The Uptime report

Author: chrisomo

  • 99.9% Uptime Allows 43.8 Minutes of Downtime a Month, and a Full-Day Outage Earns a Median 25% SLA Credit

    Uptime Report Research · The Nines Ladder

    99.9% Uptime Allows 43.8 Minutes of Downtime a Month, and a Full-Day Outage Earns a Median 25% SLA Credit

    99.9% uptime allows 43m 48s of downtime in an average month, 10m 5s a week and 8h 45m 36s a year. That is the arithmetic every calculator shows. We also read the current SLA documents of 12 providers MSPs depend on: 13 of 35 published commitments sit at exactly 99.9%, and a full 24-hour outage earns a median credit of 25% of that service’s monthly fee.

    8h 45m 36sper year
    2h 11m 24sper quarter
    43m 48sper month
    10m 5sper week
    1m 26sper day

    99.9% uptime, allowed downtime. Year = 365 days; quarter = 91.25 days; month = 730 hours (one twelfth of a year). In a 30-day month the allowance is 43m 12s.

    13 of 35published SLA commitments set at exactly 99.9%, the most common level
    10%median credit for the first breach, as a share of that service’s fee
    $2.00 vs $302Exchange Online credit vs one workday of payroll per user, after an 8-hour outage
    99.70%combined availability of three 99.9% services in series

    The nines ladder: downtime at every availability level

    Each step up the ladder cuts allowed downtime by a factor of 10 (99.5% and 99.95% are the half steps). The month column uses an average month of 730 hours so that twelve months add up to the year; because most SLAs count calendar months, the 30-day column is also shown.

    AvailabilityYearQuarterMonth30-day monthWeekDay
    99%two nines87h 36m21h 54m7h 18m7h 12m1h 40m 48s14m 24s
    99.5%two and a half nines43h 48m10h 57m3h 39m3h 36m50m 24s7m 12s
    99.9%three nines8h 45m 36s2h 11m 24s43m 48s43m 12s10m 5s1m 26s
    99.95%three and a half nines4h 22m 48s1h 5m 42s21m 54s21m 36s5m 2s43s
    99.99%four nines52m 34s13m 8s4m 23s4m 19s1m8.64s
    99.999%five nines5m 15s1m 19s26s26s6.05s0.86s
    30 s1 min10 min1 h10 h99%: 7h 18m of downtime in an average month99%7h 18m99.5%: 3h 39m of downtime in an average month99.5%3h 39m99.9%: 43m 48s of downtime in an average month99.9%43m 48s99.95%: 21m 54s of downtime in an average month99.95%21m 54s99.99%: 4m 23s of downtime in an average month99.99%4m 23s99.999%: 26s of downtime in an average month99.999%26sAllowed downtime per average month (730 hours), log scale

    Bars are on a logarithmic scale: each gridline is ten times the one before it. Red marks 99.9%.

    Moving from 99.9% to 99.99% shrinks the monthly allowance from 43m 48s to 4m 23s. AWS, Azure and Google reserve four nines for compute deployed redundantly: AWS gives a single EC2 instance 99.5% but 99.99% across availability zones, and Azure gives a single VM on Premium SSD 99.9%, an availability set 99.95%, and VMs across availability zones 99.99%. Google Compute Engine gives instances spread across zones 99.99% and a single general-purpose instance 99.9%.

    Uptime calculator

    Convert any availability percentage into allowed downtime, turn an outage into a percentage for any period, or chain services together to see the combined figure. Inputs use the same conventions as the tables on this page.

    Full downtime table

    AvailabilityYearQuarterMonth30-day monthWeekDay
    90%876h219h73h72h16h 48m2h 24m
    95%438h109h 30m36h 30m36h8h 24m1h 12m
    97%262h 48m65h 42m21h 54m21h 36m5h 2m 24s43m 12s
    98%175h 12m43h 48m14h 36m14h 24m3h 21m 36s28m 48s
    99%two nines87h 36m21h 54m7h 18m7h 12m1h 40m 48s14m 24s
    99.5%two and a half nines43h 48m10h 57m3h 39m3h 36m50m 24s7m 12s
    99.7%26h 16m 48s6h 34m 12s2h 11m 24s2h 9m 36s30m 14s4m 19s
    99.8%17h 31m 12s4h 22m 48s1h 27m 36s1h 26m 24s20m 10s2m 53s
    99.9%three nines8h 45m 36s2h 11m 24s43m 48s43m 12s10m 5s1m 26s
    99.95%three and a half nines4h 22m 48s1h 5m 42s21m 54s21m 36s5m 2s43s
    99.99%four nines52m 34s13m 8s4m 23s4m 19s1m8.64s
    99.995%26m 17s6m 34s2m 11s2m 10s30s4.32s
    99.999%five nines5m 15s1m 19s26s26s6.05s0.86s
    99.9999%six nines32s7.88s2.63s2.59s0.6s0.09s

    Formula: downtime = (100 minus availability) / 100 x period length. Example: (100 minus 99.9) / 100 x 43,800 minutes = 43.8 minutes.

    What providers actually commit to: 35 commitments from 14 SLA documents

    Calculator pages stop at the math. The more useful question for an MSP is what a provider promises in writing and what it pays when it misses. We saved each provider’s current SLA document, recorded its effective date, and coded the commitment, the measurement window and the full credit table. The columns on the right apply each credit table to a single outage that hits all users in a 30-day month.

