Cybersecurity Statistics 2026: Published Flaws Doubled, and Federal Patch Deadlines Fell to 3 Days
These cybersecurity statistics 2026 each trace to a primary dataset. The National Vulnerability Database published 74,838 CVEs from January to September 2026, 103% more than a year earlier. CISA confirmed only 255 new exploited flaws through Oct 8, 2026, but now gives agencies as little as 3 days to fix them, and the FBI logged $20.9 billion in 2025 cybercrime losses.
This page is built so that every number has a path back to its data. It has 70 numbered figures, and every card names its primary source in a chip you can click. 50 come from 21 of our own research reports, each linked from the card as the analysis. The rest we read directly from the FBI, CISA, and the UK government for this page, plus 3 clearly labeled figures from Verizon’s own breach dataset. We also computed fresh numbers from CISA’s live catalog, including a sharp change in federal patch deadlines.
What changed in 2026, like for like
Comparing the same months of 2026 and 2025 separates growth from partial-year noise. Vulnerability disclosure roughly doubled in the NVD and tripled at Microsoft. Evidence of exploitation rose by about a third, Microsoft’s exploited zero-days held flat, and large healthcare breaches ran slightly behind 2025.
The gap between the top two bars and the rest is the main story for anyone setting patch priorities. Published vulnerabilities rose 103%, but CISA’s list of flaws with evidence of real attacks grew 30%. In Microsoft’s own data, 2,859 CVEs were fixed in nine months while the exploited count went from 20 to 19. A team that patches by volume falls behind; a team that patches by exploitation evidence has a list that grew far more slowly.
01Vulnerabilities
Disclosure volume is the most quoted number in this field and the easiest to misread. The NVD count doubled, but much of that is more organizations numbering their own flaws, and NIST now scores only a small share of new records.
New CVE records published to the National Vulnerability Database from January 1 to September 30, 2026, already more than in any previous full year, according to our CVE statistics analysis.
Growth in published CVEs over the same nine months of 2025 (36,824), which we rechecked month by month against the NVD API in October 2026.
CVEs published in September 2026 alone, the highest monthly total since at least January 2025; monthly publications rose every month from April.
CVEs published in calendar 2025, about 2.6 times the 19,222 published in 2020.
Share of sampled August 2026 CVEs that carried a severity score from NIST itself, down from 82% in early 2023. Counts of critical flaws built only on NIST scores now badly undercount, as our sampling of NVD records shows.
Organizations on the CVE Program’s published list that may assign CVE IDs. 453 are vendors numbering flaws in their own products, so CVE totals measure disclosure activity as much as risk.
Vulnerabilities Microsoft assigned and fixed in the first nine months of 2026, up 219% from 896 in the same months of 2025, in our count of every Patch Tuesday release.
Microsoft-assigned CVEs in the September 2026 Patch Tuesday, the largest monthly release since our series began in January 2021.
02Exploitation
Exploitation is the better risk signal. CISA’s catalog lists only flaws with evidence of real attacks, and it grew far more slowly than the disclosure count.
Entries in CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.08, each backed by reliable evidence of exploitation in the wild. Our analysis of the full catalog breaks them down by vendor and age.
Vulnerabilities CISA added to the catalog in 2026, 30% more than the 196 added by the same date in 2025 and already above the 245 added in all of 2025.
Microsoft CVEs flagged as exploited in the wild in 2026, against 20 in the same months of 2025. The patch count tripled; the zero-day count did not.
Rate at which 2026 Microsoft CVEs were exploited before a fix existed, compared with 1 in 45 a year earlier, as our Patch Tuesday ledger calculates.
Microsoft products in the KEV catalog, the most of any vendor and nearly four times Cisco’s 100. The catalog spans 288 vendors.
Share of ransomware-linked KEV entries in firewall, VPN, and remote-access products, against 15.8% of the whole catalog, in our vendor analysis of every KEV entry.
2026 KEV additions for CVEs numbered in 2021 or earlier. Across the catalog, 21.3% of entries were added five or more years after the CVE was assigned.
Share of breaches with a known initial access vector that started with exploitation of a vulnerability, now the top vector in Verizon’s own 2026 DBIR dataset, while credential abuse fell to 13%.
03Ransomware
Ransomware complaints to the FBI rose again in 2025, and CISA’s joint advisories show how groups get in: mostly through exposed applications and remote access, with phishing second.
