The IBM and Ponemon Cost of a Data Breach report is the most quoted breach cost figure. Its 2026 edition puts the global average at US$4.99 million. Treat it as a sector wide anchor for a conversation, not as a prediction for your company, because an average hides a very wide spread.
What the headline says
IBM's report page for the 2026 edition describes the global average cost as US$4.99 million, a 12 percent increase over the previous year and a record high. It says extensive use of AI and automation in security was associated with savings of US$1.93 million compared with organizations using none. It also gives US$6 million as the average for breaches involving an AI model inversion attack.
The report is produced by IBM with the Ponemon Institute. The public landing page does not state the sample size or the exact costing method, so read the full report before you quote anything beyond the headline.
Why an average misleads
An average of breach costs is pulled upward by a few very large incidents. A company with one small database and no regulated data will not look like the average. A bank with millions of customer records will not either.
Three questions help:
- Which costs are counted? Detection, response, notification, legal, lost business and regulatory fines are different buckets. Check which ones sit in the figure.
- Which breaches are sampled? Studies built on organizations that agreed to take part can differ from the full population of incidents.
- What is the unit? Cost per incident and cost per record are different, and mixing them produces nonsense.
Using it in a budget conversation
The number is good for one job: showing that the loss side of the ledger is not trivial. It is poor for sizing a budget. For that you need your own estimate of how likely a breach is and how much it would cost you.
A simple method is to take one asset, estimate the plausible range of loss in your own terms, and put a range on the chance of it happening this year. Then compare that expected loss with what a control costs. The post on the Gordon-Loeb model shows why spend on a single asset should stay below a fraction of its expected loss, and annualized loss expectancy worked through an example shows the arithmetic.
Reading the savings claims
The US$1.93 million figure compares two groups of organizations. It does not prove that buying automation causes the saving, because organizations that invest in security tooling may also differ in size, maturity and sector. Use it as a signal that faster detection and containment tend to be cheaper, not as a promise.
What to do with this in practice
Quote the figure with its source and year. Say it is a global average. Then add one line of your own: your estimated range for your most important asset. A board hears a number it can compare with its own risk.
Safeguard's free scan at gold.safeguard.sh/scan can give you a starting inventory of known vulnerabilities in a project, which is one input to that likelihood estimate.
Quick check
Is the IBM average the cost my company would pay?
No. It is an average across a sample. Your cost depends on your data, your sector, your size and how fast you detect and contain an incident.
Can I use the average to set my security budget?
Not on its own. Use your own range for loss and likelihood on a specific asset, and use the average only as context.
Sources
Last reviewed: 19 October 2026.
