Cybercrime Statistics 2026: Shocking Risks Exposed

Cybercrime affects consumers, businesses, governments, and critical infrastructure at a scale that makes digital security an economic and operational priority. Criminal groups increasingly combine phishing, stolen credentials, malware, ransomware, cryptocurrency fraud, and social engineering to reach victims across borders. Artificial intelligence is also changing the threat landscape by helping attackers create more convincing messages, synthetic identities, deepfakes, and automated attack workflows.

For businesses, a single breach can interrupt production, expose customer information, compromise suppliers, and create millions of dollars in recovery costs. For individuals, cybercrime can lead to identity theft, drained bank accounts, investment losses, and long-term financial harm. The latest statistics also show that older adults, smaller organizations, and companies dependent on third-party technology providers can face particularly high risks. The following cybercrime statistics examine the scale of these threats, their economic impact and the trends shaping cybersecurity.

Editor’s Choice

• Americans age 60 and older reported approximately $7.7 billion in internet-crime losses in 2025, an increase of 37% from the previous year.
• Investment-related internet crime generated approximately $8.65 billion in reported U.S. losses in 2025, making it the largest loss category in the annual complaint data.
• Consumers reported $15.9 billion in fraud losses during 2025, compared with more than $12 billion a year earlier.
• Social media was the starting point for nearly 30% of reported scams that caused a financial loss in 2025, with associated losses reaching $2.1 billion.
• Ransomware appeared in 44% of confirmed breaches studied in the 2025 global breach analysis, up from 32% in the previous dataset.
• A 2026 global breach study found that AI-driven attacks increased 56% year over year, showing how criminals are incorporating automation into their attack workflows.
• A 2026 global fraud assessment found AI-enhanced fraud could be 4.5 times more profitable than traditional fraud methods.

Recent Developments

• From January through April 2026, a coordinated operation spanning 97 countries and territories resulted in 5,811 arrests linked to social engineering scams and associated money laundering.
• Authorities intercepted approximately $293 million in illicit assets during that 2026 operation, including funds associated with impersonation, investment, romance, and business email compromise schemes.
• International fraud-related notices and information-sharing requests increased 54% from 2024 levels, reflecting greater law enforcement activity against increasingly international criminal networks.
• Since 2024, investigators have supported more than 1,500 cross-border fraud cases involving lost assets valued at $1.1 billion.
• A major 2025 operation across 26 countries removed more than 20,000 malicious IP addresses or domains associated with information-stealing malware. Investigators reported disrupting 79% of the suspicious infrastructure they had identified.
• Another 2025 African operation resulted in more than 1,200 arrests, disrupted more than 11,000 malicious infrastructures and recovered almost $100 million.
• By March 2025, authorities had identified people from 66 countries who had been trafficked into online scam centers, demonstrating the link between cyber-enabled fraud and organized human exploitation.
• The average cost of an AI-related model inversion breach reached approximately $6 million in 2026, indicating that attacks against AI systems can create substantial financial exposure.
• In the 2026 global breach study, AI-driven incidents cost organizations about $1 million more per breach on average than comparable incidents without the same AI component.

Global Cybercrime Statistics

• A regional cyber-threat assessment released in 2026 found that 33% of surveyed countries across Asia and the South Pacific recorded more than 10,000 cyber-scam cases, with phishing among the most widespread techniques.
• Analysis of 4,875 cybersecurity incidents recorded between July 1, 2024, and June 30, 2025, found distributed denial-of-service attacks accounted for 77% of incidents in the European dataset.
• Hacktivist activity made up almost 80% of incidents in that European dataset, although only about 2% of those hacktivist incidents caused service disruption.
• Cybercrime represented 13.4% of analyzed European incidents, while cybercrime claims on monitored leak sites and criminal forums accounted for 81% of tracked criminal activity.
• Among cybercrime claims targeting European organizations, 81.1% involved ransomware, while 15.2% involved data breaches linked to ransomware incidents.
• Researchers documented 82 ransomware variants used against organizations in EU member states during the reporting period, underscoring how fragmented the ransomware ecosystem has become.
• Organized cyber-fraud networks in Southeast Asia were estimated to generate between $27.4 billion and $36.5 billion annually, based on regional labor-force and proceeds estimates.
• An analysis cited in 2025 found 22% of adults in Southeast Asia had experienced a scam during the previous year, despite 78% saying they felt confident they could detect one.
• Among those Southeast Asian scam victims, 62% reported high stress levels, while only 22% recovered any of the money they lost.

