IBM has published the Cost of a Data Breach report for 20 years. The 2025 edition studied 600 organizations across 16 countries and regions and 17 industries. Globally, the average cost fell for the first time in five years. In the United States, it hit a record.
Global average cost: $4.44M per breach, down 9% from $4.88M. United States average: $10.22M, up 9% and an all-time high. Healthcare average: $7.42M, the most expensive industry for the 14th consecutive year. Mean time to identify a breach: 181 days. Mean time to contain it: another 60. That is 241 days, about eight months, from breach to containment. 16% of breaches involved attackers using AI, most often for phishing and deepfake impersonation.
I run an engineering studio. We are not a cybersecurity firm. But every application we build handles data, and how we build it determines how vulnerable that data is.
The Numbers That Matter
Cost by country (top 5):
- United States: $10.22M
- Middle East: $7.29M
- Benelux: $6.24M
- Canada: $4.84M
- United Kingdom: $4.14M
Cost by industry (top 5):
- Healthcare: $7.42M
- Financial services: $5.56M
- Industrial: $5.00M
- Energy: $4.83M
- Technology: $4.79M
Cost by attack vector:
- Phishing: $4.80M (most common, 16% of breaches)
- Compromised credentials: $4.67M
- Supply-chain compromise: $4.91M (second most common, 15% of breaches)
- Malicious insider: $4.92M (the costliest vector)
What reduces cost:
- Extensive use of security AI and automation: saved $1.9M per breach
- Security analytics or SIEM: saved $212,061
- DevSecOps approach: saved $227,192 (the top single factor)
- Encryption: saved $208,087
The Engineering Connection
Most breach reports focus on the security team: incident response, threat detection, compliance. But the most impactful decisions happen during software development, months or years before the breach occurs.
Architecture decisions compound
A database designed without field-level encryption is vulnerable from day one. An API without rate limiting is an invitation for credential stuffing. An admin panel without MFA is a breach waiting to happen. A third-party dependency that has not been updated in 2 years carries every vulnerability discovered since the last patch.
These are not security team decisions. They are engineering decisions made during sprint planning. The IBM data is clear: taking a DevSecOps approach (security integrated into the development process) was the number one factor that reduced breach costs in the 2025 report, worth about $227,000 per breach. That is not a security tool. That is a development practice.
Dependencies are the new attack surface
15% of breaches now start with a vendor or supply-chain compromise, the second most common way in. Attackers compromise a library, an SDK, or a build tool, and every application that depends on it becomes vulnerable. Supply-chain breaches cost $4.91M on average and take 267 days to identify and contain.
We run automated dependency scanning in every CI/CD pipeline. npm audit, Snyk, or Dependabot on every build. When a vulnerability is published in a dependency we use, we know the same day. Not the same quarter. The same day.
Our own website runs on Astro with every dependency audited. When we found 9 moderate vulnerabilities in transitive dependencies during our last audit, we traced each one, confirmed they were dev-time-only (locked in @astrojs/check and @sanity/cli), and documented the decision. That is what dependency management looks like.
HTTPS and headers are not optional
Every application we deploy uses HTTPS with proper TLS configuration. Content Security Policy headers are deployed in report-only mode first, then enforced. Strict-Transport-Security ensures browsers never connect over plain HTTP.
These are not advanced security measures. They are baseline engineering practices. IBM data shows that encryption lowers the average breach cost by about $208,000. CSP headers prevent cross-site scripting. HSTS prevents downgrade attacks. These cost nothing to implement and protect against the most common attack vectors.
What We Do About It
We are a software development studio, not a security vendor. But every application we build includes security practices that directly reduce breach risk:
Security-first architecture. MFA on admin interfaces. Field-level encryption for sensitive data. Role-based access control with least-privilege defaults. Audit logging for every data access. These are not add-ons. They are built into the first sprint.
Automated dependency scanning. Every CI/CD pipeline includes vulnerability scanning. Every dependency update is tested. Every critical vulnerability is patched within the sprint it is discovered.
CSP and security headers. Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options. Deployed on every application.
HIPAA compliance when required. For healthcare clients like RiseMD and WinitClinic, we deploy on HIPAA-eligible infrastructure (AWS, GCP), sign BAAs, implement mandatory encryption, MFA for ePHI access, and maintain audit trails. The IBM data shows healthcare breaches cost $7.42M on average, more than any other industry. The compliance overhead is not optional.
Regular security audits. We run npm audit, OWASP checks, and CSP validation on every build. For production applications, we recommend annual penetration testing through a third-party security firm.
The $1.9M Savings
IBM found that organizations using security AI and automation extensively saved $1.9M per breach. That sounds like a sales pitch for security tools. What it actually means is: organizations that automated their security practices (scanning, monitoring, alerting, response) caught breaches faster and contained them more cheaply.
Automated dependency scanning is security automation. CI/CD pipelines that run security checks on every commit are security automation. Alert systems that notify the team when an anomaly is detected are security automation. These are engineering practices, not security products.
The average breach takes 241 days to identify and contain. Organizations that used AI and automation extensively cut that by 80 days. Eighty fewer days of exposure is where the $1.9M comes from.
If you're evaluating the space broadly, what AI consulting really is maps it. Our AI engineering services show what production AI work looks like when engineers run it.
The Business Case for Engineering Quality
$10.22M is the average US breach cost. $7.42M for healthcare. $4.91M for supply-chain attacks. These numbers make the case for security-conscious engineering better than any sales pitch ever could.
Every hour spent on security-first architecture, dependency scanning, CSP headers, and encrypted data at rest is an hour invested against a $4.44M global average loss. The ROI calculation writes itself.
We build software with these practices from the first commit. Not because we are a security company. Because we are an engineering company that understands what the data says about the cost of not doing it.
Last updated October 6, 2026