About this report
Owners and finance leads ask two questions after a breach makes the news: what would it cost us, and what should we buy first. This report reviews the 2024 to 2026 evidence from IBM and the Ponemon Institute, the Verizon Data Breach Investigations Report, the FBI, the UK government, Sophos, Coalition and Microsoft. It says which numbers apply to a firm with roughly 100 to 1,000 employees and which do not, and it names the vendors behind each figure. It is a review of other people's research, not a study of our own. Figures are quoted as the sources give them, and each is dated. Facts were checked against the original publications on 25 October 2026.
The short answer
Average cost. IBM's 2025 report puts the average worldwide cost of a breach at $4.44 million, and its 2026 edition, released on 29 July 2026, puts it at $4.99 million, up 12%. Those averages cover organizations of all sizes. For firms with 100 to 5,000 employees that were hit by ransomware, Sophos reports an average (mean) recovery cost of $1.7 million in 2026, not counting any ransom, and a median of $375,000.
Why mid-size firms are targeted. Attackers go where defenses are thinner and the payout is still worth the effort. Verizon's 2025 report found ransomware in 88% of breaches at small and medium organizations against 39% at large ones, and noted that smaller firms are less likely to have current, usable backups.
Which cheap controls help most. The evidence points to four (the ranking is our reading, see below): multifactor authentication on every account that can reach company data, backups that are kept offline or protected and tested by restoring them, fast patching of internet-facing devices, and a checked process for approving payment changes. The first two have the strongest numbers behind them.
Finding 1: The headline average is $4.44 million to $4.99 million, and it is not a mid-size number
IBM's Cost of a Data Breach Report 2025, researched by the Ponemon Institute, covered 600 organizations with breaches between March 2024 and February 2025. It found an average worldwide cost of $4.44 million, the first fall in five years, and a United States average of $10.22 million. The average breach lasted 241 days from start to containment, and breaches found by the victim's own team cost $900,000 less than breaches disclosed by the attacker. IBM's 2026 report, based on 602 organizations with breaches between March 2025 and February 2026, puts the global average at $4.99 million, a record, up 12%. IBM sells security products, and the pages we read do not break results out by company size, so a firm of a few hundred people should treat these as an upper reference, not a forecast. IBM also reported that extortion or ransomware incidents disclosed by the attacker averaged $5.08 million, and that 63% of organizations chose not to pay a ransom, up from 59% the year before. The cost is not only the ransom: IBM notes that nearly all studied organizations suffered operational disruption, and most of those that reported recovery took more than 100 days.
Finding 2: Cost evidence for mid-size firms is lower and wide
Three other sources give a different picture. Sophos surveyed 2,158 IT and security leaders in 17 countries at organizations with 100 to 5,000 employees (January to March 2026, covering the previous 12 months). It reports an average (mean) recovery cost of $1.7 million, excluding any ransom, with a median of $375,000, and a median ransom payment of $769,000; 56% of attacks succeeded in encrypting data. Coalition, a cyber insurer, reported for 2025 claims an average loss of $116,000, an average ransomware claim of $269,000 and an average business email compromise claim of $27,000 (March 2026 report). The UK government's Cyber Security Breaches Survey 2025 (2,180 businesses, fieldwork August to December 2024) puts the mean cost of the single most disruptive breach at medium and large businesses at £3,350, or £5,590 when firms reporting no cost are excluded; the median was £30 and £270. These figures differ because they measure different things: recovery after ransomware, insured claims, and self-reported direct cost across all kinds of incidents. Read together, the lesson for a finance lead is that the cost depends on what stops working and for how long, not on the size of any one fine or ransom. A planning range for a firm of this size therefore runs from about $27,000, Coalition's average business email compromise claim, up to about $1.7 million, Sophos's average ransomware recovery cost, with Sophos's median of $375,000 closer to the low end; this is our reading of the sources, not a figure any of them states.