Cybercrime Costs and Economic Impact

• The average U.S. organizational data breach cost reached approximately $11.5 million in 2026, considerably higher than the $4.99 million global average.
• Health care remained the costliest industry in the 2026 breach study, with an average breach cost of $6.64 million worldwide.
• The previous year’s global average breach cost stood at $4.44 million in 2025, down 9% from $4.88 million in the preceding study before climbing again in 2026.
• U.S. organizations faced an average breach cost of $10.22 million in the 2025 study, already the highest recorded national average that year.
• Extensive use of AI and automation in security produced approximately $1.93 million in average breach-cost savings in 2026 compared with organizations that did not use those capabilities extensively.
• Business email compromise generated approximately $3.05 billion in reported U.S. losses during 2025, up from $2.77 billion in 2024.
• Tech and customer support schemes generated about $2.13 billion in reported internet-crime losses in 2025, compared with $1.46 billion in 2024.
• Personal data breach complaints accounted for approximately $1.31 billion in reported losses in 2025, illustrating the direct financial consequences attached to stolen personal information.
• Imposter scams cost consumers approximately $3.5 billion in 2025, nearly three times the amount reported in 2020.

Cybercrime Complaints and Victims

• U.S. internet-crime reporting recorded 1,008,597 complaints in 2025, up from 859,532 complaints during 2024.
• That increase equates to roughly 149,000 additional complaints in a single year, or about a 17% rise based on the published annual totals.
• Cyber-enabled fraud alone accounted for approximately 452,868 complaints in 2025, representing 45% of all internet-crime complaints recorded in the annual dataset.
• Cyber-enabled fraud generated approximately $17.7 billion in reported losses, representing about 85% of all losses recorded in the 2025 internet-crime data.
• Consumers submitted about 3 million fraud reports in 2025, compared with 2.6 million reports in the previous year.
• More than 1 million 2025 consumer fraud reports involved imposter scams, making impersonation the most frequently reported fraud category in that dataset.
• Since January 2025, more than 5,100 account-takeover complaints tied to criminals impersonating financial institutions produced losses exceeding $262 million.
• A 2025 African enforcement operation uncovered cyber-enabled banking, investment and messaging-app scam cases involving more than 5,000 victims across seven participating countries.
• In one U.S. metropolitan reporting region, romance-scam losses exceeded $40 million in 2025, compared with nearly $22 million in 2024, illustrating how rapidly losses can rise at the local level.

Most Common Types of Cybercrime

• Phishing and spoofing remained the largest U.S. internet-crime complaint category in 2025, with 191,561 complaints. The total stood at 193,407 in 2024.
• Extortion generated 89,129 complaints in 2025, up from 86,415 in 2024 and 48,223 in 2023.
• Investment schemes generated 72,984 complaints in 2025, compared with 47,919 in 2024, an increase of more than 25,000 reports.
• Personal data breaches generated 67,456 complaints in 2025, up from 64,882 during 2024.
• Nonpayment and nondelivery schemes produced 56,478 complaints in 2025, compared with 49,572 the year before.
• Tech and customer support scams generated 47,794 complaints, rising from 36,002 in 2024.
• Government impersonation complaints increased to 32,424 in 2025, nearly double the 17,367 recorded in 2024.
• Identity theft accounted for 31,675 internet-crime complaints in 2025, compared with 21,403 in 2024 and 19,778 in 2023.
• Credential abuse remained the leading known initial access method in the 2025 global breach dataset at 22% of breaches, followed closely by exploitation of vulnerabilities at 20% and phishing at 16%.
• Phishing and social engineering initiated 28% of incident-response breaches examined in another 2025 global threat dataset, while unpatched web assets accounted for 18% and exposed remote services for 12%.

