Verizon’s Data Breach 2025 Report
What Should You Be Doing?
What happened?
On 15 May 2025 Verizon published its 17th annual Data Breach Investigations Report, distilling 12,195 confirmed breaches across 139 countries. The findings are stark: ransomware now features in 44 % of all breaches (a year-on-year jump of 37 %), and the “human element” still initiates 60 % of incidents. In other words, cyber risk has become a persistent, quantifiable KPI that boards can no longer park in the IT basement.
Headline metrics at a glance
| 2025 DBIR metric | 2024 ➜ 2025 change | Why it matters |
|---|---|---|
| Ransomware present in breaches | 32 % ➜ 44 % | RaaS ecosystems mature; encryption events almost double. |
| Victims who refuse to pay | 52 % ➜ 64 % | Attackers pivot to double- and triple-extortion to maintain ROI. |
| Third-party involvement | 15 % ➜ 30 % | Supply-chain incidents now one breach in three. |
| Breaches via unpatched flaws | 1 in 6 ➜ 1 in 5 | Median perimeter-patch lag still 32 days—ample time for exploit kits. |
| Compromised BYOD devices | 38 % ➜ 46 % | Personal laptops, phones and tablets are today’s roaming insider threat. |
Why the attack surface keeps widening
-
Ransomware-as-a-Service dominates. It fuels 75 % of all system-intrusion cases while lowering the skills bar for would-be attackers.
-
Supply-chain dominoes fall faster. Vendor endpoints, cloud tools and managed-service pipes are now your easiest entry points.
-
AI turbo-charges social engineering. Synthetic phishing lures nearly doubled, and 15 % of employees paste corporate data into Gen-AI tools.
-
Patch debt piles up. Exploitation of known vulnerabilities jumped 34 % because orgs still average a month to close perimeter holes.
-
BYOD bites back. Almost half of all compromised endpoints were unmanaged personal devices—proof that configuration drift is a standing invitation.
Bottom line
The DBIR’s numbers dismantle any “low-probability” illusion: ransomware, patch debt and supplier sprawl are systemic, statistically verified hazards. If cyber resilience is not already a board-level performance metric, these figures make the case impossible to ignore.
Building Digital Resilience – The Four-Step Sprint
-
Assess – Map every exposed asset, laser-focusing on legacy VPNs and SaaS misconfigurations.
-
Prioritise – Rank fixes by business impact, not raw CVSS scores.
-
Transform – Enforce least-privilege, MFA and micro-segmentation; craft an OT/IT convergence playbook.
-
Manage – Shift to continuous monitoring with a vCISO guiding zero-trust rollout and quantum-safe crypto pilots.