    Service (links to the SLA)CommitmentAllowed downtime, min per 30 daysFirst creditCredit, 1 h outageCredit, 8 h outageCredit, 24 h outageSLA date
    Cloud compute
    AWSAmazon EC2Region-level: instances across 2+ Availability Zones99.99%4.310%10%30%30%2022-05-25
    DigitalOceanDroplets (CPU)Each Droplet99.99%4.3100%100%100%100%2025-06-03
    Google CloudCompute EngineInstances in multiple zones, Premium Tier99.99%4.310%10%25%25%2025-03-04
    Microsoft AzureAzure Virtual Machines2+ instances across 2+ Availability Zones99.99%4.310%10%25%25%2026-10-01
    Microsoft AzureAzure Virtual Machines2+ instances in an Availability Set99.95%21.610%10%25%25%2026-10-01
    Google CloudCompute EngineSingle instance (general families)99.9%43.210%10%10%10%2025-03-04
    Microsoft AzureAzure Virtual MachinesSingle instance, Premium SSD or Ultra Disk99.9%43.210%10%25%25%2026-10-01
    AWSAmazon EC2Instance-level: a single instance99.5%216.010%0%30%30%2022-05-25
    Microsoft AzureAzure Virtual MachinesSingle instance, Standard SSD99.5%216.010%0%10%10%2026-10-01
    Microsoft AzureAzure Virtual MachinesSingle instance, Standard HDD95%2160.010%0%0%0%2026-10-01
    Cloud storage and databases
    Microsoft AzureAzure SQL DatabaseZone-redundant (General Purpose, Business Critical, Premium, Hyperscale)99.995%2.210%10%25%25%2026-10-01
    Microsoft AzureAzure SQL DatabaseNot zone-redundant, any tier99.99%4.310%10%25%25%2026-10-01
    AWSAmazon RDSMulti-AZ DB instance or cluster99.95%21.610%10%25%25%2024-01-22
    Google CloudCloud StorageStandard class, multi-region or dual-region99.95%21.610%10%25%25%2026-04-01
    AWSAmazon S3S3 Standard99.9%43.210%10%25%25%2023-11-28
    Google CloudCloud StorageStandard class, regional99.9%43.210%10%25%25%2026-04-01
    Microsoft AzureAzure StorageHot tier, LRS/ZRS/GRS writes99.9%43.210%10%25%25%2026-10-01
    AWSAmazon RDSSingle-DB instance99.5%216.010%0%25%25%2024-01-22
    Identity
    MicrosoftMicrosoft Entra IDBasic and Premium99.99%4.310%25%50%50%2026-10-01
    OktaAuth0 PlatformCore authentication services (SLA Rev 4.5.2)99.99%4.35%10%20%20%2022-02-01
    MicrosoftMicrosoft IntuneAdmin and user sign-in99.9%43.225%25%50%50%2026-10-01
    Productivity and collaboration
    Microsoft 365Teams Phone, Calling Plans, Audio ConferencingPSTN calling and dial-in99.999%0.45%25%50%50%2026-10-01
    GoogleGoogle WorkspaceGmail, Drive, Meet, Calendar and other covered services99.9%43.210%10%23.3%23.3%2026-08-31
    Microsoft 365Exchange OnlineSend and receive mail in Outlook on the web99.9%43.225%25%50%50%2026-10-01
    Microsoft 365SharePoint OnlineRead or write a site collection99.9%43.225%25%50%50%2026-10-01
    Microsoft 365OneDrive for work or schoolView or edit files99.9%43.225%25%50%50%2026-10-01
    Microsoft 365Microsoft TeamsChat and starting meetings99.9%43.225%25%50%50%2026-10-01
    Network and edge
    CloudflareCloudflare (Business plan)CDN and proxy, Business SLA100%0pro rata x10.1%1.1%3.3%not stated
    CloudflareCloudflare (Enterprise)Standard success plan100%0pro rata x101.4%11.1%33.3%2026-04-01
    CloudflareCloudflare (Enterprise)Premium success plan100%0pro rata x253.5%27.8%83.3%2026-04-01
    Developer and communications
    TwilioTwilio APIsEnterprise Edition99.99%4.310%10%10%10%2026-04-09
    AtlassianJira, Confluence, Jira Service ManagementEnterprise plan99.95%21.65%10%25%25%2026-04-30
    TwilioTwilio APIs and SendGrid Mail SendStandard99.95%21.610%10%10%10%2026-04-09
    AtlassianJira, Confluence, Jira Service ManagementPremium plan99.9%43.210%10%25%25%2026-04-30
    GitHubGitHub Enterprise CloudGit, Issues, Pull Requests, Pages, Webhooks, API99.9%131.4 per quarter5%0%5%25%2026-06

    Credits are a percentage of the fee for the affected service in that period. Cloudflare credits are pro rata (outage minutes / scheduled minutes, multiplied by 1, 10 or 25 by plan); figures assume all visitors affected. Google Workspace pays days of service (3, 7 or 15), converted here at 30 days = 100%. GitHub measures per calendar quarter (allowance shown per 91.25-day quarter). The Auth0 document is the version Okta still hosts, dated February 2022.

    The median commitment across the 35 entries is 99.95%, and 13 of them promise 99.99% or more. Exchange Online, SharePoint Online, OneDrive, Teams and Intune all start at 25% below 99.9%, the highest first-breach credit in the sample apart from DigitalOcean, which is the outlier, crediting 100% of an affected Droplet’s charges for any month below 99.99%. At the other end, a single Azure VM on Standard HDD disks is only committed to 95%, which allows 36h of downtime in a 30-day month before any credit.

    How credits grow with downtime

    Microsoft 365 (Exchange, Teams, SharePoint)AWS EC2, multi-AZGoogle Compute Engine, single VMCloudflare Enterprise PremiumGitHub Enterprise Cloud

    0%25%50%75%100%0 h8 h16 h24 h36 h48 hMicrosoft 365 (Exchange, Teams, SharePoint): credit as a share of that month’s fee, by hours of downtime in a 30-day monthAWS EC2, multi-AZ: credit as a share of that month’s fee, by hours of downtime in a 30-day monthGoogle Compute Engine, single VM: credit as a share of that month’s fee, by hours of downtime in a 30-day monthCloudflare Enterprise Premium: credit as a share of that month’s fee, by hours of downtime in a 30-day monthGitHub Enterprise Cloud: credit as a share of that month’s fee, by hours of downtime in a 30-day monthHours of downtime in one 30-day month (one continuous outage, all users affected)

    Credit as a share of that month’s fee for the affected service, for one continuous outage of the length shown in a 30-day month. GitHub is measured over a quarter, so the same outage counts for less.

    Credits rise in steps, not in proportion to the damage. Under the Microsoft 365 table, a 45-minute outage and a 7-hour outage both earn 25%; the next step (50%) starts once uptime falls below 99%, which takes 7h 12m of downtime in a 30-day month. Google Compute Engine’s single-instance table stays at 10% until uptime falls below 95%, which takes 36h. In 24 of the 32 step tables in our sample, the top tier starts below 95%, which takes 36h of downtime in a 30-day month, a day and a half. Only the Cloudflare Enterprise formulas scale with every minute: the Premium plan’s 25x multiplier reaches 100% of the monthly fee after 28h 48m.

    The measurement window matters as much as the percentage. GitHub’s 99.9% is measured per calendar quarter, which allows about 2h 11m 24s of downtime per quarter before a credit, so a single 2-hour outage can fall inside the allowance. Microsoft measures most Microsoft 365 services in user-minutes, so an outage that hits a fifth of your users counts as a fifth of the time. Google Workspace and Atlassian count time as down only when the error rate passes 5%. And 5 of the 35 commitments pay nothing at all for a 1-hour outage.