Phishing and Spoofing Statistics

• Phishing and spoofing generated 191,561 U.S. internet-crime complaints in 2025, keeping the category among the most frequently reported forms of cybercrime.
• Reported losses connected with phishing and spoofing reached approximately $215.8 million in 2025. Among victims age 60 and older alone, losses reached about $77 million.
• The 2024 reporting cycle recorded 193,407 phishing and spoofing complaints, meaning complaint volume remained extremely high even though the total edged down in 2025.
• By comparison, phishing and spoofing produced more than 298,000 complaints in 2023, showing that reported volume has declined from its earlier peak while the financial impact remains substantial.
• Phishing or social engineering initiated 28% of investigated breaches in a major 2025 incident-response dataset, making deceptive communications one of the most important initial access methods.
• Another global breach dataset found phishing accounted for 16% of known initial access vectors in 2025, behind credential abuse at 22% and vulnerability exploitation at 20%.
• In 2026 breach data, attackers shifted further toward software exploitation, yet phishing still accounted for 20% of initial access in public administration, illustrating its continued relevance in government environments.
• Mobile social engineering became more effective in the 2026 dataset, with 40% higher click rates than comparable traditional approaches. This shift gives smishing and mobile-targeted fraud more room to grow.
• One AI-assisted phishing analysis found malicious campaigns could reach click-through rates of 54% compared with 12% for traditional phishing, or roughly 4.5 times the rate.
• A regional smishing surge in March 2025 generated 1,573 complaints in less than two weeks, compared with 1,720 complaints during the preceding 14-month period, showing how quickly a convincing text-message campaign can scale.

Malware and Virus Statistics

• Security systems observed and blocked approximately 4.5 million newly detected malware files or attempts each day during the 2025 reporting period.
• The same security environment processed more than 100 trillion security signals per day, illustrating the scale required to identify malware and other malicious activity across modern networks.
• Roughly 5 billion emails were screened every day for malware and phishing threats in the 2025 dataset.
• Reported direct U.S. losses categorized specifically as malware reached approximately $19.4 million in 2025.
• Among Americans age 60 and older, reported malware losses reached approximately $3.4 million in 2025, compared with less than $200,000 in 2024.
• Infostealer malware became an increasingly important first-stage attack tool in 2025, with families designed to collect passwords, browser cookies, session tokens and system information for subsequent attacks.
• One major infostealer disruption in 2025 seized or blocked more than 2,300 malicious domains connected with malware infrastructure.
• A separate international operation in 2025 removed more than 20,000 malicious IP addresses and domains associated with information-stealing malware, disrupting 79% of the identified suspicious infrastructure.
• Identity-based attacks remained closely connected with malware-driven credential theft: 97% of observed identity attacks in one 2025 dataset involved password spraying, highlighting how stolen credentials and automated login attacks reinforce each other.
• In cloud environments studied during the second half of 2025, remote-code-execution exploitation rose from 2.9% to 13.6%, nearly a fivefold increase that gives attackers another route for deploying malicious code.

Ransomware Damages and Victim Behavior

• Global ransomware damages are estimated to reach $74 billion in 2026, a steep increase from $20 billion in 2021, highlighting the rapidly growing financial impact of ransomware attacks worldwide.
• About 64% of ransomware victims now refuse to pay attackers, marking a record-high refusal rate and signaling a significant shift toward recovery and resilience strategies instead of ransom payments.
• Organizations recovering from ransomware attacks without paying face an average cost of approximately $1.53 million, showing that restoration, investigation, and business disruption can still create a substantial financial burden.
• Third-party and supply chain vulnerabilities now contribute to roughly 30% of all ransomware incidents, with their share doubling year over year as attackers increasingly exploit interconnected vendors and external service providers.

Data Breach Statistics

• The 2026 global breach study found that 31% of breaches began with software vulnerability exploitation, making vulnerable software the leading initial access route for the first time in that dataset.
• A year earlier, credential abuse led known initial access routes at 22%, while vulnerability exploitation accounted for 20% and phishing for 16%.
• The 2025 breach study analyzed more than 22,000 security incidents and 12,195 confirmed data breaches across organizations worldwide.
• Third-party involvement appeared in 48% of breaches in the 2026 dataset, representing a 60% increase from the prior year’s level.
• In the 2025 dataset, third parties were involved in 30% of breaches, roughly twice the share recorded in the preceding study.
• The worldwide average cost of a data breach reached a record $4.99 million in 2026, a 12% increase from the previous annual study.
• AI-driven attacks increased 56% year over year in the 2026 breach-cost analysis, led by deepfake impersonation and AI-enabled malware.
• Breaches involving AI model-inversion attacks carried an average cost of approximately $6 million in 2026.
• Extensive use of AI and automation for security reduced average breach costs by approximately $1.93 million compared with organizations that made no extensive use of those capabilities.
• In H2 2025 cloud investigations, compromised identities played a role in 83% of incidents involving major cloud and software-as-a-service environments, while attackers targeted data in 73% of cloud-related incidents.