Ransomware complaints to the FBI’s Internet Crime Complaint Center in 2025, up 14% from 3,156 in 2024 and 2,825 in 2023, as tracked in our multi-year look at FBI ransomware reports.
Ransomware losses victims reported to IC3 in 2025 ($32,320,105), up from $12.5 million in 2024. The FBI says the figure does not normally include lost business, time, or remediation costs.
Ransomware complaints to IC3 from the healthcare and public health sector, the most of any critical infrastructure sector, ahead of critical manufacturing with 355.
New ransomware variants the FBI identified through IC3 complaints in 2025, an average of 5.25 a month. Akira was the most reported variant.
Share of the more than 1,400 ransomware complaints from organizations outside critical sectors that came from legal services, the top industry, ahead of contracting services at 17%.
Share of CISA #StopRansomware advisories listing exploitation of a public-facing application as initial access (16 of 22), the top entry route in our coding of all 25 advisories.
Advisories in which initial access included an exploited internet-facing application or an external remote service such as a VPN or RDP gateway (20 of 22).
Advisories that list phishing as an entry route (13 of 22): common, but second to exploits, and most groups use more than one door.
Share of breaches in Verizon’s 2026 DBIR dataset that involved ransomware, up from 44% the year before. In the same dataset, 69% of ransomware victims did not pay.
04Breaches
Breach counts depend on who is counting. These come from a federal regulator’s portal, a public breach catalog, a government survey, and FBI complaints, each with its own scope.
Breaches of 500 or more health records reported to HHS in 2025, the most in any year since reporting began in 2009. Hacking caused 80.8% of them, in our analysis of the HHS breach portal.
Individuals affected by large healthcare breaches reported in 2025, down from 290.1 million in 2024, the year of the Change Healthcare breach.
Share of 2025 healthcare breaches with a business associate present, the vendor category that includes MSPs with access to patient data. Those breaches covered 64% of everyone affected.
Healthcare breaches reported to HHS so far in 2026, 6% fewer than the 605 reported by the same date in 2025. Hacking caused 85.3%, up from 80.8% in 2025.
Accounts across the 980 verified breaches in Have I Been Pwned. One person can appear in many breaches, so this counts accounts, not people.
Share of breaches added to Have I Been Pwned in 2026 that expose passwords, down from 86% of those added in 2016 to 2019, per our breakdown of 980 HIBP breaches.
Share of 2026 HIBP additions that include phone numbers, now ahead of passwords: raw material for SMS phishing, voice phishing, and help desk impersonation.
Share of UK businesses that identified a cyber breach or attack in the previous 12 months, about 612,000 firms, in the UK government’s official survey. Among large businesses it was 69%.
Share of breaches in Verizon’s 2026 DBIR dataset with third-party involvement, up 60% on the prior year’s dataset. Every MSP is a third party to its clients.
05Phishing, BEC and fraud
By dollars, the FBI’s data is dominated by fraud, not malware. Business email compromise alone was reported at about 94 times the ransomware loss figure in 2025, though ransomware losses are known to be badly under-reported.
Losses reported to the FBI’s IC3 in 2025 ($20.877 billion), up 26% from 2024, across 1,008,597 complaints.
Share of 2025 IC3 losses from cyber-enabled fraud ($17.7 billion), even though fraud made up 45% of complaints.
Phishing and spoofing complaints to IC3, the most reported crime type in 2025, though down from 298,878 in 2023.
BEC losses reported in 2025 ($3,046,598,558) from 24,768 complaints, the second-largest loss category and 10% above 2024.
Investment fraud losses reported to IC3 in 2025, the largest category. Cryptocurrency investment fraud alone accounted for $7.2 billion.
Losses in 2025 complaints involving cryptocurrency, from 181,565 complaints: more than half of everything reported to IC3.
Losses reported by complainants aged 60 and over in 2025 ($7.748 billion), up 59% from 2024, from 201,266 complaints averaging $38,500.
Losses in IC3 complaints that referenced artificial intelligence, across 22,364 complaints. Businesses reported more than $30 million lost to BEC scams involving AI.
Success rate of the FBI Recovery Asset Team’s Financial Fraud Kill Chain, which froze $679 million of $1.16 billion in attempted fraudulent transfers. Speed of reporting decides recovery.
Share of UK businesses hit by phishing in the previous 12 months, by far the most common type of breach or attack and the most disruptive for 69% of those breached.
Share of UK businesses with two-factor authentication in place, against 81% with updated malware protection, in the same official survey.
