PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Data breach costs in 2026: beyond IBM's global average
A global average starts the discussion. A budget needs to show which services could stop, who works on the response and what supports each estimate.
By Pentesty
What IBM measured in 2026
An October 15 TI Inside report revisited the cost of a data breach. This analysis uses the global figures confirmed on IBM’s public pages and proposes comparing them with the company’s own operation.
In its July 29, 2026 announcement, IBM reported a global average breach cost of US$4.99 million. The public report page states a 12% increase. Conducted by Ponemon Institute and sponsored and analyzed by IBM, the study examined breaches at 602 organizations between March 2025 and February 2026. That scope describes the group studied without establishing the cost for any particular business.
Choose an operation before choosing a number
In Pentesty’s analysis, the starting point is a function the business recognizes: approving orders, retrieving contracts or releasing payments. Identify the systems, people and providers needed to complete it. Converting the global average into Brazilian reais preserves an external average; it does not establish local exposure.
Define a bounded assumption, such as the order integration being unavailable for one shift. Record normal volume, the operational alternative, its capacity and the estimate’s owner. Our article on loss estimates and decision quality helps distinguish a scenario, an observed expense and a value that remains unknown.
Build an estimate without charging the same loss twice
Separate additional spending from the allocation of internal work. An hour of staff time may displace another deliverable without creating a new cash payment. Present those perspectives in different columns, with the rule used to value each.
Connect every entry to an activity, period and evidence. If the same interruption appears under staff hours and operational loss, explain which effects each line represents before adding them together.
- Response: internal hours and contracted services, without repeating the same activity under both.
- Recovery: work, temporary resources and validation needed to return the function to the business.
- Operations: permanently lost orders separated from delayed orders and the work required to reconcile them.
- Other expenses: estimates from identified owners, distinguishing confirmed amounts from contingencies.
Treat time as an assumption you can check
Write down when the clock starts and which outcome stops it. Receiving an alert, deciding on containment, restoring data and confirming an order are different milestones. Identify parallel tasks too: adding their durations as though they were sequential can distort the scenario.
Compare alternatives under the same starting conditions. If a proposal shortens access revocation, examine which stage changes and whether a later approval still constrains resumption. Record plausible ranges and dependencies without turning the best laboratory result into a guaranteed deadline.
Produce evidence through a comparable exercise
NIST SP 800-61 Rev. 3 integrates incident response recommendations into cybersecurity risk management. For budgeting, Pentesty proposes choosing an authorized exercise with fictional data, an observable objective and defined boundaries.
Record the initial version, exercise conditions and who can authorize each action. Repeat the same workflow after the proposed change, keeping inputs, load and completion criteria comparable. Retain timestamps, accepted or denied operations and confirmation from the service owner. Document any difference that prevents a direct comparison.
An investment decision needs to state what remains unknown
A difference between groups of companies does not demonstrate that adopting AI will cause the same savings in your organization. If a tool automates response, assess authorized effects, errors and return to the previous procedure. The action boundaries for AI in incident response belong in that assessment.
Present the requested investment, observed effect and remaining assumptions. Improvement at one stage does not establish an equivalent reduction in the cost of every incident. Define who will review the decision and which changes in volume, integrations or team membership require repeating the exercise.
Frequently asked questions
Can I use US$4.99 million as my company’s budget?
Use the global average as context. Your budget needs a local scenario, identified costs and explicit assumptions about interruption and recovery.
How can we avoid double counting?
Connect each amount to an activity, period and effect. Separate payments, allocated work, delayed orders and permanent losses before consolidating them.
Does the difference associated with AI use prove financial return?
A comparison between groups does not establish a causal return for your operation. Assess the change’s effects, its costs and the test’s limitations.
Does an exercise need to interrupt production?
Begin in an authorized, representative environment with fictional data. Record what was not exercised and avoid generalizing the result to the entire operation.
Sources and references
- IBM: public summary of the 2026 Cost of a Data Breach Report
- IBM: July 29, 2026 global announcement
- NIST SP 800-61 Rev. 3: incident response and risk management
- TI Inside: October 15, 2026 report
Original Pentesty analysis, published October 18, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.