.
- Govern AI. Approve AI tools, control what data they can access, and train staff on safe use.
- Practise the response. Tabletop exercises and tested backups turn a potential crisis into a managed event.
- Use a recognised framework. The NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022 provide a structured way to prioritise and measure progress.
Operational technology deserves equal attention
For utilities, oil and gas operators, airports and manufacturers, the most serious risk may sit in operational technology: SCADA, control systems and safety systems. Standards such as IEC 62443 and NIST SP 800-82 provide specific guidance for securing these environments without disrupting operations.
How Optimity Global helps
Our ICT practice delivers managed SOC services, vulnerability assessment and penetration testing, governance and compliance programmes, identity and zero trust implementation, and OT/ICS security. We help organisations detect faster, respond better and reduce the likelihood of becoming the next statistic.
Sources
Figures are quoted from the sources listed as published at the time of writing. Please refer to the original publications for full context and any later updates.