06Regulation and disclosure
Disclosure rules and enforcement are tightening on timing. The clearest 2026 change in our data is how little time federal agencies now get to fix exploited flaws.
Original Form 8-K Item 1.05 disclosures of material cybersecurity incidents, filed by 57 public companies, in our tracker of every Item 1.05 filing.
Item 1.05 filings in the second and third quarters of 2026, seven in each, the highest two-quarter total since the first half of 2024.
Share of 2026 KEV additions that gave federal agencies 3 days or less to remediate under BOD 22-01 (132 of 255). In 2025, 92% carried the standard 21 days. This is our own count from the catalog’s due dates.
KEV entries given the long-standing 21-day deadline after March 5, 2026. All 203 additions since then carry 14 days or less, and 78 of the 100 added in July to September carry 3 days or less.
HHS Office for Civil Rights actions in 2025, a record, with 17 announced as ransomware, hacking, phishing, or Security Rule cases, per our ledger of every OCR penalty.
Median verified HIPAA settlement or penalty in 2024 to 2026, 85% below the $1,600,000 median of 2016 to 2019. More cases, smaller amounts.
OCR enforcement actions with ransomware in their HHS title since the first one on October 31, 2023.
Median time from discovering a breach to notifying the Washington Attorney General in 2025 filings, up from 36 days in 2020, against a 30-day statutory limit, in our study of 1,675 Washington notices.
Share of 2025 Washington notices filed more than 30 days after discovery. The law allows some delays, and the data does not record which exception applied.
Median discovery-to-notice time for ransomware breach notices filed in Washington in 2024 to 2026, up from 36 days in 2020 to 2021. Other breach types barely slowed.
07Workforce
Is cybersecurity oversaturated in 2026? The BLS still projects fast growth for security analysts, while broader tech hiring is slow and routine support roles are projected to shrink.
Projected growth in information security analyst jobs, adding 40,600 positions, much faster than average, per the BLS Occupational Outlook Handbook and our IT jobs outlook.
Median annual pay for information security analysts, who held 192,900 jobs in 2025.
Projected change for computer support specialists (903,100 jobs in 2025). Network and computer systems administrators are projected to fall 4%.
Median information security analyst pay in Washington, the highest of any state, against $81,950 in Montana, in our state-by-state IT pay matrix.
Median security analyst pay in San Jose, the top-paying metro. Washington, DC is the largest market, with 16,560 analysts at $148,950, per our metro pay leaderboard.
Median GSA contract ceiling rate for cybersecurity analyst labor, against $76 for help desk and $152 for penetration testers, in our rate card of 23,033 federal labor rates.
Drop in information sector job openings from the April 2022 peak of 274,000 to 123,000 in August 2026, while the sector’s 2026 layoff rate (1.74%) ran above the national 1.07%, per our JOLTS labor dashboard.
08MSP market
The managed services market behind these numbers: more firms, fewer staff per firm, higher wages, and modest revenue growth compared with hosting and software.
Establishments in NAICS 541513, the industry code closest to MSPs, up 10.6% from 6,304 in Q1 2023, in our MSP industry census.
Change in private employment in the same industry, from 79,383 to 75,313: more firms, fewer people.
Rise in the industry’s average weekly wage, from $2,892 to $3,306, which raises the labor cost inside every flat-rate contract.
U.S. establishments in computer systems design and related services, employing 2,050,626 people at average pay of $122,296, mapped in our census atlas of IT services firms.
Year-over-year revenue growth for computer systems design and related services ($195.5 billion in the quarter), against 20.4% for data processing and hosting, in our IT services growth analysis.
Civilian agency contract obligations for IT services in fiscal 2026, up 9.6% and the highest in the series, in our federal IT spending ledger.
Share of U.S. business and government wireline voice connections that run on interconnected VoIP, up from 3.2% in 2008, per our analysis of FCC voice data. Phone systems are now network assets to secure.
Share of U.S. counties designated in at least one major FEMA disaster declaration in a decade, after a record 100 declarations in 2024, in our FEMA continuity analysis.
The patch deadline change, month by month
Under Binding Operational Directive 22-01, each KEV entry carries a date by which federal civilian agencies must fix it. Through 2025, nearly every entry got 21 days. Counting the due dates in the catalog, that changed in early 2026: 132 of 255 entries added in 2026 carry 3 days or less, and none added after March 5 carries more than 14 days. The catalog records the dates, not the reason, so we report the change without attributing a cause.