Identity Theft Statistics

• U.S. internet-crime complaints categorized as identity theft reached 31,675 in 2025, compared with 21,403 in 2024, representing a sharp year-over-year rise.
• Reported losses tied specifically to identity theft reached approximately $185.8 million in 2025.
• Americans age 60 and older reported about $48.5 million in identity-theft losses during 2025, compared with $28.5 million in 2024.
• The most recent complete consumer identity-theft data book recorded more than 1.1 million identity theft reports in 2024, representing about 18% of all reports in that database.
• Credit card identity theft led reported identity-theft types in 2024, with 449,032 reports involving misuse of an existing card or fraudulent applications for new cards.
• Fraudulent new credit card accounts generated 406,110 reports in 2024, a 7% increase from the previous year.
• Existing-credit-card identity theft produced another 52,428 reports, up 17% year over year.
• Business and personal loan identity theft accounted for 95,689 reports in 2024, representing an 18% increase from 2023.
• Auto loan and lease identity theft generated 60,188 reports in 2024, up 16% from the preceding year.
• Identity theft involving email or social media accounts reached 22,258 reports in 2024, increasing 14% year over year, while online shopping or payment-account identity theft reached 19,797 reports.

Online Fraud Statistics

• Consumers reported approximately $15.9 billion in fraud losses during 2025, up from more than $12 billion in the previous year.
• The number of consumer fraud reports rose to approximately 3 million in 2025, compared with 2.6 million in 2024.
• Separately, cyber-enabled fraud accounted for 452,868 U.S. internet-crime complaints and approximately $17.7 billion in reported losses in 2025.
• Cyber-enabled fraud represented only 45% of complaints but 85% of reported losses in that 2025 dataset, showing how costly digitally facilitated scams have become.
• Imposter scams generated more than 1 million consumer reports in 2025 and approximately $3.5 billion in reported losses.
• Nearly 30% of consumers who reported losing money to a scam in 2025 said the scheme started on social media. Reported losses from social-media-originated scams totaled $2.1 billion.
• Social media scam losses in 2025 were approximately eight times higher than in 2020, when reported losses totaled $261 million.
• More than 40% of people who lost money through a social media scam said the scheme began when they tried to buy something advertised online.
• Nonpayment and nondelivery schemes produced 56,478 U.S. complaints in 2025, while associated losses reached more than $503 million.
• Account-takeover fraud linked to criminals impersonating financial institutions produced more than 5,100 complaints and over $262 million in losses from January 2025 onward.

Investment and Cryptocurrency Fraud Statistics

• Cryptocurrency investment fraud generated 61,559 complaints and $7.23 billion in reported U.S. losses in 2025. Complaint volume increased 48% from 2024, while losses rose 25%.
• Victims age 60 and older accounted for 13,685 cryptocurrency investment complaints and approximately $2.76 billion in losses in 2025, more than any other listed age group.
• Cryptocurrency ATM and kiosk schemes produced 13,460 complaints and $389 million in reported losses during 2025. Losses rose 58% year over year, while complaints increased 23%.
• Global cryptocurrency scams received at least $14 billion on-chain in 2025, with the eventual total projected to exceed $17 billion as additional illicit addresses are identified.
• The average cryptocurrency scam payment climbed from $782 in 2024 to $2,764 in 2025, representing a 253% year-over-year increase.
• Cryptocurrency inflows connected with impersonation scams increased approximately 1,400% year over year in 2025, showing how rapidly criminals have scaled fake-persona and impersonation tactics.
• Identified illicit cryptocurrency addresses received at least $154 billion during 2025, up 162% from the previous year. Activity involving sanctioned entities increased 694%.
• Stablecoins accounted for 84% of identified illicit cryptocurrency transaction volume in 2025, reflecting their growing role in cross-border criminal financial flows as well as legitimate transactions.
• Cryptocurrency theft exceeded $3.4 billion in 2025. One February incident alone accounted for about $1.5 billion, while attackers linked to North Korea stole roughly $2 billion over the year.
• Physical attacks against cryptocurrency holders also increased. About $58 million was stolen through violent attacks in 2025, while another $30 million had already been stolen by mid-2026.