Finding 3: Mid-size firms are hit because the attack works and the defense is thinner
Verizon's 2025 Data Breach Investigations Report analyzed 22,052 security incidents, of which 12,195 were confirmed breaches, from 139 countries (November 2023 to October 2024). Organizations with fewer than 1,000 employees accounted for 3,049 incidents against 982 for larger ones, almost four times as many, though Verizon notes this may partly reflect its contributors. Ransomware featured in 88% of breaches at small and medium organizations against 39% at large ones. Verizon's explanation is that ransomware groups do not care about victim size and adjust the ransom to fit, and that smaller firms are less likely to have up-to-date, ready backups. Its 2026 edition adds that, among ransomware cases where the victim's size was known, about 96% of victims were small or medium organizations. Microsoft notes that state-linked attackers have targeted small businesses as pivot points toward larger organizations. The 2025 Verizon report found ransomware in 44% of all breaches, a median ransom payment of $115,000 (down from $150,000) and 64% of victims declining to pay, so the money is smaller per case but the volume is high. The UK survey shows how common the problem is: 67% of medium businesses reported a breach or attack in the prior 12 months, against 43% of all businesses.
Finding 4: Attackers get in through stolen logins, unpatched edge devices and suppliers
In the same Verizon report, the most common known entry points were use of stolen credentials (22% of breaches), exploitation of vulnerabilities (20%, up 34% from the year before) and phishing (15%). The human element, such as clicking a link or reusing a password, was involved in about 60% of breaches. Third-party involvement doubled from about 15% to 30%. Only about 54% of edge-device vulnerabilities were fully fixed during the year, taking a median of 32 days. Verizon's 2026 edition (incidents from November 2024 to October 2025) reports that exploitation of vulnerabilities was the initial access vector in 31% of breaches, up from 20%, ahead of credential abuse at 13%, and that ransomware is present in 48% of breaches. Sophos's 2026 survey of ransomware victims ranks the root causes differently, with malicious email (26%) and phishing (24%) first, compromised credentials at 23% and exploited vulnerabilities at 18%; the two studies measure different things, and both show that attackers use every open door. The UK survey found only 35% of medium businesses monitor risks from suppliers, against 48% of large ones.
Finding 5: Multifactor authentication blocks most password attacks, but not all
Microsoft's October 2025 Digital Defense Report summary states that over 99% of identity-based attacks can be blocked by MFA, and that password attacks make up more than 97% of identity attacks. The underlying Microsoft research paper estimated a 99.22% drop in compromise risk across the population and 98.56% where credentials had leaked. That study looked at Azure Active Directory accounts already showing suspicious activity, and Microsoft sells the software, so the figure is strong evidence but not a guarantee for every firm. Verizon calls MFA "the gold standard" while documenting bypasses: in the Microsoft 365 logs it analyzed, token theft was the most common bypass at 31%, followed by repeated approval prompts and adversary-in-the-middle attacks. Sophos's 2026 survey found that 97% of victims whose attack began with compromised credentials had MFA enabled in some form, which Sophos reads as a sign that it was not fully deployed or is not enough on its own. CISA advises phishing-resistant MFA, such as hardware tokens, with text-message codes as a last resort. Coverage is still patchy: the UK survey's closest measure shows 40% of businesses using any form of two-factor authentication. Our view, not a finding of any source: MFA is among the cheapest controls and has the largest measured effect of those covered here, so it should be switched on everywhere before it is upgraded anywhere.