21 days4 to 12 days14 days3 days or less
Private organizations are not bound by the directive, but the catalog is widely used as a patch priority list. If the federal clock is now 3 days for most new entries, a 30-day patch cycle leaves an exploited flaw open roughly ten times longer than agencies are allowed.
Source register
Every primary source behind the 70 figures, how many cards use it, and the Uptime Report analysis that goes deeper. Chips on each card link to the same sources.
What this means for MSPs
Patch by exploitation, on a shorter clock. With 74,838 CVEs in nine months, severity scores alone cannot set priority, especially when NIST scores only about 10% of new records. Feed the KEV catalog into your RMM or vulnerability scanner and treat a KEV hit on an internet-facing device as an emergency change; the federal deadline for most new entries is now 3 days.
Edge devices first. Exposed applications and remote access gateways appear in 91% of CISA’s ransomware advisories that list initial access, and edge vendors are overrepresented among ransomware-linked KEV entries. Firewalls, VPNs, file transfer servers, and remote management tools belong at the top of the queue, with MFA on every remote login.
Sell fraud controls, not only malware controls. BEC losses reported to the FBI ($3.05 billion) dwarf reported ransomware losses. Payment verification by phone, mailbox rule monitoring, and fast reporting matter: the FBI’s Financial Fraud Kill Chain froze 58% of the attempted theft it handled in 2025.
Remember you are the third party. In 2025, 35% of large healthcare breaches involved a business associate, and Verizon’s dataset puts third-party involvement at 48% of breaches. Client contracts, cyber insurance questionnaires, and HIPAA risk analyses will keep asking how the MSP itself is secured.
Plan for the bill and the clock. Washington breach notices now take a median 134 days to file, and ransomware cases 165. Incident response retainers, forensic access, and tested backups decide how fast a client can meet notice deadlines. For continuity planning, 85% of U.S. counties had a major disaster declaration in the last decade.
Frequently asked questions
Will cyber attacks increase in 2026?
The available 2026 measures mostly point up. CISA added 255 exploited vulnerabilities to its catalog through Oct 8, 2026, 30% ahead of the same point in 2025, and published CVEs rose 103% from January to September. FBI-reported losses rose 26% in 2025 to $20.877 billion. One counter-signal: large healthcare breaches reported to HHS were running 6% behind 2025 through Sep 21.
How many cyber attacks happen per year?
No dataset counts every attack. The closest U.S. measure is complaints to the FBI’s IC3, which received 1,008,597 in 2025, about 2,760 a day. In the UK government’s survey, 43% of businesses identified a breach or attack in the previous 12 months.
What is the most common type of cyber attack?
By complaint count, phishing and spoofing: 191,561 IC3 complaints in 2025. In the UK survey, phishing hit 38% of businesses. For ransomware entry specifically, exploitation of public-facing applications led, appearing in 16 of 22 CISA advisories that list initial access (73%).
Where do 90% of all cyber incidents begin?
We found no primary dataset that supports a 90% figure for any single starting point. In Verizon’s 2026 DBIR dataset, exploitation of vulnerabilities was the initial access vector for 31% of breaches with a known vector, and phishing for 16% of breaches. In CISA’s ransomware advisories, 77% list two or more entry routes.
Is cybersecurity a good career in 2026?
By BLS data, security analyst jobs are projected to grow 21% from 2025 to 2035, adding 40,600 positions, with a 2025 median pay of $129,180. The wider tech market is slower: information sector job openings were 55% below their 2022 peak in August 2026. This is published labor data, not career advice.
How much does cybercrime cost each year?
Losses reported to the FBI’s IC3 reached $20.877 billion in 2025, up 26% from 2024. Investment fraud ($8.65 billion) and business email compromise ($3.05 billion) were the largest categories. Reported ransomware losses were $32.3 million, a figure the FBI says excludes downtime and remediation.
Methodology
What we did. On October 13, 2026 we downloaded the live text of all 21 Uptime Report research reports and took each headline figure together with the primary dataset it was computed from. We then read primary sources directly for figures our reports do not cover: the FBI IC3 2025 Internet Crime Report (PDF), the UK Cyber Security Breaches Survey 2025/2026 (published April 30, 2026), the BLS Occupational Outlook Handbook, and the Verizon 2026 Data Breach Investigations Report. Before the page is generated, the build script checks that every quoted figure appears word for word in the saved copy of its source; a mismatch stops the build.
