Kaufman Rossin · Risk Advisory ServicesReport / 2026

The State of Cybersecurity 2026

The (Over)Confidence Gap

Emerging threats and trends in financial services, healthcare, technology, manufacturing and retail. Most leaders say they feel ready. This report looks at the distance between that confidence and reality, and where leadership teams can make real progress in the year ahead.

Download the full report Talk to our cyber team

Key findings

Leaders feel ready. The year’s data disagrees.

Twelve months after our last report, the numbers moved the wrong way, and the pressure spread well beyond banks and investment firms.

What leaders say

82%

of business leaders say they are prepared for cyber risk

Beazley Risk & Resilience 2026, survey of 3,500 leaders

78%

say they could fully recover financially from an attack

Beazley Risk & Resilience 2026

What the data shows

$11.5M

average cost of a U.S. data breach, up from $10.22M

IBM 2026

1 in 4

malicious breaches were AI-enabled, a 56% increase

IBM 2026

48%

of breaches involved a third party, up from 30%

Verizon 2026 DBIR

247

days on average to identify and contain a breach, the first increase in five years

IBM 2026

$1.93M

What works

Organizations that used AI and automation extensively in security operations cut breach costs by $1.93 million and identified and contained breaches 65 days faster. IBM 2026

By industry

Same threats, different pressure points

Select an industry to see its headline number, what is driving the pressure, and what to plan for.

$6.29M

Average financial sector breach cost, up from $5.56M

Financial sector, 2026$6.29M

Financial sector, 2025$5.56M

Global average, all sectors$4.99M

IBM 2026

Financial services

Finance and insurance were the second most attacked sectors for the fifth year in a row, at 27% of incidents (IBM X-Force). With Regulation S-P now fully in effect, examiners will expect investment firms to show that their incident response plans and vendor oversight programs work in practice.

Regulatory watch

SEC Regulation S-P is now in effect for all covered firms: a written incident response program, 30-day notice to affected individuals, and 72-hour notice from service providers.

What to plan for & test

Deepfake impersonation of executives in payment and wire approvals
Breaches that start at a payment processor, core provider, or cloud vendor
Testing incident response against the 30-day and 72-hour notice clocks

$6.64M

Average healthcare breach cost, the highest of any industry for the 13th year

Healthcare$6.64M

Financial sector$6.29M

Global average, all sectors$4.99M

IBM 2026

Healthcare

Healthcare breaches remain the most expensive of any industry. While the HIPAA Security Rule rewrite is delayed, enforcement under the current rule continues, and inadequate risk analysis remains one of the most commonly cited deficiencies in OCR investigations.

Regulatory watch

Final action on the HIPAA Security Rule rewrite is projected for July 2027. Many of the proposed controls, such as asset inventories, encryption, and multifactor authentication, can be built now.

What to plan for & test

An enterprise-wide risk analysis that is current and documented
Business associates with access to patient data
Legacy and connected medical systems that cannot be patched quickly

94%

PE firms that suffered financial impact from cyber risk, averaging $2.1M per incident

PE firms with financial impact94%

Larger firms with a formal cyber mandate55%

Smaller firms with a formal cyber mandate12%

Kroll 2026

Private equity

Half of PE portfolio companies face elevated or high cybersecurity risk (ACA Group 2026). A single vulnerable portfolio company can become an entry point into vendors, customers, or other companies using shared platforms.

What to plan for & test

Pre-acquisition: cyber due diligence that goes beyond a checkbox exercise
Hold period: a portfolio-wide cybersecurity baseline
At exit: evidence that cyber posture improved under your ownership

27.7%

Share of incidents, making manufacturing the most attacked industry for the fifth year

Manufacturing share of incidents27.7%

Finance and insurance share27%

Mfg. incidents via public-facing apps32%

IBM X-Force 2026

Manufacturing

Downtime is the attacker's leverage. Manufacturing also leads the mid-market ransomware count, accounting for more than a quarter of all mid-market victims (Black Kite). A ransomware attack that starts in a corporate email inbox can reach the factory floor.

What to plan for & test

Ransomware that halts production or shipping
Remote access used by suppliers and equipment vendors
Separation between office IT and operational technology

21%

Breached organizations with an incident involving an AI model or application, up from 13% a year earlier

AI model or application incidents, 202621%

Same measure, a year earlier13%

IBM 2026

Technology

AI systems are now a breach category of their own: models that process sensitive data, training pipelines that can be poisoned, and AI agents with broad system access. Fewer than half of organizations are actively securing the non-human identities that power their AI workflows.

Regulatory watch

No single U.S. framework governs AI security yet. Until one arrives, organizations should set their own AI use policy and keep an inventory of the AI tools employees are using.

What to plan for & test

Unapproved AI tools handling customer or proprietary data
Non-human identities powering AI workflows that hold broad access with little or no monitoring
AI models trained on or processing sensitive data without governance controls

$402M

Estimated hit to operating profit at Marks & Spencer after its April 2025 attack

Public reporting*Marks & Spencer estimated a £300 million hit to group operating profit in May 2025, about $402 million at both the May 2025 and current exchange rates.

Retail

One of the year’s most widely reported retail breaches started with a phone call. Attackers reportedly posed as employees to get an IT help desk to reset credentials, then deployed ransomware. The U.K. retailer paused online orders for weeks.

What to plan for & test

Identity checks at the help desk before any password or MFA reset
Outsourced IT and service desk providers
Seasonal staff and store systems with shared logins

Where to act

Five priorities for the year ahead

Each priority comes with questions your leadership team should be able to answer.

Select a number to view each priority.

Priority 01 / 05

Put (or keep) cyber risk at the top of the leadership agenda

Many of the incidents in this report were failures of oversight more than failures of technology. A quantified risk assessment gives leadership a dollar figure to work with, not just a color on a heat map, so the board conversation shifts from "Are we compliant?" to "Are we protected?"