Finding 6: When attackers reach the backups, recovery costs eight times more
A Sophos whitepaper (March 2024) surveyed 2,974 organizations of 100 to 5,000 employees that had been hit by ransomware, through Vanson Bourne, in 14 countries. In 94% of attacks the criminals tried to compromise the backups, and 57% of those attempts succeeded. Where backups were compromised, median recovery cost was $3 million against $375,000, and 26% fully recovered within a week against 46%. The survey was commissioned by a security vendor and shows association, not proof of cause; firms with weak backups may be weak elsewhere too. Sophos recommends regular backups stored in several locations, MFA on the cloud backup account, and practice restores. Its 2026 survey found that 66% of victims whose data was encrypted restored from backups, up from 54% a year earlier. Verizon makes the same point from the other side, noting that ransomware crews benefit when a small firm lacks backups that are current and ready to use. In the UK survey 71% of businesses back up data through a cloud service and 47% use other means, but the survey does not say whether those copies are protected from an attacker or have ever been restored.
What the evidence does not show
No source we could read gives an average breach cost for mid-size firms alone. IBM's pages gave no size breakdown, and the Verizon "small" group is every organization under 1,000 employees.
IBM, Sophos, Microsoft and Coalition sell security or insurance. Their data is useful but not neutral.
The FBI's 2025 Internet Crime Report logged 3,611 ransomware complaints with just over $32 million in reported losses, but says that figure excludes lost business, time and recovery services, so it understates the real cost.
Controls were not compared head to head in a randomized way. The MFA and backup figures are observational.
No source we read measures how well call-back checks on payment changes work, although the FBI's 2025 report logged $3.05 billion in business email compromise losses across 24,768 complaints in 2025 and Coalition found business email compromise and funds transfer fraud made up 58% of its 2025 claims.
What this means for an owner or CFO
Plan for a range, not a headline. This is our advice: use the Sophos and Coalition figures for a mid-size firm and keep IBM's average as the worst-case reference. Then spend in this order, which is our judgment and not a ranking any source gives. First, require MFA, preferably phishing-resistant, on email, remote access, admin accounts and the backup console. Second, keep one backup copy offline or immutable and restore from it twice a year. Third, patch internet-facing devices such as VPNs and firewalls on a set deadline. Fourth, require a phone call to a known number before any change of bank details or large payment. Fifth, ask your key suppliers how they protect your data. Sixth, ask your insurer which controls it expects you to have in place. Seventh, write down who decides and who calls the insurer, and rehearse it once a year, as CISA recommends. Also set a rule for employee use of unapproved AI tools: IBM's 2025 study found that high levels of "shadow AI" added about $670,000 to the average breach cost, and 63% of breached organizations had no AI governance policy or were still developing one.
Where to start
If you want a second opinion on your software, access controls or a vendor's security answers, our software consulting team can review them with you, and you can book a call to talk it over. More of our reviews are in Research.
Sources
IBM (2025). Cost of a Data Breach Report 2025, press release of 30 July 2025 (Ponemon Institute research, 600 organizations).
IBM (2026). Cost of a Data Breach Report 2026, landing page and press release of 29 July 2026 (Ponemon Institute research, 602 organizations). https://www.ibm.com/reports/data-breach and
Verizon (2025). 2025 Data Breach Investigations Report.
Verizon (2026). 2026 Data Breach Investigations Report. https://www.verizon.com/business/resources/T343/reports/2026-dbir-data-breach-investigations-report.pdf (landing page:
FBI Internet Crime Complaint Center (2026). 2025 Internet Crime Report.
UK Department for Science, Innovation and Technology (2025). Cyber Security Breaches Survey 2025.
Sophos (2026). The State of Ransomware 2026. https://assets.sophos.com/X24WTUEQ/at/jbww7pmb8n3gp99wr6hfq4/sophos-state-ransomware-report-2026.pdf (landing page:
Sophos (2024). The Impact of Compromised Backups on Ransomware Outcomes, whitepaper, March 2024.
Microsoft (2025). Extortion and ransomware drive over half of cyberattacks, 16 October 2025.
Microsoft Research (2023). How effective is multifactor authentication at deterring cyberattacks?
Coalition (2026). 2026 Cyber Claims Report, 5 March 2026.
CISA (2023). Take the First Steps Towards Better Cybersecurity With These Four Goals, 21 July 2023.