Mind-blowing Cybersecurity Statistics in 2024

Due to the growing cybercrime industry, cybersecurity techniques and trends are always evolving. A cyber attack can devastate any size business, so it is up to each company to set up the appropriate cyber security measures and protect their company and customer information.

Because the state of cybersecurity changes every year, we’ve provided the most up-to-date statistics for 2024.

Editor’s Choice for Cybersecurity Statistics 2024

If there’s anything that you take away from this ultimate gate to cybersecurity trends in 2024 it’s these top stats:

The cybersecurity market is growing globally at a compound annual growth rate (CAGR) of 10.9%.
The COVID-19 pandemic in 2020 caused a significant rise in cybercrime and phishing attacks, most likely due to the increase in remote work and insufficient security protocols around that remote work.
When it comes to cost by industry, healthcare is the most expensive for data breaches. In 2020, the healthcare industry lost around $7.18 million and that number has risen to $10.10 million in 2022.
It takes around 280 days to discover and contain a cybersecurity breach.
Most cybersecurity breaches (95%) are due to human mistakes.
Google detected over 2 million phishing sites in 2020.

The State of Cybersecurity

Data Breaches 101

A data breach is a serious security violation where hackers infiltrate data networks to gain access to confidential, sensitive, personal data for financial gain. The cost of cybercrime is predicted to be $9.5 trillion in 2024, slightly lower than the previously projected $10.5 trillion by 2025 (Embroker, Govtech). This reflects the ongoing and substantial financial impact of cyber threats on businesses.

While each individual and organization is entitled to the privacy of their own personal information, hackers still attempt to steal it to make money, bring down major corporations, and disrupt global systems.

Data breaches are typically the result of security vulnerabilities in computer networks. Hackers can find multiple ways of getting into a network. Harder-to-penetrate networks come with more security firewalls in place.

Data breaches occur commonly through compromised credentials, phishing attacks, software misconfiguration, failed software updates, lost or stolen hardware, and malware downloads.

Data breaches come in all kinds of sizes, scales, and frequencies. However, in general, data breaches are extremely expensive and cost companies a lot of money, integrity, and customer trust. It is therefore vital that companies and IT departments do everything they can to protect their networks and sensitive data.

With so many financial rewards and incentives, hackers are more than willing to hack security protocols. Hackers are challenged every day by new security protocols. Protecting a company against a data breach is not straightforward, and it often requires multiple rounds of protection, software, training, and updates. The more that a company can do to protect its data, the better. After all, companies that fall victim to a data breach will likely find that data is stolen, damaged, or compromised. The data may also be used to ask for a ransom or sold to malicious third parties.

Data breaches are usually rather sophisticated. Cyber attackers will often research a company for its security weaknesses and target those vulnerabilities to capture high-value assets. Attackers might contact employees to get in; however, once they are in, they can use the infrastructure, systems, and appliances to move throughout the organization’s network.

1. Lost information is the most expensive type of cyber attack.

(Source: Accenture)

Accenture’s Cost of Cybercrime (2019) study found that lost information was the most expensive component of any cybersecurity issue. This equated to around $5.9 million.

The report also found increases in certain types of cyber attacks; people-based attacks increased the most, with malware attacks increasing by 11%, and web-based attacks increasing by 13%.

2. Humans cause most security breaches.

(Source: Cybint Solutions)

While we rely largely on technology to protect us from data breaches, humans are usually responsible for most security breaches.

Human error accounts for 95% of security breaches experienced today. This is primarily why training company employees is a vital defense against debilitating cybersecurity attacks.

3. Estimated cybersecurity spending in 2022 was $172 billion.

(Source: Gartner)

Considering that data breaches cost us an average of $4.35 million globally in 2022 (IBM), companies face significant pressure to protect against a data breach. And considering all of the other losses, like trust and customer information, companies spend billions each year in security.

Gartner found that responding to security issues was one of the biggest challenges companies face. The average security spend reached $123 billion for automated security checks and intelligence systems.

4. Data breaches doubled in 2020.

(Source: RiskBased Security)

In addition to the extravagant spending associated with data breaches, it seems that the frequency of attacks is also on the rise. RiskBased Security found that in the first half of 2020, data breaches doubled the number of records exposed compared to the entire year of 2019. In the first half of 2020, around 36 billion records were exposed!