Our own computations. KEV figures use the CISA catalog JSON feed, version 2026.10.08 (1,739 entries). Deadline length is dueDate minus dateAdded in days. CVE counts use the NVD CVE API 2.0 totalResults for each calendar month by publish date, January 2025 to September 2026, which reproduce the 49,972 (2025) and 74,838 (January to September 2026) totals in our CVE report exactly. Healthcare 2026 figures use our extract of the HHS OCR breach portal (8,009 breaches, latest submission September 21, 2026) and compare January 1 to Sep 21 in both years.
Periods. Every card carries its own period. Calendar-year figures are labeled with the year; partial-year figures are compared only with the same dates a year earlier. Federal fiscal years run October to September. The Verizon DBIR covers incidents from November 1, 2024 to October 31, 2025.
Limitations. Complaint and breach counts measure what was reported, not everything that happened. IC3 losses are victim-reported and exclude most downtime and recovery costs. KEV inclusion depends on CISA’s evidence threshold. HHS covers only breaches of 500 or more health records; Washington notices only breaches affecting more than 500 residents. Verizon’s DBIR is one company’s dataset of incidents from its own caseload and contributors, used here for 3 figures and labeled as such. The UK survey reflects breaches organizations identified and chose to report.
Not advice. This is a compilation of public data, not security, legal, or career advice.
Cite as:The Uptime Report. "Cybersecurity Statistics 2026: Published Flaws Doubled, and Federal Patch Deadlines Fell to 3 Days." October 2026. https://theuptimereport.com/cybersecurity-statistics-2026/
References
- NIST, NIST National Vulnerability Database. Accessed October 2026.
- CVE Program, CVE Program list of CNAs. Accessed October 2026.
- Microsoft Security Response Center, Microsoft Security Update Guide. Accessed October 2026.
- CISA, CISA Known Exploited Vulnerabilities catalog. Accessed October 2026.
- CISA, KEV catalog JSON feed, version 2026.10.08. Accessed October 2026.
- CISA, Binding Operational Directive 22-01. Accessed October 2026.
- CISA, FBI and partner agencies, CISA #StopRansomware advisories. Accessed October 2026.
- FBI Internet Crime Complaint Center, FBI IC3 2025 Internet Crime Report. Accessed October 2026.
- HHS Office for Civil Rights, HHS OCR breach portal. Accessed October 2026.
- HHS Office for Civil Rights, HHS OCR resolution agreements and penalties. Accessed October 2026.
- Have I Been Pwned, Have I Been Pwned breach catalog. Accessed October 2026.
- Washington State Attorney General, Washington AG data breach notices. Accessed October 2026.
- U.S. Securities and Exchange Commission, SEC EDGAR, Form 8-K Item 1.05. Accessed October 2026.
- UK DSIT and Home Office, UK Cyber Security Breaches Survey 2025/2026. Accessed October 2026.
- Verizon, Verizon 2026 DBIR. Accessed October 2026.
- U.S. Bureau of Labor Statistics, BLS Occupational Outlook Handbook. Accessed October 2026.
- U.S. Bureau of Labor Statistics, BLS Occupational Outlook Handbook. Accessed October 2026.
- U.S. Bureau of Labor Statistics, BLS OEWS, May 2025. Accessed October 2026.
- U.S. General Services Administration, GSA CALC+ labor rates. Accessed October 2026.
- U.S. Bureau of Labor Statistics, BLS JOLTS. Accessed October 2026.
- U.S. Bureau of Labor Statistics, BLS QCEW. Accessed October 2026.
- U.S. Census Bureau, Census County Business Patterns. Accessed October 2026.
- U.S. Census Bureau, Census Quarterly Services Survey. Accessed October 2026.
- U.S. Department of the Treasury, USAspending.gov. Accessed October 2026.
- Federal Communications Commission, FCC voice subscription data. Accessed October 2026.
- FEMA, FEMA OpenFEMA declarations. Accessed October 2026.
- U.S. Bureau of Labor Statistics, Occupational Outlook Handbook, Network and Computer Systems Administrators. Accessed October 2026.
- U.S. Securities and Exchange Commission, press release 2023-139 on cybersecurity disclosure rules. Accessed October 2026.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Ransomware Statistics 2026
Leak-site victims by month since 2021 - Malicious npm Packages
Malicious npm packages, day by day - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021 - Disaster Declarations by State
FEMA data for continuity planning - Data Breach Statistics 2026
980 breaches in Have I Been Pwned - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend
Infrastructure and uptime
- Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version
Regulation and disclosure
- SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement
Workforce and pay
- Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections
MSP market and spending
- Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas
Leave a Reply