Ask your leadership team

Can we quantify the cost of cyber risk?
Do we have a documented, prioritized risk plan, and do we track progress over time?
Who reports cyber risk to the board, and how often?
Do we have an approved AI use policy, and can we tell when it is ignored?

Priority 02 / 05

Identity remains the new perimeter

Attackers increasingly log in rather than break in. A Zero Trust mindset, where no user, device, or request is trusted by default, verifies every request, limits access to only what each role needs, and extends the same discipline to service accounts and AI agents. For mid-market companies without a dedicated security operations center, identity controls are the highest-leverage investment available.

Ask your leadership team

Could someone talk our help desk into resetting a password or MFA device?
Which accounts, human or not, hold standing administrator access?
Do we have a plan to move beyond static passwords and MFA toward phishing-resistant credentials like biometrics?

Priority 03 / 05

Rehearse your incident response before you need it

Organizations that find breaches themselves and use automation to contain them typically face substantially smaller financial consequences than those that learn of a breach from the attacker. Many mid-market companies have a plan on paper but have never run a tabletop exercise to test it under real pressure, real time constraints, and real coordination across legal, IT, and leadership.

Ask your leadership team

When did we last run a tabletop exercise with executives in the room?
Can we meet a 30-day customer notification deadline with our current process?

Priority 04 / 05

Secure AI and cloud adoption as it happens

AI tools, applications, and cloud services are finding their way into companies’ environments faster than security teams can review them. Keep an inventory of the AI tools and applications in use, apply access controls to the models and data behind them, and test continuously rather than once a year.

Ask your leadership team

Which AI tools and applications are employees using today, approved or not?
When was our environment last tested by offensive security experts trying to break in?

Priority 05 / 05

Know what your vendors can reach

Nearly half of breaches involve a third party, and a gap in a vendor’s security can become a breach in your environment. Due diligence, contract reviews, SOC reports, and access reviews should match how much of your data each vendor touches. Your vendor’s weakness is your weakness.

Ask your leadership team

Which vendors can access or store our most sensitive data, and when did we last review their security posture?
Do our contracts require prompt notice when a vendor is breached?

“The organizations that got hit the hardest were rarely the ones that thought they were vulnerable. They were the ones who were certain they were covered. … Confidence without evidence is just exposure you haven’t measured yet.”

Kory Patrick, CISSP · Principal, Risk Advisory Services

How Kaufman Rossin can help

Meet your program where it is and move it forward

Our cybersecurity practice is built on a simple principle: you cannot protect what you do not understand. Whether you need a clear picture of your current risk or a long-term partner to accelerate your program, we start by quantifying your risk, then build and execute a program around it.

Assess
Quantified Risk Assessment
A clear, dollar-denominated picture of your cyber risk, mapped to the frameworks that apply to your industry (NIST CSF 2.0, HIPAA, Regulation S-P, ISO, and others).
Design
Program Design
A prioritized roadmap of policies, controls, and governance, including incident response planning, vendor oversight, and AI use policies.
Implement
Implementation
From Zero Trust architectures to MFA, we handle the technical work so your team can stay focused on the business.
Retain
Retained Advisory
Continuous monitoring guidance, regulatory change tracking, and a direct line to our team when an incident occurs.

Partner-powered solutions: Synack for continuous, AI-powered penetration testing; NetRise for firmware and software supply chain risk analysis; Remedio for automated IT asset discovery, vulnerability management, and compliance mapping.

Also available: SOC 1 and SOC 2 examinations, HIPAA/HITECH readiness, and global data privacy compliance.

Want to learn more?

Find out where your organization actually stands.

Contact our cybersecurity team to talk about where your organization stands and what to prioritize next.

Talk to our cyber team Download the full report

Sources

Sources(9)

IBM, Cost of a Data Breach Report 2026 (July 2026) and 2025
Verizon, 2026 Data Breach Investigations Report (May 2026)
IBM X-Force Threat Intelligence Index 2026
Black Kite, “Mid-Market Is the Routine Target” (August 2026)
Kroll, “Cyber Risk at Scale: Safeguarding Portfolio Value in Private Equity” (February 2026)
ACA Group, “2026 PortCo Cyber Risk Report” (March 2026)
Beazley, Risk & Resilience: Cyber Threat and Tech Advances 2026 (April 2026)
SEC Regulation S-P amendments; HHS proposed HIPAA Security Rule (January 2025)
Public reporting on the April 2025 Marks & Spencer incident

This report is for general information only and is not legal or technical advice for any specific situation.

The (Over)Confidence Gap

Leaders feel ready. The year’s data disagrees.

Same threats, different pressure points

Financial services

Healthcare

Private equity

Manufacturing

Technology

Retail

Five priorities for the year ahead

Put (or keep) cyber risk at the top of the leadership agenda

Identity remains the new perimeter

Rehearse your incident response before you need it

Secure AI and cloud adoption as it happens

Know what your vendors can reach

Meet your program where it is and move it forward

Quantified Risk Assessment

Program Design

Implementation

Retained Advisory

Find out where your organization actually stands.

Sources

LOCATIONS

QUICK LINKS

SUBSCRIBE

Contact Us

The (Over)Confidence Gap

Leaders feel ready. The year’s data disagrees.

Same threats, different pressure points

Financial services

Five priorities for the year ahead

Put (or keep) cyber risk at the top of the leadership agenda

Meet your program where it is and move it forward

Quantified Risk Assessment

Program Design

Implementation

Retained Advisory

Find out where your organization actually stands.

Cybersecurity Team

Sources

LOCATIONS

QUICK LINKS

SUBSCRIBE

Contact Us