However, around 43.6% of the companies that reported attacks in 2020 did not report the number of records exposed, indicating that even more were exposed than reported.

5. Issues of cybercrime might account for $5.2 trillion in losses.

(Source: Accenture)

So just how expensive is a cyber attack? Well, Accenture estimates that losses due to cybercrime could add up to $5.2 trillion in cyber attacks occurring between 2019 and 2024.

Malware seems to be the most expensive type of attack to overcome, and malware attack frequency has increased by 11%. The cost of malicious insider attacks has also risen by 15%.

6. It is estimated that on average 497 data records were lost per second in 2019.

(Source: Iomart)

An Iomart study reported that in 2019, around 479 data records were either stolen or lost every second. This accounts for approximately $71,823 lost per second, or $6,205,479,452 lost per day.

These cost estimates don’t just account for downtime or lost data, but also the residual effects of a data breach, such as lost value in terms of stock and reputation. The average company experiences a value drop of 7.27% after a cybercrime vulnerability, which can lead to millions of potential future losses in large businesses.

7. Security made up 50% of cybersecurity budgets in 2020.

(Source: Gartner)

Studies out of Gartner show that global security spending is increasing. In 2020, we saw 50% of security spend was dedicated to protecting against cybersecurity and overcoming security vulnerabilities.

Cybercrime Trends for 2024

Pay mind to these cybercrime trends that have been popping up in 2024:

8. Remote work-related breaches cost organizations an estimated $1 million in 2022 (AbnormalSecurity.com, 2022).

9. CIOs are more vulnerable than ever to cyberattacks, with 82% being targeted (Forbes, 2022).

10. Global Attacks have increased by 25% in the third quarter of 2022 (Check Point Research, 2022).

11. 28% of organizations reported a ransomware attack during the primary COVID-19 lockdown in 2020 (Sophos, 2021).

12. Q3 in 2020 saw a significant increase in email threats (notably 3,818,307), malicious URLs related (1,025,301), malware files (15,513 malware files) to COVID-19 detected (Trend Micro, 2020).

13. Total DDoS or social engineering attacks are expected to reach 14.5 million in 2022. (Cisco, 2019).

14. Google detected over 2 million phishing sites in 2020 (TechRadar, 2020).

15. 43% of data breaches involve web applications (Verizon, 2020).

16. 52% of data breaches were from malicious attacks (IBM, 2020).

17. Indirect attacks were the result of 40% of data breaches in 2020 (Accenture, 2020).

18. Here are the most common types of cyberattack vulnerabilities across all networks, from largest to smallest: crypto weaknesses (39.7%), cross-site scripting (12%), system patching related (8%), directory listing (7.1%), and exposed systems and services (3.5%) (Edgescan, 2020).

19. In 2019, we saw attack groups using destructive malware to destroy business operations rise by 25% (Symantec, 2019).

20. Companies that have suffered from a cyberattack in the past year also suffer from lost business, as 59% of buyers are likely to avoid companies that suffered from a cyberattack in the past year (Arcserve, 2020).

21. Ransomware attacks are so prevalent, that it is estimated that a business falls victim to one every 11 seconds (Arcserve, 2020).

22. Consumers want businesses to do more to protect their personal information, as 70% of consumers feel that businesses don’t do enough to safeguard their information (Arcserve, 2020).

23. If your business underwent a cyberattack, 25% of your customers will likely abandon products and services and move to competitors who haven’t been attacked (Arcserve, 2020).

24. Over half (50%) of all cyberattacks will target medium- and small-sized enterprises (Cybersecurity Ventures, 2021).

25. 60% of SMBs that suffer from a data breach are likely to fold within six months of the attack (Cybersecurity Ventures, 2021).

Types of Cybercrimes

Your business will need to protect against different types of cybercrime attacks, as each one is used to get past different security measures and to attack certain types of protected data. Here are some of the most common types of cybercrimes:

Malware Infection

Malware infections are one extremely common security threat that businesses protect against. Malware usually infiltrates companies through email spam. If an employee clicks on an email with malware software on it, then it has the potential to automatically download onto that employee’s computer and navigate your company network.