Business Email Compromise Statistics

• Business email compromise caused approximately $3.05 billion in reported U.S. losses in 2025, making it the second-largest cyber-enabled fraud category by financial loss behind investment fraud.
• Business email compromise represented roughly 17% of the $17.7 billion in reported cyber-enabled fraud losses during 2025 when comparing the category total with overall fraud losses.
• Losses have remained persistently high for several years: reported business email compromise losses totaled approximately $2.9 billion in 2023 before exceeding $3 billion in 2025.
• Among victims age 60 and older, business email compromise losses reached approximately $568 million in 2025, compared with $385 million in 2024 and $382 million in 2023.
• That means reported business email compromise losses among older victims increased by roughly 48% from 2024 to 2025, based on the annual loss totals.
• In one state-level example, business email compromise losses reached $64.5 million in 2025, up from $40.8 million the previous year.
• In another regional example, reported business email compromise losses climbed from $4.3 million in 2024 to $7 million in 2025, a rise of roughly 63%.
• In investigations involving major cloud environments during H2 2025, 10% of cases involved business email compromise, with criminals commonly targeting banking details for fraudulent wire transfers or deposits.
• Modern business email compromise has increasingly shifted toward a service-based criminal model in which stolen credentials and compromised inboxes can be sold to other operators, allowing attackers to automate target selection and payment fraud.
• Business email compromise frequently combines several attack methods, including spoofed domains, spearphishing, compromised email accounts, and manipulated payment instructions, which helps explain why individual incidents can produce losses reaching hundreds of thousands or millions of dollars.

Cybercrime Statistics by Country and Region

• California recorded approximately $3.67 billion in reported internet-crime losses in 2025, the highest U.S. state total. Texas ranked second at $1.83 billion, followed by Florida at $1.60 billion.
• New York recorded approximately $1.23 billion in internet-crime losses, making it the fourth U.S. state to exceed $1 billion during 2025.
• Cryptocurrency-related losses alone reached approximately $2.10 billion in California, $1.02 billion in Texas and $914.5 million in Florida during 2025.
• More than half of surveyed countries across Asia and the South Pacific reported that cybercrime represented at least 30% of nationally recorded crime, demonstrating how digital offenses have become a major share of overall criminal activity in parts of the region.
• One-third of surveyed Asia-Pacific countries reported more than 10,000 online scam cases, with phishing and social engineering among the most widespread methods.
• Half of surveyed countries in that region reported cybercrime-related financial losses exceeding $10,000, while several reported losses of more than $100 million.
• In Europe, public administration accounted for 38% of recorded cybersecurity incidents in a recent sector analysis. Central governments represented 69% of public-sector incidents.
• Distributed denial-of-service attacks represented 60% of European public-administration incidents, while data breaches accounted for 17.4% and cyberespionage for 2.5%.
• Within European cybercrime claims, manufacturing attracted 14.9% of ransomware claims, while digital infrastructure and services accounted for 27.7% of documented data breaches.
• A cross-border cybercrime operation involving 13 Middle Eastern and North African countries identified 3,867 victims, 201 arrests and 382 additional suspects between October 2025 and February 2026. Authorities also seized 53 servers.

Cybercrime Statistics by Industry and Organization Size

• Manufacturing recorded 3,627 security incidents and 2,713 confirmed data breaches in the 2026 breach dataset, making it one of the most heavily represented industries.
• External actors were responsible for 95% of manufacturing breaches, while 87% carried a financial motive. Espionage appeared as a motive in another 15%.
• Malware appeared in 75% of manufacturing breaches, and ransomware accounted for 61%, highlighting the operational disruption risk facing factories and connected production environments.
• Third parties played a role in 61% of manufacturing breaches, while the human element appeared in 56%, reinforcing the importance of supplier and employee security controls.
• Organizations with fewer than 1,000 employees accounted for 7,256 incidents and 7,152 confirmed breaches in the 2026 small-business dataset.
• External actors and financial motives each appeared in 100% of the analyzed small-business breaches where those attributes were recorded. Third parties were involved in 55%.
• Health care recorded 1,492 incidents and 1,438 confirmed breaches in the 2026 dataset. External actors accounted for 81% of breaches, while financial motives appeared in 99%.
• Retail organizations recorded 997 incidents and 806 confirmed breaches. External actors caused 99% of retail breaches, while 85% involved a financial motive.
• Third parties appeared in 68% of retail breaches, and attackers compromised internal organizational data in 84%. Vulnerability exploitation accounted for 42% of known initial access.
• Insurance-claim analysis of retail cyber incidents found business interruption represented 44% of known total losses, compared with 28% attributed to threat actors and 15% to response and recovery costs.