    Credits are small next to the cost of downtime

    Every SLA we read limits the remedy to credits against that service’s own fee, and 13 of the 14 SLA documents state that credits are the sole or exclusive remedy. To put a credit next to a real cost, take Exchange Online (Plan 1), listed at $4.00 per user per month (paid yearly). An 8-hour outage that hits every user in a 30-day month drops uptime to 98.89%, which earns a 50% credit: $2.00 per user. Eight hours of payroll at the BLS average hourly earnings for private-sector employees (September 2026, $37.81, preliminary) is $302.48 per user, about 151 times the credit. Even a 100% credit on the most expensive Microsoft 365 business plan listed ($32.00 per user per month) would cover 11% of that one day of payroll.

    Payroll is only one part of what an outage costs, and idle hours are not all lost hours, but the gap is wide enough that the conclusion does not depend on the exact figure. We are building a separate analysis of what an hour of downtime costs a business; read the two together when you set client expectations. The cost of the technician time spent on response and recovery comes on top, at the hourly rates IT contracts actually pay.

    Credits are also not automatic. Apart from AWS’s automatic waiver for any EC2 instance hour with more than six minutes of unavailability, every SLA in the table requires a claim with evidence. Cloudflare wants notice within five business days of the incident and Okta’s Auth0 SLA within five business days of the event; Atlassian gives 15 days after month end; Google Workspace and Twilio 30 days.

    The math of serial dependencies

    When a user needs several services to work at once, their availabilities multiply. Three services at 99.9% each give 0.999 x 0.999 x 0.999 = 99.70%, which allows about 2h 11m 16s of downtime in an average month instead of 43m 48s. The product is exact when failures are independent. When outages share a cause, such as one cloud region, they overlap in time and the combined figure comes out somewhat higher, but the outage hits everything at once.

    0 h2 h4 h6 h8 h123456789101 services at 99.9% in series: 99.9000% combined, 43m 48s a month2 services at 99.9% in series: 99.8001% combined, 1h 27m 33s a month3 services at 99.9% in series: 99.7003% combined, 2h 11m 16s a month4 services at 99.9% in series: 99.6006% combined, 2h 54m 56s a month5 services at 99.9% in series: 99.5010% combined, 3h 38m 34s a month6 services at 99.9% in series: 99.4015% combined, 4h 22m 9s a month7 services at 99.9% in series: 99.3021% combined, 5h 5m 41s a month8 services at 99.9% in series: 99.2028% combined, 5h 49m 11s a month9 services at 99.9% in series: 99.1036% combined, 6h 32m 38s a month10 services at 99.9% in series: 99.0045% combined, 7h 16m 2s a month10 x 99.9% = 99.00%1 services at 99.95% in series: 99.9500% combined, 21m 54s a month2 services at 99.95% in series: 99.9000% combined, 43m 47s a month3 services at 99.95% in series: 99.8501% combined, 1h 5m 40s a month4 services at 99.95% in series: 99.8001% combined, 1h 27m 32s a month5 services at 99.95% in series: 99.7502% combined, 1h 49m 23s a month6 services at 99.95% in series: 99.7004% combined, 2h 11m 14s a month7 services at 99.95% in series: 99.6505% combined, 2h 33m 4s a month8 services at 99.95% in series: 99.6007% combined, 2h 54m 54s a month9 services at 99.95% in series: 99.5509% combined, 3h 16m 42s a month10 services at 99.95% in series: 99.5011% combined, 3h 38m 30s a month10 x 99.95% = 99.50%1 services at 99.99% in series: 99.9900% combined, 4m 23s a month2 services at 99.99% in series: 99.9800% combined, 8m 46s a month3 services at 99.99% in series: 99.9700% combined, 13m 8s a month4 services at 99.99% in series: 99.9600% combined, 17m 31s a month5 services at 99.99% in series: 99.9500% combined, 21m 54s a month6 services at 99.99% in series: 99.9400% combined, 26m 16s a month7 services at 99.99% in series: 99.9300% combined, 30m 39s a month8 services at 99.99% in series: 99.9200% combined, 35m 2s a month9 services at 99.99% in series: 99.9100% combined, 39m 24s a month10 services at 99.99% in series: 99.9000% combined, 43m 47s a month10 x 99.99% = 99.90%Number of services in the chain (each must be up for the whole to be up)

    Combined allowed downtime per average month (730 hours) for a chain of 1 to 10 services, each at the stated availability, assuming independent failures.

    A Microsoft 365 desk: 99.69%

    ServiceSLA
    Microsoft Entra ID99.99%
    Exchange Online99.9%
    SharePoint Online99.9%
    Microsoft Teams99.9%
    All four in series99.6903%

    About 2h 15m 38s a month in which at least one piece can be down within SLA.

    A web app on AWS behind Cloudflare: 99.84%

    ServiceSLA
    Cloudflare Enterprise100%
    Amazon EC2, multi-AZ99.99%
    Amazon RDS Multi-AZ99.95%
    Amazon S3 Standard99.9%
    All four in series99.8401%

    About 1h 10m 3s a month, before counting your own code, DNS or the client’s internet line.

    The reverse also holds: two independent copies of a 99.9% component in parallel fail together only 0.1% x 0.1% of the time, and in the SLA table it is the redundant configurations that carry the higher commitments.