Malware, which stands for malicious software, encompasses software that might contain viruses, trojans, worms, and other harmful code. All that needs to be done is for the software to be downloaded onto a computer. Other malware can be disguised as spyware, adware, a ransomware attack, malvertising, or used for cryptojacking and as a rootkit operator.

Distributed Denial of Service Attack (DDoS)

DDoS attacks, which stand for Distributed Denial of Service Attacks, have been increasing in popularity. Businesses globally are expected to experience over 10 million DDoS attacks in 2021, which would indicate about 1.6 million more attacks than what occurred in 2019.

Distributed denial-of-service attacks are simple in theory but complicated to execute. The hackers use multiple servers around the world to flood a website with too much traffic, which overloads the business server and forces the website and/or computer networks to be unavailable. Hackers usually use bots that make fake packet requests and incoming messages to overload the network.

DDoS attacks are social engineering attacks that are extremely difficult to detect and ward off. DDoS hackers might threaten DDoS to get a ransom. But others may use it as a form of distraction. For example, while the company is dealing with DDoS, other attackers may be installing malicious software or stealing data on the sly.

DDoS attack symptoms include problems accessing websites, internet disconnection, excessive amounts of spam emails, long-term inability to access a certain website or slow access to files.

Insider Threats

Insider threats are simply threats instigated by those inside the company. This might mean that your employees are accidentally letting in hackers, or your employees could be part of a malicious group themselves. Insider threats can also come from third-party organizations with access to your computer network. Statistics suggest that 60% of cyberattacks come from insider threats, and they are unfortunately tough to detect and extremely expensive.

Unfortunately, anyone in your company can cause or be part of an insider threat. This is why employee monitoring software is vital for protection as it will detect anomalous behavior from any user within your company.

Cybercrime Costs and Damages Statistics

Cybercrime does more than damage companies’ reputations and the lives of the business’ customers. They have significant financial benefits to cybercrime:

26. Across all industries, 86% of data breaches are financially motivated (Verizon, 2020).

27. The biggest data breach of all time, which involved 10.88 billion in accounts, was the Cam4 data breach in 2020. (UpGuard, 2021).

28. Global ransomware attack damage might reach $21 billion in 2021 (Cybersecurity Ventures, 2021).

29. In 2020, data breaches cost an average of $3.86 million (IBM, 2020).

30. The U.S. has the world’s highest average cost of data breach at $8.64 million (IBM, 2020).

31. After the Cam4 security breach, here are the remaining 10 largest data breaches of all time (so far): Yahoo, $3 billion in 2013, Aadhar, $1.1 billion in 2018, First American Financial Corporation, $885 million in 2019, Verifications.io, $763 million in 2019, Facebook, $540 million in 2019, Yahoo, $500 million in 2014, Marriott, $500 million in 2018, Adult FriendFinder, $412.2 million in 2016, and MySpace, $360 million in 2013 (UpGuard, 2021).

32. The cost of cybercrime is predicted to hit $8 trillion in 2023 and will grow to $10.5 trillion by 2025. This staggering cost underscores the increasing financial impact of cyber threats on businesses (Forbes, 2023).

33. The average ransom payment of companies infected with ransomware was $812,360 (Sophos, 2022).

Preparing Your Business for Cyber Threats

Businesses of all sizes need to have a strong cybersecurity plan in place to protect against cybercriminals.

34. Most Americans (64%) don’t know what to do if a data breach occurs.

(Source: Varonis)

Most Americans don’t know what they would do if they were ever attacked by a cybercriminal. Around 64% said that they wouldn’t have a plan in place if they had data stolen, and another 64% said they’d never even checked to see if they’d fallen victim to an attack.

35. Unfortunately, it takes 280 days to find and contain a data breach.

(Source: Ponemon Institute)

It takes up to 280 days on average for companies to locate the source of a data breach, although this number of days on average will depend on the industry that you’re in. For example, retail workers often find the source faster, within 197 days.

36. Companies leave large numbers of sensitive files accessible by employees.

(Source: Varonis)

Cybersecurity professionals target vulnerabilities, like employees having access to sensitive files, even when they shouldn’t!

Most company employees have access to more information than they need, resulting in an exponentially higher number of security vulnerabilities and one of the main reasons why insider threats are so damaging:

15% of companies leave more than a million files available for any staff member to access.
The average employee has access to around 11 million files at work.
17% of all sensitive files are also accessible to all employees.

