The average total cost of a data breach is the combined financial impact of detection, containment, notification, lost business, and post-breach response that an organization incurs after unauthorized access to sensitive data, as measured annually by IBM’s Cost of a Data Breach Report.
IBM’s 2025 Cost of a Data Breach Report puts the global average cost of a breach at $4.44 million, a 9% drop from $4.88 million in 2024 and the first decline in five years. The United States remains the most expensive region at $10.22 million per breach, and healthcare remains the costliest industry at $7.42 million.
Key Takeaways
- The global average cost of a data breach fell 9% year over year, from $4.88 million in 2024 to $4.44 million in 2025, per IBM’s 20th annual report.
- The United States average breach cost rose to an all-time high of $10.22 million in 2025, driven by regulatory fines and slower detection.
- Healthcare remains the costliest industry for the 15th consecutive year, at an average of $7.42 million per breach.
- Mean time to identify and contain a breach fell to 241 days, the lowest in nine years, largely due to AI-assisted detection.
- Shadow AI, meaning unsanctioned employee use of AI tools, contributed to 20% of breaches and added roughly $670,000 to average costs.
What Is Driving the Global Decline in Breach Costs?
IBM attributes the 2025 decline mainly to faster detection and containment, powered by security AI and automation. Organizations using extensive security AI and automation saw materially lower costs and shorter breach lifecycles than those without it.
The improvement is uneven. While the global average fell, the U.S. average climbed to $10.22 million, the highest figure IBM has recorded, driven by heavier regulatory fines, longer investigations, and higher detection and escalation costs in that market.
How Does Breach Cost Vary by Industry?
| Industry | 2025 average cost |
|---|---|
| Industry | 2025 average cost |
| Healthcare | $7.42 million |
| Financial services | Above the $4.44 million global average |
| Public sector | Below the global average |
Healthcare has held the top spot for cost per breach for over a decade, reflecting the high value of protected health information and the stringent regulatory exposure under frameworks like HIPAA.
What Role Does AI Play in Both Attacks and Defense?
The 2025 report is the first to focus squarely on AI as both a defensive tool and an attack vector. Roughly 1 in 6 breaches involved attackers using AI, most often for phishing and deepfake impersonation, while organizations using AI-driven detection cut both cost and time to containment.
- Shadow AI, unsanctioned AI tool use by employees, factored into 20% of breaches and added an average of $670,000 to breach costs.
- AI-related breach vectors most often involve compromised applications, APIs, and plug-ins in the AI supply chain.
- Regulatory fines hit roughly a third of breached organizations, with nearly half of those fines exceeding $100,000.
How Encryption Consulting Helps
Encryption Consulting’s Encryption Advisory Services and CBOM Secure help organizations find and close the gaps that turn into breach cost, from unmanaged certificates and weak cryptography to unmonitored key material. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.
Frequently Asked Questions
What is the current average cost of a data breach?
According to IBM’s 2025 Cost of a Data Breach Report, the global average cost of a data breach is $4.44 million, down 9% from $4.88 million in 2024. The United States average is $10.22 million, an all-time high for that market.
Which industry has the highest average breach cost?
Healthcare has the highest average breach cost, at $7.42 million in IBM’s 2025 report. It has held that position for the past several years, reflecting the sensitivity of protected health information and the strict regulatory penalties that follow a breach.
Why did global breach costs fall in 2025 while U.S. costs rose?
Global costs fell mainly due to faster detection and containment enabled by security AI and automation, cutting the average detection-to-containment window to 241 days. U.S. costs rose because of heavier regulatory fines and longer investigation and escalation timelines specific to that market.
How does PKI and certificate management reduce breach cost?
Expired or mismanaged certificates create blind spots that delay detection, since encrypted traffic cannot be inspected without valid keys and certificates. Automating certificate lifecycle management closes that blind spot and shortens the time needed to detect and contain a breach.
Reduce Your Organization’s Breach Exposure
An encryption assessment from Encryption Consulting identifies the gaps in key management, certificate lifecycle, and cryptographic posture most likely to drive up breach cost. Assess your encryption strategy today.