    The fine print, provider by provider

    SLAMeasurement windowWhat counts as downClaim deadlineCredit cap
    AWS: Amazon EC2monthly billing cycleminutes of Unavailabilityby the end of the second billing cycle after the incident100% of the fee
    AWS: Amazon RDSmonthly billing cycle1-minute intervalsby the end of the second billing cycle after the incident100% of the fee
    AWS: Amazon S3monthly billing cycleaverage 5-minute error rateby the end of the second billing cycle after the incident100% of the fee
    Atlassian: Jira, Confluence, Jira Service Managementcalendar monthminutes with >5% error ratewithin 15 days of the end of the month50% of the fee
    Cloudflare: Business planmonthly billing periodoutage minutes x share of visitors affectednotify within 5 business days; claim by end of following billing month1 month of fees per 12 months
    Cloudflare: Enterprisemonthly billing periodoutage minutes x share of visitors affectednotify within 5 business days; claim by end of following billing month6 months of fees per year
    DigitalOcean: Droplets (CPUmonthly billing cycleminutes of Unavailabilitywithin two billing cycles100% of the fee
    GitHub: GitHub Enterprise Cloudcalendar quarterminutes with >5% error ratewithin 30 days of the end of the quarter90 days of fees per quarter
    Google: Google Workspacecalendar monthminutes with >5% user error ratewithin 30 days of becoming eligible15 days of service
    Google Cloud: Cloud Storagecalendar monthaverage 5-minute error ratewithin 30 days of becoming eligible50% of the fee
    Google Cloud: Compute Enginecalendar monthminutes of Downtimewithin 60 days of becoming eligible100% of the fee
    Microsoft: Microsoft Entra ID, Microsoft Intunecalendar monthuser-minutesby the end of the month after the incident100% of the fee
    Microsoft 365: Exchange Online, Microsoft Teams, OneDrive for work or school, SharePoint Online, Teams Phone, Calling Plans, Audio Conferencingcalendar monthuser-minutesby the end of the month after the incident100% of the fee
    Microsoft Azure: Azure SQL DatabaseApplicable Period (30 days for pay-as-you-go)minutes unavailablewithin 60 days of the incident100% of the fee
    Microsoft Azure: Azure StorageApplicable Period (30 days for pay-as-you-go)average hourly error ratewithin 60 days of the incident25% of the fee
    Microsoft Azure: Azure Virtual MachinesApplicable Period (30 days for pay-as-you-go)minutes with no VM connectivitywithin 60 days of the incident100% of the fee
    Okta: Auth0 Platformcalendar monthminutes of Downtimewithin 5 business days of the event50% of the fee
    Twilio: APIs and SendGrid Mail Sendcalendar monthminutes unavailablewithin 30 days of the end of the month10% of the fee

    Exclusions follow a common pattern: events outside the provider’s control, the customer’s own equipment and configuration, preview features, and suspensions for breach. Microsoft also excludes failures in a single datacenter when your setup depends on that location in a non-geo-resilient way, which matters for regional events such as those in our disaster declarations by state data.

    Services with no public uptime number

    Several services MSPs rely on publish no percentage at all in their public terms. Where an uptime commitment exists for these, it is in a negotiated order form, not a public document.

    DocumentDateWhat the public terms say
    Slack2024-07-11“Commercially reasonable efforts” to keep the service available 24×7; no percentage, no credit table
    Salesforce (Main Services Agreement)2026-09-01“Commercially reasonable efforts” to keep the service available 24×7; no percentage, no credit table
    Okta (Master Subscription Agreement)2025-02 (Q1 FY26 version)“Commercially reasonable efforts” to keep the service available 24×7; no percentage, no credit table
    Zoom (Terms of Service)2023-08-11No uptime percentage or service credit anywhere in the terms
    ConnectWise Cloud Backup and SaaS Security2025-03-14Says ConnectWise has no liability for interruptions

    Web searches did not turn up a public uptime SLA for Kaseya or Datto products, so they are not in the table.

    What this means for MSPs

    Quote the configuration, not the vendor. The same provider can sit anywhere from 95% to 99.995% depending on the setup (Azure, in our table). If a client’s line-of-business server is one Azure VM, its SLA is 99.9% at best, and only with Premium SSD or Ultra disks; a single EC2 instance gets 99.5%.

    Do not write a 99.9% end-to-end promise on top of 99.9% vendors. Your service depends on several vendors in series, so promising the same number as each of them leaves you no allowance of your own. Either commit to a lower figure, or define availability per component the way the vendors do.

    Never let credits stand in for continuity planning. For a full-day outage the median credit in the table is 25% of one month’s fee for the affected service, and the most any entry pays is that one month’s fee. Budget for downtime from the client’s side (staff time, lost orders, recovery labor) and spend on redundancy where the math above says it pays.

    Put claim deadlines in your runbook. Some windows are five business days. Log outage start and end times, affected users and error evidence during the incident, because every claim requires them, and track that the credit is applied.

    For the wider market context, our MSP industry statistics track the number of managed IT firms, their jobs and their pay.

    Frequently asked questions

    What does 99.9% uptime mean?

    99.9% uptime means a service can be down 0.1% of the time: 8h 45m 36s a year, 2h 11m 24s a quarter, 43m 48s in an average month (43m 12s in a 30-day month), 10m 5s a week, or 1m 26s a day.

    How much downtime is 99.9% uptime per month?

    43m 48s in an average month of 730 hours (one twelfth of a 365-day year). In a 30-day month it is 43m 12s, and in a 31-day month 44m 38s. Most provider SLAs measure per calendar month, so the exact allowance changes with the month.

    Is 99.99% uptime good?

    99.99% allows 4m 23s of downtime in an average month and 52m 34s a year, one tenth of what 99.9% allows. In the 35 SLA commitments we read, 13 promise 99.99% or more, For AWS, Azure and Google compute that level needs instances spread across availability zones; their single instances get 99.5% to 99.9%. DigitalOcean is the exception, at 99.99% per Droplet.

    Is 100% uptime possible?

    Cloudflare’s Business and Enterprise SLAs promise 100%, but the credit is proportional to the outage: on the Business plan a 4-hour outage affecting all visitors earns 0.6% of the monthly fee. A 100% promise sets the credit formula; it does not guarantee zero downtime.

    How much downtime is 99.7% availability?

    99.7% allows 2h 11m 24s of downtime in an average month and 26h 16m 48s a year. It is also roughly what you get when three services at 99.9% are chained in series: 0.999 x 0.999 x 0.999 = 99.70%.

    What do I get if a provider misses a 99.9% SLA?

    A service credit against that service’s fee, never cash for your losses. Across the 35 commitments we read, the median first-tier credit is 10% and a full 24-hour outage earns a median 25%. You must file a claim, often within 30 days and in two cases within 5 business days.

    Download the data. provider-sla-uptime-commitments-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Ladder math. Allowed downtime = (100 minus availability) / 100 x period. Year = 365 days (525,600 minutes); quarter = 91.25 days; month = 730 hours (43,800 minutes), one twelfth of a year; 30-day month = 43,200 minutes; week = 10,080 minutes; day = 1,440 minutes. A 31-day month allows 44.6 minutes at 99.9%, a 28-day month 40.3 minutes.

    SLA sources. We downloaded 19 public SLA or terms documents from 12 providers on October 13, 2026, and saved each one. For every commitment we recorded the percentage, the credit table, the measurement window, what counts as downtime, the claim deadline, the credit cap and the document’s own effective or last-updated date (Cloudflare’s Business SLA page shows none). A verification script checks 119 verbatim passages from those documents against the saved copies before the page is built. Cloudflare’s Enterprise credit formula is published as an image, which we read directly.

