IBM’s Cost of a Data Breach Report 2025 put the global average cost of a breach at $4.44 million, down about 9% from $4.88 million the year before — the first decline in five years. The same report put the average for United States organisations at $10.22 million, an all-time high. And it found that organisations took a mean of 241 days to identify and contain a breach, the lowest figure in nine years.
The averages make headlines. The 241 days is the number that should change how you work.
Why the time matters more than the money
An average cost across thousands of organisations tells you almost nothing about your own exposure: it mixes hospital systems with software startups. The detection and containment time is different. It describes a process every company has, whether or not anyone designed it: how long something can be wrong inside your systems before anyone notices.
Eight months is a long time for an attacker to be inside a system, and it is also a long time for an ordinary fault — a misconfigured backup, a permission nobody revoked, an integration quietly failing — to go unnoticed. Most of the work that shortens breach detection also catches the boring failures, which is why it pays for itself even in the years when nothing attacks you.
The unglamorous work that shortens it
Know who has access to what. The most common finding in any access review is accounts belonging to people who left, and permissions granted for one task years ago. Reviewing them is dull and takes an afternoon.
Log something, and look at it. A system that records what happened is the difference between “we think it started on Tuesday” and knowing. Logging costs little; not having it costs the investigation.
Patch what you run, on a schedule. Not heroically, just regularly, including the libraries inside your own applications.
Test the restore, not the backup. A backup that has never been restored is an assumption. Restoring one is the only way to find out whether it works, and the only time to find out is before you need it.
Decide in advance who does what. When something happens at 2am, the useful artefact is a short written list: who is called, who can take a system offline, who talks to customers.
Where the IBM figure is misleading
Two cautions about quoting the $4.44 million:
It is an average of organisations that had a breach. It is not a prediction of your cost, and a smaller company’s breach usually costs far less in absolute money and far more in proportion to its size.
The drop does not mean the risk fell. IBM attributes the decline in part to faster containment, not to fewer or weaker attacks. A lower average cost alongside a record US average is a story about response, not about safety.
What we’d do first, in a company of fifty people
Start with access. Then backups you have actually restored from. Then logging. All three are cheap, none of them require a new product, and each of them shortens the time between something going wrong and somebody noticing.
If that work is not getting done because nobody owns it, that is what a support arrangement is for — ours covers infrastructure support and backup and disaster recovery.
Sources
- IBM, Cost of a Data Breach Report 2025: https://www.ibm.com/reports/data-breach
- IBM, “2025 Cost of a Data Breach Report: Navigating the AI rush without sidelining security”: https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai
- Help Net Security, “Average global data breach cost now $4.44 million”, 4 August 2025: https://www.helpnetsecurity.com/2025/08/04/ibm-cost-data-breach-report-2025/