U.S. average — an all-time high
The average cost of a breach at a U.S. organisation, across detection, response, business interruption, lost customers, regulatory penalties, legal expenses, notification and recovery.
IBM 2025 ›Industry —
Sensitive documents they cannot take back
—
—
If one breach lands—
—
Carried every year expected value—
Already gone files outside control today—
Their exposure against the published average
This business
—
U.S. average breach
$10.22M
—
The part nothing else fixes
—
Illustrative. Anchored on IBM Cost of a Data Breach 2025.
Every assumption behind those numbers
Nobody counts their files, so these are the numbers worth arguing about. Change any of them and everything above moves.
The estate
What one breach does
A breach does not spill the whole estate — this is the bridge between a file count and a credible number.
Illustrative, in USD. This page counts exposure only — it makes no claim about what any product saves. For that, and for what it costs, use the savings calculator.
Where these numbers come from
One published anchor, and a file-count model on top of it. Both labelled, so nobody has to guess which is which.
What a breach costs
PublishedIBM Cost of a Data Breach 2025Healthcare
The most expensive sector, year after year.
IBM 2025 ›Global average
All industries worldwide — well under the U.S. figure.
IBM 2025 ›
The number above is the incident. It is not the exposure.
$10.22M is what it costs to handle a breach — investigate it, notify people, answer the regulator, win back customers. It says nothing about what the escaped documents do for the rest of their life. A file that leaves without control can be copied, resold, re-leaked and produced in litigation years after the incident is closed and the cheque is cashed. Every other control on the market is spent by the time that starts. That is the exposure this page counts, and it is the only one that does not end.
Size bands, for conversation. Micro 1–19 · Small 20–99 · Medium 100–499 · Large 500–999 · Enterprise 1,000+. Useful for framing a room; not an IBM finding — IBM publishes no headcount-to-cost formula, and nothing on this page is calculated from a band.