    Coverage. 40 entries: 35 with a published percentage and 5 documents with none. Where one document sets several levels (for example Azure VMs by deployment and disk type), each is a separate entry. Regional variants (Google Cloud’s Mexico and Stockholm regions) and secondary metrics (Exchange email delivery time, storage cool tiers) are left out.

    Credit calculations. One continuous outage affecting all users or visitors in a 30-day month (a 91.25-day quarter for GitHub). Medians are across the 35 entries with a published percentage; Cloudflare entries use their pro rata formulas with an affected ratio of 1. First-breach medians exclude Cloudflare’s pro rata formulas. Credits are a percentage of the fee for the affected service only.

    Cost comparison. Exchange Online (Plan 1) and Microsoft 365 Business Premium list prices from Microsoft’s US pricing pages (annual commitment), retrieved October 2026. Wage: BLS Current Employment Statistics series CES0500000003, average hourly earnings of all employees, total private, September 2026 (preliminary). Payroll is used as a lower bound for the cost of idle time, not as a full cost of downtime.

    Limitations. Public SLAs can be superseded by negotiated contracts and enterprise order forms. Okta’s Auth0 SLA is an older document (Rev 4.5.2, February 2022) still hosted on okta.com; current Okta contracts may differ. Serial chain math assumes independent failures. Provider SLAs change often; dates in the table are the versions we read.

    Not advice. This is an analysis of public contract terms, not legal advice on any agreement.

    Cite as:The Uptime Report. "99.9% Uptime Allows 43.8 Minutes of Downtime a Month, and a Full-Day Outage Earns a Median 25% SLA Credit." October 2026. https://theuptimereport.com/99-9-uptime/

    References

    1. Amazon Web Services, Amazon Compute Service Level Agreement. Accessed October 2026.
    2. Amazon Web Services, Amazon S3 Service Level Agreement. Accessed October 2026.
    3. Amazon Web Services, Amazon RDS Service Level Agreement. Accessed October 2026.
    4. Microsoft, Service Level Agreement for Microsoft Online Services (October 1, 2026 edition). Accessed October 2026.
    5. Google Cloud, Compute Engine Service Level Agreement. Accessed October 2026.
    6. Google Cloud, Cloud Storage Service Level Agreement. Accessed October 2026.
    7. Google, Google Workspace Service Level Agreement. Accessed October 2026.
    8. Cloudflare, Business Service Level Agreement. Accessed October 2026.
    9. Cloudflare, Enterprise Customer Support and Service Level Agreement. Accessed October 2026.
    10. GitHub, GitHub Online Services SLA. Accessed October 2026.
    11. Atlassian, Cloud Service Level Agreement. Accessed October 2026.
    12. Twilio, Twilio APIs Service Level Agreement. Accessed October 2026.
    13. DigitalOcean, CPU Droplet SLA. Accessed October 2026.
    14. Okta, Auth0 Platform Service Level Agreement (Rev 4.5.2). Accessed October 2026.
    15. Slack, Service Level Agreement page. Accessed October 2026.
    16. Salesforce, Main Services Agreement. Accessed October 2026.
    17. Okta, Master Subscription Agreement (online terms). Accessed October 2026.
    18. Zoom, Terms of Service. Accessed October 2026.
    19. ConnectWise, Cloud Backup and SaaS Security Customer Terms. Accessed October 2026.
    20. U.S. Bureau of Labor Statistics, Current Employment Statistics, series CES0500000003. Accessed October 2026.
    21. Microsoft, Exchange Online plans and pricing. Accessed October 2026.
    22. Microsoft, Microsoft 365 business plans and pricing. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Power Outage Statistics: Outage Hours Rose 46% in a Decade, and Major Storms Caused 91% of the Increase

    Uptime Report Research · Grid Reliability

    Power Outage Statistics: Outage Hours Rose 46% in a Decade, and Major Storms Caused 91% of the Increase

    Power outage statistics from the federal government’s own utility reports show the average U.S. electricity customer lost 7.0 hours of power a year from 2021 to 2025, up from 4.8 hours in 2013 to 2017. In 2025 the figure was 4.5 hours (269 minutes) across 1.34 interruptions. Major event days, mostly storms, explain 91% of the decade’s increase.

    4.5 hwithout power per customer in 2025 (269 minutes)
    11.0 hin 2024, the worst year since reporting began in 2013
    +10%everyday outage time, 2013 to 2017 vs 2021 to 2025
    +70%outage time on major event days, same comparison

    We downloaded every annual Form EIA-861 reliability file from the U.S. Energy Information Administration (2013 to 2025, the 2025 final data released October 7, 2026), which lists each utility’s SAIDI (minutes without power per customer) and SAIFI (interruptions per customer), with and without major event days. We combined 752 utility-state reports for 2025 into customer-weighted state and national figures. Our national numbers reproduce the EIA’s published series to within one minute. We then matched the result against 865 Department of Energy disturbance reports for large outages.

    Power outage statistics by year: everyday outages vs. major events

    0h2h4h6h8h10h12h2013: 3.8 hours total (227 min), 1.9 h everyday outages, 1.9 h on major event days3.820132014: 3.9 hours total (236 min), 1.9 h everyday outages, 2.0 h on major event days3.920142015: 3.5 hours total (209 min), 2.0 h everyday outages, 1.5 h on major event days3.520152016: 4.5 hours total (268 min), 2.0 h everyday outages, 2.5 h on major event days4.520162017: 8.4 hours total (506 min), 1.9 h everyday outages, 6.5 h on major event days8.420172018: 5.8 hours total (349 min), 2.0 h everyday outages, 3.8 h on major event days5.820182019: 4.9 hours total (296 min), 2.0 h everyday outages, 2.9 h on major event days4.920192020: 7.6 hours total (456 min), 1.9 h everyday outages, 5.7 h on major event days7.620202021: 7.9 hours total (476 min), 2.1 h everyday outages, 5.8 h on major event days7.920212022: 5.6 hours total (333 min), 2.2 h everyday outages, 3.4 h on major event days5.620222023: 6.1 hours total (367 min), 2.1 h everyday outages, 4.0 h on major event days6.120232024: 11.0 hours total (663 min), 2.2 h everyday outages, 8.8 h on major event days11.020242025: 4.5 hours total (269 min), 2.1 h everyday outages, 2.4 h on major event days4.52025Major event daysEveryday outages (without major event days)

    Average hours without power per customer, 50 states and DC, IEEE 1366 method. Dark: interruptions on normal days. Red: interruptions on major event days, which each utility identifies under the IEEE 1366 standard (usually severe weather). Source: EIA Form EIA-861, The Uptime Report analysis.

