2026 年網絡安全統計：已申報損失達 $20.9B，軟件漏洞超越失竊密碼成為主要入侵途徑
Cybersecurity Statistics 2026: $20.9B in Reported Losses, and Vulnerabilities Now Beat Passwords
FBI 的 IC3 在 2025 年接獲 1,008,597 宗投訴，申報損失達 $20.877 billion，較 2024 年上升 26%。Verizon 的 2026 DBIR 指出，31% 的資料外洩始於軟件漏洞，比例超越失竊密碼；48% 涉及勒索軟件。IBM 報告的資料外洩全球平均成本為 $4.4 million，較前一年下降 9%。
The FBI's IC3 received 1,008,597 complaints in 2025, with reported losses of $20.877 billion — up 26% from 2024, an average loss of $20,699 per complaint. These are reported losses, not a complete measure of all cybercrime, but they come from a consistent federal reporting channel.
Fraud is where the money goes
Fraud dominated the financial impact: 452,868 cyber-enabled fraud complaints, $17.697 billion in losses — 45% of all 2025 complaints and 85% of all 2025 losses. Phishing and spoofing were the largest crime type by complaint count, at 191,561 complaints.
People age 60 and older filed 201,266 complaints and reported $7.7 billion in losses in 2025. Security is not only an enterprise IT problem — consumer education, fraud detection, and account-protection design matter too.
Breaches still cost $4.4M on average
IBM's 2025 Cost of a Data Breach Report puts the global average cost of a data breach at $4.4 million, down 9% from the previous year. That decline should not be oversold: breach cost varies by region, industry, data type, and detection maturity. Breaches remain expensive even when the global average moves down.
IBM also highlights AI governance risk: 97% of organizations that reported an AI-related security incident lacked proper AI access controls, and 63% lacked AI governance policies. That moves the AI security discussion away from hype and toward controls — inventory, access, approval, monitoring, and accountability.
How breaches start has changed
Verizon's 2026 DBIR says 31% of breaches now start with software vulnerabilities, surpassing stolen passwords as the top initial path. 48% of breaches now involve ransomware. And 15% of attack techniques are being bolstered by generative AI, while mobile threats show 40% higher click rates than traditional email threats.
The practical takeaway: patch by known exploitation, not only by theoretical severity. CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities with evidence of active exploitation — a useful official reference for prioritization.
The full breakdown, with each source's scope explained, is on SaaSStatsHub: https://saasstatshub.com/security/cybersecurity-statistics-2026/
Originally published with full sources at SaaSStatsHub. Free calculators for MRR, churn, CAC and LTV: https://saasstatshub.com/tools/
來源：DEV Community · dev.to