A door opens and no alarm sounds.
A login appears in the logs and no one flags it. For most companies hit by a data breach, the intruder is already moving through files while the normal workday carries on.
The damage accumulates for days, then weeks, then months. What this year’s data measured is how much that silence actually costs.
Why the clock matters more than the break-in itself
Organizations took an average of 241 days to identify and contain a breach in the latest reporting period, a nine-year low , yet still a window long enough to turn a single intrusion into a multimillion-dollar crisis. Every day of undetected access adds forensics work, legal exposure, regulatory scrutiny and customer churn on top of the original incident: “time really is money when it comes to breach impact,” with detection and escalation remaining the largest cost driver for data breaches for the past four years.
Breaches taking longer than 200 days to contain cost organizations an average of $1.14 million more than those resolved more quickly. That gap is, in effect, the price of slow detection alone, before a single fine, lawsuit or remediation contract is signed. The break-in itself is almost a footnote compared to what happens after the door swings open.
What $10.22 million looks like inside a US company
The average cost of a data breach for US companies jumped 9% to an all-time high of $10.22 million, while the global average fell 9% to $4.44 million. The figure is not a projection or a worst-case scenario. For a mid-sized company running a lean IT team and a modest security budget, that number lands roughly in the same range as its entire annual technology spend.
Costs include detection, escalation, notification, lost business and post-breach response. None of those line items arrive at once. They stack up across months, which is part of why the final bill surprises finance teams who had only budgeted for the immediate incident. Lawyers, regulators and lost clients keep adding to the total long after the patch is applied.
Despite a 24% year-over-year reduction in costs, healthcare remained the most heavily impacted industry overall for the 14th consecutive year, at $7.42 million. Financial services averaged $5.56 million per breach. Those sectors carry the heaviest regulatory burden and store records that fetch the highest prices on criminal markets.
Where the numbers come from and what the data actually covered
The figures draw on breaches experienced by around 600 organizations worldwide between March 2024 and February 2025 , published in the 2025 edition of the annual IBM Cost of a Data Breach Report, released on July 30. The 20th edition of a study that has tracked these economics continuously, making its year-over-year comparisons among the most reliable long-run data on breach costs available. The primary IBM report noted that organizations deploying security AI and automation saw the steepest cost reductions of any group in the study.
AI was involved in 1 in 6 breaches, most commonly to fuel phishing campaigns and create deepfakes. Shadow AI was involved in 20% of breaches and often operated without proper access controls. Among organizations that experienced AI-related breaches, 97% lacked proper AI access controls; additionally, shadow AI added an average of $670,000 to breach costs.
Third-party involvement in breaches doubled from 15% to 30% in just one year. Supply chain breaches cost organizations an average of $4.91 million and took the longest to resolve at 267 days. The attackers did not just get more numerous; they got faster and harder to catch before the 241-day clock ran out.
Where the math breaks down and who remains most exposed
The average breach lifecycle dropped to 241 days, the shortest in nine years, but 76% of organizations still needed more than 100 days to fully recover from a breach.
For those companies, the real cost runs well above any published average. Adoption of AI and automation remains uneven, with only 32% of organizations using these technologies extensively. That gap has a clear price: security AI and automation reduced breach costs by an average of $1.9 million and shortened breach lifecycles by 80 days. Skipping those tools is not a neutral decision.
Supply chains are the other widening gap. Third-party breaches now account for a meaningfully larger share of all incidents. For anyone tracking the AI-driven threat landscape, the same tools powering misinformation campaigns are now aimed directly at corporate networks. A company can harden its own perimeter and still absorb a massive bill because a vendor it trusted did not.
What the data leaves open and what most companies can do now
The IBM report captures direct costs well, but the longer reputational tail remains hard to quantify. Customer churn after a breach can run for years, and the IBM methodology closes its accounting window before that full damage registers.
The $10.22 million US average is almost certainly a floor, not a ceiling. The counterweight is real: organizations using AI tools extensively cut their breach lifecycle by 80 days and saved nearly $1.9 million on average , yet most organizations have not adopted these tools at scale. As the broader sector debates next-generation security architectures, the most immediate saving available to most companies is already known, priced and waiting to be deployed.
Every day of undetected access lengthens the bill. Faster detection is one of the most effective ways to reduce breach-related financial impact , and that single finding makes the case more plainly than almost anything else in the report.