    The grid’s everyday performance barely moved. Without major event days, customers lost 1.9 hours a year in 2013 to 2017 and 2.1 hours in 2021 to 2025. The number of everyday interruptions was flat (1.04 vs 1.06 a year); the growth came from each one lasting longer, with the average everyday interruption up from 111 to 120 minutes.

    Major event days are where the volatility lives. They added 2.9 hours a year on average in 2013 to 2017 and 4.9 hours in 2021 to 2025. In 2024, they accounted for 80% of all outage time. The EIA attributes most of 2024’s outage time to major events such as Hurricanes Beryl, Helene, and Milton; Helene alone left 5.9 million customers without power across 10 states. 2025 was calmer, at 4.5 hours, the lowest total since 2016.

    Is it just more utilities reporting? No. The share of customers covered by IEEE reporting rose from 66% in 2013 to 79% in 2025, so we re-ran the numbers on a fixed panel of 366 utility-state units that reported every year from 2013 to 2025. Same pattern: everyday outage time rose from 1.9 to 2.1 hours, total outage time from 4.9 to 6.7 hours.

    Power outages by state: the reliability scatter

    70%+ of outage time on major event days 50% to 69% under 50% under half of customers covered

    0h5h10h15h20h25h00.511.522.533.54U.S. average 1.42 interruptionsU.S. average 7.0 hoursInterruptions per customer per year (SAIFI)Hours without power per customer per year (SAIDI)Utah: 1.9 hours a year (116 min), 0.91 interruptions a year, 13% of minutes on major event days (2021 to 2025 average)Delaware: 1.6 hours a year (95 min), 0.89 interruptions a year, 30% of minutes on major event days (2021 to 2025 average)Wyoming: 2.7 hours a year (162 min), 1.17 interruptions a year, 31% of minutes on major event days (2021 to 2025 average)New Mexico: 3.2 hours a year (194 min), 1.19 interruptions a year, 32% of minutes on major event days (2021 to 2025 average)Arizona: 1.6 hours a year (99 min), 0.97 interruptions a year, 32% of minutes on major event days (2021 to 2025 average)District of Columbia: 0.8 hours a year (48 min), 0.34 interruptions a year, 33% of minutes on major event days (2021 to 2025 average)New Jersey: 2.2 hours a year (133 min), 1.00 interruptions a year, 33% of minutes on major event days (2021 to 2025 average)Hawaii: 5.4 hours a year (322 min), 3.92 interruptions a year, 35% of minutes on major event days (2021 to 2025 average); under half of customers covered by IEEE reportingIdaho: 4.1 hours a year (247 min), 1.30 interruptions a year, 43% of minutes on major event days (2021 to 2025 average)Montana: 4.1 hours a year (244 min), 1.41 interruptions a year, 44% of minutes on major event days (2021 to 2025 average)Alabama: 4.5 hours a year (267 min), 2.01 interruptions a year, 44% of minutes on major event days (2021 to 2025 average); under half of customers covered by IEEE reportingColorado: 3.2 hours a year (192 min), 1.16 interruptions a year, 45% of minutes on major event days (2021 to 2025 average)Iowa: 2.3 hours a year (140 min), 1.03 interruptions a year, 45% of minutes on major event days (2021 to 2025 average)Nevada: 2.4 hours a year (145 min), 1.00 interruptions a year, 46% of minutes on major event days (2021 to 2025 average)California: 5.1 hours a year (307 min), 1.33 interruptions a year, 50% of minutes on major event days (2021 to 2025 average)Alaska: 9.4 hours a year (563 min), 3.19 interruptions a year, 53% of minutes on major event days (2021 to 2025 average)West Virginia: 16.8 hours a year (1010 min), 2.68 interruptions a year, 53% of minutes on major event days (2021 to 2025 average)New York: 5.0 hours a year (299 min), 1.40 interruptions a year, 53% of minutes on major event days (2021 to 2025 average); under half of customers covered by IEEE reportingMaryland: 2.8 hours a year (170 min), 0.96 interruptions a year, 55% of minutes on major event days (2021 to 2025 average)Minnesota: 3.1 hours a year (186 min), 1.13 interruptions a year, 55% of minutes on major event days (2021 to 2025 average)Pennsylvania: 4.9 hours a year (292 min), 1.27 interruptions a year, 56% of minutes on major event days (2021 to 2025 average)Connecticut: 3.0 hours a year (178 min), 0.92 interruptions a year, 57% of minutes on major event days (2021 to 2025 average)South Dakota: 3.0 hours a year (178 min), 1.07 interruptions a year, 57% of minutes on major event days (2021 to 2025 average)Arkansas: 8.9 hours a year (533 min), 2.05 interruptions a year, 58% of minutes on major event days (2021 to 2025 average)Illinois: 2.4 hours a year (146 min), 0.84 interruptions a year, 59% of minutes on major event days (2021 to 2025 average)Kansas: 4.3 hours a year (259 min), 1.40 interruptions a year, 59% of minutes on major event days (2021 to 2025 average)Tennessee: 7.3 hours a year (438 min), 2.33 interruptions a year, 61% of minutes on major event days (2021 to 2025 average)Ohio: 5.8 hours a year (348 min), 1.33 interruptions a year, 61% of minutes on major event days (2021 to 2025 average)Indiana: 5.8 hours a year (347 min), 1.38 interruptions a year, 64% of minutes on major event days (2021 to 2025 average)Mississippi: 12.2 hours a year (731 min), 2.41 interruptions a year, 64% of minutes on major event days (2021 to 2025 average)Vermont: 9.2 hours a year (553 min), 2.40 interruptions a year, 65% of minutes on major event days (2021 to 2025 average); under half of customers covered by IEEE reportingMissouri: 4.9 hours a year (295 min), 1.24 interruptions a year, 65% of minutes on major event days (2021 to 2025 average)Massachusetts: 3.9 hours a year (237 min), 1.03 interruptions a year, 66% of minutes on major event days (2021 to 2025 average)Washington: 7.1 hours a year (427 min), 1.51 interruptions a year, 66% of minutes on major event days (2021 to 2025 average)Georgia: 7.2 hours a year (435 min), 1.75 interruptions a year, 66% of minutes on major event days (2021 to 2025 average)Virginia: 13.1 hours a year (785 min), 2.15 interruptions a year, 66% of minutes on major event days (2021 to 2025 average); under half of customers covered by IEEE reportingRhode Island: 3.1 hours a year (184 min), 1.01 interruptions a year, 67% of minutes on major event days (2021 to 2025 average)North Dakota: 4.5 hours a year (271 min), 1.14 interruptions a year, 67% of minutes on major event days (2021 to 2025 average)Wisconsin: 4.8 hours a year (287 min), 1.02 interruptions a year, 68% of minutes on major event days (2021 to 2025 average)Oklahoma: 7.3 hours a year (438 min), 1.67 interruptions a year, 72% of minutes on major event days (2021 to 2025 average); under half of customers covered by IEEE reportingNorth Carolina: 8.9 hours a year (535 min), 1.59 interruptions a year, 73% of minutes on major event days (2021 to 2025 average)Kentucky: 9.5 hours a year (568 min), 1.75 interruptions a year, 74% of minutes on major event days (2021 to 2025 average)Michigan: 12.1 hours a year (726 min), 1.46 interruptions a year, 77% of minutes on major event days (2021 to 2025 average)Maine: 17.5 hours a year (1053 min), 2.94 interruptions a year, 78% of minutes on major event days (2021 to 2025 average)New Hampshire: 7.2 hours a year (430 min), 1.35 interruptions a year, 80% of minutes on major event days (2021 to 2025 average)Oregon: 9.7 hours a year (584 min), 1.23 interruptions a year, 81% of minutes on major event days (2021 to 2025 average)Texas: 13.7 hours a year (822 min), 2.19 interruptions a year, 81% of minutes on major event days (2021 to 2025 average)Nebraska: 6.5 hours a year (388 min), 0.98 interruptions a year, 83% of minutes on major event days (2021 to 2025 average)Louisiana: 25.9 hours a year (1552 min), 2.36 interruptions a year, 85% of minutes on major event days (2021 to 2025 average)South Carolina: 13.0 hours a year (781 min), 1.63 interruptions a year, 86% of minutes on major event days (2021 to 2025 average)Florida: 9.4 hours a year (565 min), 1.19 interruptions a year, 88% of minutes on major event days (2021 to 2025 average)UTDEAZDCHIAKWVMSVANCKYMIMEORTXNELASCFL