Restricting access to files can limit the attack surface and minimize the threats posed to your company.

37. Vulnerabilities are frequent in email. For example, 93% of all malware arrives on our computers via email.

(Source: Verizon)

Almost all (93%) malware gets onto computers via email. Phishing is currently the number one form of social engineering attack, accounting for around 80% of all reported incidents today.

Many company vulnerabilities are known but they have no way of preparing for them. At least 11,000 exploitable issues are listed on the CVE database today, and 34% had no available security patches in 2020.

Managing Security In PostCOVID Times

The COVID-19 pandemic shook most of the world in 2019 and 2020. In North America, businesses were forced to shut down and many employees had to work from home. Many companies were unprepared for a remote workforce but needed to find security solutions so that their employees could access vital records safely and do their jobs.

Before the COVID-19 pandemic, internet security was not as big of a priority. Prior to the pandemic, 18% of SMBs in 2019 said they consider cybersecurity investment and protection to be their lowest priority. 66% of respondents thought that cyberattacks would not be an issue for their business, even though 67% of SMBs were hit by an attack in 2019.

Clearly, the COVID-19 pandemic has changed this mindset. More businesses are needing to provide professional IT security on remote worker devices, including personal devices, or by shipping company computers out to remote workers. Since employees working from home are using their personal networks, this presents a lot more surface area for attacks. A hacker can more easily tap into a personal internet connection through weak router passwords (or passwords that have not been changed from the admin password) and IoT devices.

Cyber security breaches rose sharply due to the COVID-19 pandemic, adding to the list of challenges that businesses face. For unknown reasons, cyber crime seems to be more prevalent at home and on personal computers. 47% of individuals fall for a phishing scam while working at home (Deloitte, 2020).

Work-from-home due to the COVID-19 pandemic required individuals to use video conferencing tools more frequently. It was mainstream news that Zoom users were being hacked; in fact, between February and May 2020 more than half a million (over 500,000) people globally were affected by breaches in which the personal data of video conferencing users was stolen and sold on the dark web (Deloitte, 2020).

The cyber threat landscape is increasingly diverse. Deloitte estimates that businesses could experience all different types of hackers:

With less supervision, malicious employees (malicious insider threats) who begin working from home might have more opportunities and technical controls to carry out fraud and other criminal activity.
Opportunist cybercriminals take advantage of weak data security measures
Hacktivists (hackers fighting for social and political issues) are adding to the cybersecurity threats
Script kiddies (or ‘junior’ hackers) testing out cyberattack packages to improve their skills.

Best Ways to Prevent Cyber Security Attacks for Any Size Business

Cybersecurity preparedness can help your business to identify and mitigate a data breach attack. Unfortunately, cyberattacks weaken public confidence and can be a significant liability, costing businesses millions of dollars. Especially with the rise in remote workers due to the COVID-19 pandemic, businesses have been forced to find more ways of ensuring company security while still enabling remote access.

You’ll need multiple methods to protect your business. The methods will depend on the type of data being collected, how it’s collected, and the amount of data you have. If you are new to this industry and need to start upping your security, be sure to establish these six best practices as soon as possible:

Implement a formal security framework like zero trust
Arm employees with knowledge about cybersecurity
Perform continuous threat monitoring
Assess and manage vulnerabilities
Manage third-party risks
Create a strong cybersecurity culture

All companies should adopt multiple security barriers, like antivirus, antimalware, firewall, and performance scanners, in addition to employee monitoring and incident response plans.

Protection against malware comes from employee education, email monitoring, email scanning, and filtration systems. Educating your employees to recognize suspicious emails, advertisements, and programs is a major line of defense. You’ll also want to deploy an employee monitoring solution to detect insider behavior trends so that you can be alerted to when suspicious activity is on your network.

With the rise of work-from-home and the online workplace, IT departments and security teams must be prepared with antivirus, antimalware, firewall, and data loss prevention software like employee monitoring to protect against common security threats, such as malware, spyware, a malicious computer virus, or a phishing attack.

One major cybersecurity trend is that cybersecurity incidents continue to rise and increase in frequency and power. They will likely increase in cost too. Understanding how these advanced attacks are targeting your company and computer network will help you to put up the necessary safeguards and protect your data.

