IBM's breach cost figure is a vendor estimate, not an audited total

What the document says

IBM Security's Cost of a Data Breach Report, produced with the Ponemon Institute, is the estimate most frequently quoted for what a data breach costs an organisation. The 2026 edition, as retrieved 16 September 2026, states a global average total cost of 4.99 million US dollars, which it describes as a 12 percent increase over the prior edition and a record high, attributed to higher detection, escalation and lost-business costs. Ponemon describes its own general method as combining secure web, telephone and interview-based research to build benchmark and cost-analysis studies. IBM's summary page does not itself set out the current edition's specific cost categories, sample size, countries or organisation types behind the figure, and the full methodology sits behind a report download that requires registration.

Confidence and limits

What is well established is that this is a named, recurring, vendor-sponsored estimate built from Ponemon's interview-based research method, not a government statistic or an audited accounting figure. What this account cannot confirm, because the public landing page does not disclose it, is the current edition's sample composition, its treatment of very large or very small breaches, or the precise cost categories used to build the total. Earlier editions of this study have described an activity-based costing approach across categories such as detection, notification, post-breach response and lost business, drawn from a sample weighted toward larger, better-resourced organisations; this account does not assume that description still applies without the current methodology text in hand.

Why it mattered

A single average figure travels further than the study behind it. Because the average blends breaches of very different sizes and sectors, it is commonly misapplied as a per-record multiplier to estimate a specific organisation's exposure, which the underlying research does not support. An average built from a mixed sample of mostly larger organisations does not describe a small business's likely cost, and the figure includes soft costs such as reputational and productivity loss that are themselves modelled, not measured cash outlays.

Defensive takeaway

Cite this figure as a modelled industry average, not as a formula for your own likely loss, and question any board or insurance presentation that multiplies it by your own record count.

• Is a cost-per-record figure being applied to our organisation without examining the sample it was drawn from?
• Does our own incident cost tracking distinguish hard costs, such as legal and forensic fees, from modelled soft costs?
• Have we read this year's methodology section, or only the headline number in a press summary?

An average describes a sample, not a prediction for any one organisation within it. Treating the headline figure as a benchmark to discuss, rather than a number to multiply, keeps the estimate useful without overstating what it measures.