    Each dot is a state, averaged over 2021 to 2025, all events included. Up means more hours without power; right means more separate interruptions. Hover for values.

    The scatter separates two different problems. The storm states sit high but not far right: South Carolina, Michigan, Oregon, and Florida have interruption counts near the national average but lost 9.4 to 13.0 hours a year, with 70% or more of that time on major event days. In South Carolina, the 2024 total reached 52.6 hours. Further right sit the frequent-outage states, where customers see many separate interruptions: Alaska (3.2 a year), Maine (2.9), and West Virginia (2.7), against a national average of 1.4.

    West Virginia is the outlier on both axes. Even with major event days removed, its customers lost 7.9 hours a year, the most of any state and 3.7 times the national everyday figure. Across the decade, 38 of 51 states lost more time per customer in 2021 to 2025 than in 2013 to 2017. Because severe weather drives most of this, our analysis of FEMA disaster declarations by state is a useful second input when scoring a client site’s continuity risk.

    Puerto Rico, which the national figures exclude, is in a different category. Its utility reported 59.1 hours without power per customer in 2025, 35.9 of them outside major event days. Its everyday figure averaged 27.3 hours a year from 2021 to 2024, in line with the 27 hours the EIA has reported for that period.

    Most hours without power

    1. Louisiana25.9 h
    2. Maine17.5 h
    3. West Virginia16.8 h
    4. Texas13.7 h
    5. Virginia†13.1 h

    Fewest hours without power

    1. District of Columbia0.8 h
    2. Delaware1.6 h
    3. Arizona1.6 h
    4. Utah1.9 h
    5. New Jersey2.2 h

    Five-year averages, 2021 to 2025, all events. † Under half of customers covered by IEEE reporting (see the note under the full table).

    State ranking: all 50 states and DC

    Click a column header to sort. Single years swing hard: one hurricane can multiply a state’s total, so the ranking uses the five-year average.