Artificial Intelligence and Cybercrime

• Artificial intelligence enabled an estimated 55% of reported cybercrime across surveyed African countries in the 2026 regional assessment. The analysis covered responses from 36 countries.
• AI-driven document and identity forgeries increased 195% globally, with synthetic IDs and deepfakes becoming capable of defeating some selfie and liveness verification checks.
• The median threat actor observed using generative AI applied it across 15 different documented attack techniques, while some actors incorporated AI into 40 to 50 techniques.
• Less than 2.5% of observed AI-assisted malware activity involved techniques with one or fewer existing malware examples. Most AI use therefore enhanced established attack methods rather than creating entirely novel techniques.
• AI-assisted phishing could potentially improve criminal campaign profitability by up to 50 times by allowing attackers to personalize and distribute convincing messages at far greater scale.
• By May 2026, 77% of surveyed organizations reported using AI in cybersecurity operations, indicating that defenders are also rapidly adopting automation for detection, analysis and response.
• Data leakage associated with generative AI became the leading AI security concern in 2026 at 34% of respondents, ahead of advanced adversarial capabilities at 29%.
• The pattern had been reversed one year earlier: in 2025, 47% cited advancing adversarial AI capabilities as their primary concern, compared with 22% concerned about generative-AI data leakage.
• One 2025 threat dataset found that 52% of observed cyberattacks were financially motivated, while attackers sought to steal or leak data in 80% of investigated incidents, giving AI-enabled criminals strong economic incentives to automate existing tactics.

Cybercrime Trends and Future Projections

• 94% of cybersecurity leaders expect AI to be the most significant force changing cybersecurity in 2026, making automation the dominant near-term technology trend.
• About 87% of surveyed leaders said AI-related vulnerabilities increased during 2025 faster than other cyber-risk categories.
• The share of organizations formally assessing the security of AI tools rose from 37% in 2025 to 64% in 2026, suggesting that AI governance is beginning to catch up with adoption.
• Geopolitical threats are increasingly shaping corporate defense plans: 64% of organizations now account for geopolitically motivated cyberattacks when developing risk-mitigation strategies.
• Among the largest organizations, 91% changed their cybersecurity strategies in response to geopolitical volatility, indicating that cyber risk now directly intersects with international business planning.
• Cyber-enabled fraud has become increasingly personal: 73% of surveyed respondents said they or someone in their network had experienced cyber-enabled fraud during 2025.
• Third-party risk is also increasing. 65% of large companies identified supply chain and third-party vulnerabilities as their greatest cyber-resilience challenge in 2026, up from 54% in 2025.
• Confidence in national cyber preparedness weakened, with 31% of respondents reporting low confidence that their country could respond effectively to major cyber incidents, compared with 26% a year earlier.
• Ransomware is expected to remain a major operational threat as criminals combine established extortion models with increasingly automated reconnaissance, social engineering and attack development. Cyber-enabled fraud, meanwhile, has overtaken ransomware as the leading cyber concern among surveyed CEOs in 2026.

Frequently Asked Questions (FAQs)

Conclusion

Cybercrime statistics point to a threat environment that is becoming more financially damaging, automated and internationally connected. Fraud, ransomware, cryptocurrency crime, identity theft and business email compromise continue to generate substantial losses, while attackers increasingly exploit software vulnerabilities, third-party providers and compromised identities. AI adds another layer of complexity by making phishing, impersonation and content manipulation easier to scale, even as security teams use the same technology to strengthen detection and response.

The data also shows that cyber risk is not distributed evenly. Smaller organizations often have fewer defensive resources, older consumers suffer disproportionately high financial losses, and industries such as manufacturing, health care and retail remain attractive targets because disruption can produce immediate operational and financial pressure. Supply-chain exposure and geopolitical instability add further uncertainty.

At the same time, organizations are improving their defenses. The share reporting cyber-resilience capabilities beyond minimum requirements reached 19% in 2026, more than double the 9% recorded in 2025. Continued investment in identity security, software patching, third-party oversight, employee awareness, AI governance, and incident-response planning will be essential. Cybercrime is likely to remain a persistent global risk, but stronger prevention, faster detection and coordinated response can reduce both the frequency and cost of successful attacks.