Statistics by Industry and Business Types

Cybercrime exists across industries and business types. Healthcare data breaches and those in the financial industry tend to be more financially rewarding and far more impactful. Here are key statistics in different industries:

38. The manufacturing sector is most commonly susceptible to stolen credit cards, which account for 80% of hacking-related breaches (Verizon, 2020).

39. Here are the most common cyber attacks experienced by companies in the United States: phishing (38%), network intrusion (32%), inadvertent disclosure (12%), stolen/lost devices or records (8%), and system misconfiguration (5%) (BakerHostetler, 2020).

40. While all industries are susceptible to target cyber attacks, the industries most targeted by malware in 2019 included the public sector (4,346 incidents), the professional sector (1,168 incidents), manufacturing companies (465 incidents), information firms (420 incidents), and healthcare companies (206 incidents) (Verizon, 2020).

41. Cyberespionage is a type of attack where sensitive, classified data or intellectual property is stolen to gain a competitive advantage over another company. Globally, the industries that were most frequently targeted by cyber espionage in 2019 were: manufacturing (75), professional (40), public (26), information (11), and mining and utilities (6) (Verizon, 2020).

42. Web application cyber attacks accounted for 40% of data breaches in the information industry (Verizon, 2020).

43. Phishing attacks largely targeted online industries like SaaS (34.7%), financial institutions (18%), payment gateways (11.8%), social media networks (10.8%), ecommerce (7.5%), logistics (3.5%), and cloud storages (2.9%) (APWG, 2020).

Healthcare Industry

44. Global healthcare cybersecurity is expected to grow 15% annually, reaching $125 billion by 2025 (Cybercrime Magazine, 2020).

45. The healthcare industry experiences 2-3 times more cyber attacks than the financial services sector, which is also a highly targeted sector! (Cybercrime Magazine, 2020).

46. In 2020, U.S. healthcare cyber attacks affected 17.3 million people, the result of 436 data breaches (Forbes, 2020).

47. Attackers can sell medical records on the dark web for $1,000 each (Forbes, 2020).

48. As of January 2021, the U.S. Department of Health and Human Services Office for Civil Rights was actively investigating around 700 data breach cases in healthcare alone (U.S. Department of Health and Human Services Office for Civil Rights, 2021).

49. 16 of the 700 cases in healthcare were submitted in the first half of January 2021. 552 cases logged for 2020 were being investigated (US Department of Health and Human Services Office for Civil Rights, 2021).

50. Almost half (48%) of data breaches on healthcare businesses were from internal actors, also known as insider threats (Verizon, 2020).

51. A quarter (24%) of healthcare employees in the U.S. still haven’t received cybersecurity awareness training (Cybercrime Magazine, 2020).

Trusting SoftActivity for Cybersecurity Protection

Employee monitoring software is a program that can be downloaded onto each user’s computer to track common behaviors on that computer. It is extremely effective as an added boost to company security and also for increasing employee productivity.

Along with other security features like a firewall and antimalware software, employee monitoring can do the following to improve your company security:

Reduce cybersecurity risk for external malicious activity through monitored internet usage and external intrusion detection
User activity monitoring against malicious insider threats and identity theft
Monitor the amount of time your employees spend on social media
Stay on top of remote working employees
Create another barrier that protects sensitive data from a data breach and minimize the attack surface
Find and isolate malware software
Easily detect phishing emails to minimize cyber risk
Quickly recover after a cyber attack
Boost endpoint security, which is especially important for a remote workforce
Build data around threat intelligence to better prevent, mitigate, and recover from a cyber threat or cyber attack
Protect unsecured Internet of Things, or IoT devices
Remote access to install, configure, and adjust settings

Employee monitoring software will be able to take screenshots of an employee’s computer, log their keystrokes, and limit the bandwidth over a network connection. It can also monitor network activity on a mobile device. This allows your business to keep tabs on even remote employees within your company.

While this software can have a range in features, they, in general, will track the time an employee is working, track the apps and websites that the employee visits while time is being tracked, monitor typical user activity, alert you to any atypical employee activity, and report time wasted.

See how SoftActivity employee monitoring can protect your company from cybersecurity threats today!

By SoftActivity Team.