Introduction
IBM recently released its 2023 report on the cost of data breaches for businesses. In this article we break down the report and summarise the main findings.
About HYDN
HYDN is a multi-disciplinary company that works with businesses from startups to established enterprises. The team has over four decades of collective cybersecurity experience, and its services run from Adversarial Simulation and Red Teaming to Incident Response and Secure Network Design. We also carry out Smart Contract Audits and Web3 Penetration Testing for blockchain projects.
Understanding the cost of data breaches
A rising financial burden
The 2023 Cost of a Data Breach Report is the 18th edition, and it looks at the financial impact of data breaches globally. The headline finding is that costs keep climbing. The average breach cost an all-time high of USD 4.45 million in 2023, up 2.3% from 2022 and 15.3% from the 2020 figure.
Key findings and trends
- AI and automation cut costs. Organizations that used security AI and automation extensively reported breach costs averaging USD 1.76 million lower than those that did not. They also identified and contained breaches approximately 108 days faster.
- Internal detection versus external reporting. Only about one-third of data breaches were detected by internal security teams, which points to a need for better threat detection. Breaches reported by attackers or third parties cost nearly USD 1 million more than those identified internally.
- Ransomware and law enforcement. Organizations that did not involve law enforcement in ransomware incidents faced higher costs and longer breach lifecycles. In healthcare, a highly regulated sector, data breach costs have risen 53.3% since 2020.
- DevSecOps and incident response planning. High adoption of DevSecOps produced the largest cost savings (USD 1.68 million), which shows the return on building security into software development. Effective incident response (IR) planning and testing saved organizations an average of USD 1.49 million.
- Security system complexity. More complex security systems correlated with higher breach costs. Organizations with simpler systems reported significantly lower costs.
- Breach lifecycle duration. How long a breach lasted had a large effect on its cost. Breaches resolved within 200 days cost USD 3.93 million, compared with USD 4.95 million for those that took longer.
- Countries and industries. The United States again had the highest average data breach costs, followed by the Middle East and Canada. Healthcare remained the most affected industry, with costs reaching USD 10.93 million in 2023.
- Lost business costs. Lost business costs, including revenue losses and reputation damage, fell slightly from USD 1.42 million in 2022 to USD 1.30 million in 2023.
- Smaller organizations hit harder. Smaller organizations, particularly those with fewer than 5000 employees, saw larger increases in breach costs than bigger ones.
- Rising consumer costs. A majority of organizations said they raised their service and product prices after a data breach, as in previous years.
- Data types and attack vectors. Customer and employee personal identifiable information (PII) were the most commonly compromised records and the most costly. Phishing and compromised credentials were the most prevalent and costly attack vectors.
- Stolen credentials and insider threats. Breaches that began with compromised credentials or malicious insiders took the longest to resolve, averaging nearly 11 months.
Conclusion
Data breaches are getting more expensive and harder to deal with. For HYDN, the report reinforces the case for cybersecurity strategies that include advanced AI tools, effective incident response planning and less complex systems. As threats change, businesses need to invest in proactive measures and keep upgrading their defenses.
To talk to us about our cybersecurity services, head over to our Contact page now.
