A new report from IBM Security today finds that the relentless rise in data breach costs continues unabated in 2023, with the global average data breach cost increasing to $4.45 million, up 15% over the last three years.

The 2023 Cost of a Data Breach Report is based on an in-depth analysis of real-world data breaches experienced by 553 organizations globally between March 2022 and March 2023. It was conducted by the Ponemon Institute and is the 18th straight year the report has been published. 

Key findings in the report included detection and escalation costs jumping 42% over the last three years, representing the highest portion of breach costs and indicating a shift toward more complex breach investigations.

According to the report, businesses are divided in how they plan to handle the increasing cost and frequency of data breaches. The study found that though 95% of studied organizations have experienced more than one breach, breached organizations were more likely to pass incident costs onto consumers — 57% — than to increase security investments, at 51%.  

It’s 2023, so naturally, artificial intelligence gets a look in, with the report covering the significant role of AI in the automation of data breach management. The interesting takeaway is that AI is good for security as organizations that extensively deploy AI experience a much shorter data breach lifecycle – 108 days less on average — compared with companies not using AI. Using AI also resulted in average data breach cost savings of nearly $1.8 million, making it the most substantial cost-saving measure in the report.

Despite the encouraging data about AI, there are still problems. Many organizations hesitate to involve law enforcement during a ransomware attack. Although it’s perhaps understandable that some companies don’t want their breaches in the public domain for fear of reputational damage, organizations not involving law enforcement faced breach lifecycles that were 33 days longer on average and incurred an additional $470,000 in breach costs.

Detecting breaches was also identified in the report as posing significant challenges for organizations, with only a third of breaches being detected by the organization’s own security team or tools. Breaches disclosed by an attacker incurred nearly $1 million more in costs and had a lifecycle of nearly 80 days longer compared with those identified internally.

“Time is the new currency in cybersecurity, both for the defenders and the attackers. As the report shows, early detection and fast response can significantly reduce the impact of a breach,” said Chris McCurdy, general manager of Worldwide IBM Security Services. “Security teams must focus on where adversaries are the most successful and concentrate their efforts on stopping them before they achieve their goals. Investments in threat detection and response approaches that accelerate defenders’ speed and efficiency – such as AI and automation – are crucial to shifting this balance.”

Image: IBM Security