The message looks like an invoice, a password reset, or a note from IT.
It takes maybe four seconds to click the link. What follows takes an average of 247 days to contain.
And when it finally ends, the bill for a US company runs to $11.5 million.
That number landed in the most closely watched security cost study in the industry, resetting every assumption about how expensive a breach really is.
So why does the same breach cost less than half that on a global average?
Why the US bill more than doubles the global average every single time
The gap is not about attackers hitting American companies harder. It is about what happens after the door opens. US regulatory penalties, mandatory notification windows that vary state by state, and the near-certainty of class-action litigation stack costs that simply do not exist in most other markets. Detection, escalation, legal counsel, forensics, and the slow bleed of customers who never return all compound on top of each other.
Then there is time, which is the real multiplier. Mean time to identify and contain a breach rose to 247 days, split between 183 days to find it and 64 days to close it. Breach lifecycles longer than 200 days averaged $5.65 million globally, while those contained inside 200 days averaged $4.32 million.
Every extra day the attacker sits undetected is another day of forensic work, another tranche of legal fees, another news cycle.
For the fourth consecutive year, phishing remained the most common initial attack vector. The most expensive problem in US corporate security still begins with someone clicking a link.
What the $11.5 million actually buys an attacker
A data breach does not cost millions because someone got in. It costs millions because of everything that happens after: forensics, crisis calls, downtime, lawyers, regulators, and customers who leave. Each of those categories has its own invoice, its own vendor, and its own timeline.
Detection, escalation, and lost business from customer churn and downtime accounted for nearly two-thirds of total breach costs. The real drain is weeks of paralyzed operations, outside counsel billing by the hour, and customers who quietly moved their accounts elsewhere while the incident team was still writing the containment report.
Supply chain exposure makes the bill even larger. Supply chain compromise adds $227,250 per breach on average and takes 258 days to identify and contain. That single line item is larger than many small companies’ entire IT budgets.
The study behind the $11.5 million figure
IBM’s Cost of a Data Breach Report 2026, the 21st annual edition, was conducted by Ponemon Institute across 602 organizations with breaches between March 2025 and February 2026. The global average hit a record $4.99 million, up 12 percent from the prior year. The US figure of $11.5 million is up 13 percent.
The study covered 17 industries across 16 countries and regions, with breach samples ranging across organizations of varying scale. Even the smallest incidents triggered the full machinery of notification, legal review, and remediation. Scale does not protect a company from the fixed-cost floor of a breach.
AI is reshaping both sides of the equation. One in four malicious breaches were AI-enabled, a 56 percent increase over the prior study, and those incidents cost roughly $1 million more than the global breach average. But organizations using security AI and automation reduced breach costs by $1.93 million and shortened breach lifecycles by 65 days.
Where the figure breaks down and who pays more
The $11.5 million is an average, which means some sectors sit well above it. Healthcare continues to face the highest breach costs globally, though that figure has fallen 10.5 percent year over year. Apply the US cost premium to that sector and the numbers become genuinely staggering for any hospital system working through a major incident.
The AI-access control gap is its own category of risk. The research found 92 percent of organizations that suffered an AI-related breach did not have proper AI-access controls in place. As companies wire AI agents into their workflows, that figure describes the current state of most enterprise deployments right now, not a hypothetical future risk. It is worth reading alongside GCN’s earlier look at AI-flagging tools platforms are already deploying to manage those same systems.
The 200-day threshold that separates the two cost bands is not a soft benchmark. It is where the bill structurally changes, and smaller organizations without dedicated incident-response teams frequently land on the wrong side of it.
What the number leaves open and where it goes next
The study is a rear-view mirror: it measures breaches that already happened using attack methods that were already mature. The 56 percent rise in AI-enabled attacks in a single year means the next edition will be measuring a materially different threat environment.
The economics of launching an attack are falling while the cost of absorbing one keeps climbing.
After an actual breach, 64 percent of breached organizations said they plan to increase security spending, a figure that rose to 85 percent once organizations learned more about the scale of frontier AI threats. Either way, most of those decisions come after a breach rather than before it. The reactive posture is itself a cost driver, because every dollar spent in crisis mode costs more than a dollar spent in preparation.
Cutting 65 days off a breach lifecycle, which is what AI-assisted detection delivered in the IBM data, saves nearly $2 million. Understanding the real price of a clicked phishing link is the first step toward putting a number on what device-level security updates and faster patching are actually worth. The bill is no longer abstract.
