Loading story…
Cyentia Institute argued that widely cited single-number metrics like an “average cost per record” (e.g., figures popularized in annual breach-cost studies) are frequently misleading because breach losses and record counts are highly skewed. Using incident data spanning roughly the last 15 years, Cyentia illustrated that applying a single per-record average can produce large estimation errors for many events—especially those outside the narrow scope where such averages are even intended to apply—undermining its usefulness for budgeting, risk quantification, and executive decision-making.
Separately, ProcessUnity’s State of Third-Party Risk Assessments 2026 survey (conducted by Ponemon Institute) reported that 90% of organizations experienced at least one third-party breach in the prior year, with respondents indicating an average of 12 third-party breaches per year. The report also described operational gaps that can contribute to this exposure, including long assessment cycles (often 4+ months), limited vendor coverage (organizations assessing about 36% of vendors on average), and heavy reliance on manual methods (e.g., spreadsheets), despite over half of respondents expressing confidence in their third-party risk management programs.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Cyentia published updated analysis of roughly 15 years of breach data, concluding that single average cost-per-record estimates frequently produce large errors and recommending medians, quantiles, or full loss distributions instead.
ProcessUnity's State of Third-Party Risk Assessments 2026 report found organizations experienced an average of 12 third-party breaches per year, while assessments were often slow, incomplete, and heavily manual.
The 2025 Ponemon Cost of a Data Breach Study reported an average cost-per-record figure, which Cyentia later said was only applicable to a limited subset of incidents and inaccurate outside that scope.
Cyentia's IRIS 2022 report again challenged the practice of applying a single average cost-per-record figure to estimate breach losses, reinforcing that the metric performs poorly across varied incidents.
Cyentia's IRIS 2020 report argued that using a single average cost per record to estimate cyber incident losses is misleading because breach costs and record counts are highly skewed across incidents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Barracuda report revealed that 78% of organizations experienced an email breach in the past year, with phishing, impersonation, and account takeover attacks leading to significant business disruption, data loss, and reputational harm. The report highlights that smaller firms bear a higher per-employee cost for breach recovery, and slow detection of email-based threats is closely linked to increased ransomware risk, with 71% of breached organizations also suffering ransomware attacks. The average cost of recovery varies by company size, but the consequences—ranging from lost business to prolonged reputational damage—are widespread across industries. In a notable example, Volvo Group North America was affected by a data breach originating from its third-party HR software provider, Miljödata. Sensitive employee data, including Social Security numbers, was exfiltrated, and the incident exposed delays in detection and notification, raising concerns about forensic readiness and incident response maturity. Volvo responded by offering identity protection services to affected employees, but the breach underscores the critical need for rapid, integrated forensic response and robust communication protocols, especially when third-party vendors are involved.
Jul 12, 2026
A *Panorays* survey of 200 U.S. CISOs reported rising **third-party security incidents** alongside major visibility gaps across extended vendor ecosystems. In the findings cited by Help Net Security and SC Media, **60%** of CISOs said third-party incidents increased over the past year, while only **15%** said they have full visibility into third-party risk across deeper supply-chain tiers (third-, fourth-, and beyond). The reporting emphasizes that vendor dependencies now span core functions (cloud, software development, data processing, and AI services), expanding attack surface and enabling attackers to exploit less-monitored downstream relationships such as subcontractors and affiliates. The survey also pointed to weak preparedness and governance as compounding factors: while **77%** of CISOs view third-party risk as a major threat, only **21%** reported having tested crisis response plans, and only **41%** monitor risk beyond direct suppliers. Both articles highlight **unmanaged/“shadow” AI tools** as an emerging third-party risk driver, with only **22%** of organizations having formal AI vetting processes and **60%** of respondents identifying shadow AI as uniquely risky—creating new, poorly understood pathways for supply-chain compromise and regulatory exposure.
Jun 29, 2026
IBM’s **2026 Cost of a Data Breach Study** found that the average global cost of a data breach rose **12% year over year** to nearly **$5 million**, while the **United States** recorded the highest national average at **$11.5 million**. **Healthcare** remained the most expensive sector globally at **$6.64 million per breach**, even after a 10.5% decline from the prior year, and **phishing** was identified as the most common initial access vector across industries, with an average breach cost of **$5.9 million**. The report said breach **identification and containment times increased** for the first time in five years, with **removable media** and **supply chain compromises** taking the longest to resolve. It also found that **AI-driven attacks** rose **56%** year over year, affected **one in four organizations**, and added roughly **$1 million** to average breach costs, while **shadow AI** incidents more than doubled. **Ransomware** remained a major driver of losses, with **39%** of breached organizations reporting at least one ransomware attack in the past year and attackers increasingly using **data leaks** and **public shaming** to pressure victims into paying.
Aug 4, 2026