    Rank State Hours a year, 2021 to 2025 Everyday hours (no major events) Interruptions a year Share on major event days Hours, 2025 Hours, 2024 Change vs 2013 to 2017 Customers covered, 2025
    1 Louisiana 25.9 3.9 2.36 85% 4.5 10.5 +232% 73%
    2 Maine 17.5 3.8 2.94 78% 6.1 29.1 0% 100%
    3 West Virginia 16.8 7.9 2.68 53% 16.9 19.4 +46% 98%
    4 Texas 13.7 2.6 2.19 81% 3.5 26.9 +209% 66%
    5 Virginia† 13.1 4.5 2.15 66% 12.7 16.0 +95% 30%
    6 South Carolina 13.0 1.9 1.63 86% 2.5 52.6 +21% 95%
    7 Mississippi 12.2 4.4 2.41 64% 8.7 10.1 +115% 69%
    8 Michigan 12.1 2.8 1.46 77% 10.1 8.0 +28% 94%
    9 Oregon 9.7 1.9 1.23 81% 5.0 9.7 +140% 87%
    10 Kentucky 9.5 2.5 1.75 74% 6.6 9.0 +168% 94%
    11 Florida 9.4 1.1 1.19 88% 1.2 24.8 -15% 84%
    12 Alaska 9.4 4.4 3.19 53% 9.4 5.4 +66% 80%
    13 Vermont† 9.2 3.3 2.40 65% 4.2 14.9 +4% 11%
    14 North Carolina 8.9 2.4 1.59 73% 3.2 25.3 +26% 90%
    15 Arkansas 8.9 3.7 2.05 58% 7.9 8.8 +64% 82%
    16 Tennessee 7.3 2.9 2.33 61% 3.8 4.8 +41% 69%
    17 Oklahoma† 7.3 2.1 1.67 72% 5.0 3.7 +26% 46%
    18 Georgia 7.2 2.5 1.75 66% 4.5 20.1 +4% 88%
    19 New Hampshire 7.2 1.5 1.35 80% 2.5 12.3 -4% 88%
    20 Washington 7.1 2.5 1.51 66% 6.3 10.7 +20% 89%
    21 Nebraska 6.5 1.1 0.98 83% 9.0 11.6 +292% 66%
    22 Ohio 5.8 2.2 1.33 61% 3.4 8.5 +77% 97%
    23 Indiana 5.8 2.1 1.38 64% 6.3 5.2 +42% 90%
    24 Hawaii† 5.4 3.5 3.92 35% 5.6 6.4 +87% 7%
    25 California 5.1 2.6 1.33 50% 6.0 4.8 +120% 93%
    26 New York† 5.0 2.3 1.40 53% 4.1 8.0 +28% 24%
    27 Missouri 4.9 1.7 1.24 65% 7.8 3.5 +33% 83%
    28 Pennsylvania 4.9 2.1 1.27 56% 6.9 5.9 +37% 84%
    29 Wisconsin 4.8 1.5 1.02 68% 4.4 4.9 +81% 74%
    30 North Dakota 4.5 1.5 1.14 67% 3.5 1.7 +143% 84%
    31 Alabama† 4.5 2.5 2.01 44% 4.5 3.3 +7% 15%
    32 Kansas 4.3 1.7 1.40 59% 3.2 4.8 0% 80%
    33 Idaho 4.1 2.3 1.30 43% 4.9 3.4 +13% 93%
    34 Montana 4.1 2.3 1.41 44% 4.8 5.7 +23% 71%
    35 Massachusetts 3.9 1.4 1.03 66% 2.0 1.7 +21% 92%
    36 New Mexico 3.2 2.2 1.19 32% 2.7 4.5 +70% 87%
    37 Colorado 3.2 1.8 1.16 45% 4.5 4.3 +54% 93%
    38 Minnesota 3.1 1.4 1.13 55% 3.0 3.7 -16% 86%
    39 Rhode Island 3.1 1.0 1.01 67% 3.0 1.7 -56% 97%
    40 Connecticut 3.0 1.3 0.92 57% 3.1 2.5 -5% 99%
    41 South Dakota 3.0 1.3 1.07 57% 4.7 1.4 -45% 72%
    42 Maryland 2.8 1.3 0.96 55% 3.0 2.0 +19% 99%
    43 Wyoming 2.7 1.9 1.17 31% 3.7 2.3 -30% 72%
    44 Illinois 2.4 1.0 0.84 59% 2.4 2.6 -9% 96%
    45 Nevada 2.4 1.3 1.00 46% 2.1 2.6 +57% 100%
    46 Iowa 2.3 1.3 1.03 45% 3.1 3.3 +7% 53%
    47 New Jersey 2.2 1.5 1.00 33% 2.6 2.9 -13% 99%
    48 Utah 1.9 1.7 0.91 13% 1.9 1.9 -38% 86%
    49 Arizona 1.6 1.1 0.97 32% 1.1 1.4 +16% 95%
    50 Delaware 1.6 1.1 0.89 30% 1.7 2.0 -42% 87%
    51 District of Columbia 0.8 0.5 0.34 33% 0.8 0.5 -52% 99%

    † Under half of the state’s customers are served by utilities reporting under the IEEE standard in 2025 (Alabama, Hawaii, New York, Oklahoma, Virginia, Vermont), so the figure reflects a minority of customers. Including utilities that report under another standard gives these five-year averages: Alabama 4.6 hours; Hawaii 5.0 hours; New York 2.7 hours; Oklahoma 6.1 hours; Virginia 7.0 hours; Vermont 9.9 hours. Customer-weighted averages of utility SAIDI and SAIFI; coverage is capped at 100% where utility counts slightly exceed the EIA sales-file total.

    Year by year: the national series

    Year Minutes, all events Hours, all events Minutes, without major events Minutes on major event days Major event share Interruptions, all Interruptions, without major events Utility reports Customers covered
    2013 227 3.8 112 115 51% 1.19 0.99 541 66%
    2014 236 3.9 114 122 52% 1.26 1.04 598 74%
    2015 209 3.5 117 92 44% 1.28 1.07 643 77%
    2016 268 4.5 120 149 55% 1.33 1.08 691 78%
    2017 506 8.4 117 389 77% 1.42 1.02 731 78%
    2018 349 5.8 121 228 65% 1.34 1.05 771 76%
    2019 296 4.9 122 173 59% 1.33 1.04 809 78%
    2020 456 7.6 116 340 75% 1.39 1.01 689 77%
    2021 476 7.9 126 351 74% 1.44 1.04 702 78%
    2022 333 5.6 131 202 61% 1.43 1.09 712 78%
    2023 367 6.1 124 243 66% 1.35 1.02 732 78%
    2024 663 11.0 132 531 80% 1.53 1.06 744 79%
    2025 269 4.5 125 144 53% 1.34 1.08 752 79%

    Major disturbances timeline: what the Department of Energy reports show

    Utilities and grid operators must file Form OE-417 with the Department of Energy when an incident cuts power to more than 50,000 customers for an hour or more. From 2015 (when the summaries began recording the alert criterion) through 2025, 865 reports cited that criterion, and 97% gave weather or natural disaster as the cause. A single storm can produce several reports, one per affected utility, so the chart counts reports, not storms.

    weather or natural disaster other causes

    01020302015-02: 8 large outage reports (8 weather)2015-03: 1 large outage reports (1 weather)2015-04: 6 large outage reports (5 weather)2015-05: 5 large outage reports (5 weather)2015-06: 8 large outage reports (7 weather)2015-07: 5 large outage reports (5 weather)2015-08: 9 large outage reports (8 weather)2015-09: 1 large outage reports (1 weather)2015-10: 3 large outage reports (2 weather)2015-11: 6 large outage reports (6 weather)2015-12: 7 large outage reports (6 weather)2016-01: 3 large outage reports (3 weather)2016-02: 5 large outage reports (5 weather)2016-03: 2 large outage reports (2 weather)2016-04: 2 large outage reports (2 weather)2016-05: 4 large outage reports (1 weather)2016-06: 1 large outage reports (1 weather)2016-07: 12 large outage reports (12 weather)2016-08: 2 large outage reports (2 weather)2016-09: 5 large outage reports (5 weather)2016-10: 7 large outage reports (7 weather)2016-12: 1 large outage reports (1 weather)2017-01: 6 large outage reports (5 weather)2017-02: 4 large outage reports (4 weather)2017-03: 12 large outage reports (12 weather)2017-04: 7 large outage reports (6 weather)2017-05: 7 large outage reports (7 weather)2017-06: 7 large outage reports (7 weather)2017-07: 5 large outage reports (5 weather)2017-08: 5 large outage reports (5 weather)2017-09: 8 large outage reports (8 weather)2017-10: 5 large outage reports (5 weather)2017-11: 3 large outage reports (3 weather)2017-12: 5 large outage reports (5 weather)2018-03: 20 large outage reports (20 weather)2018-04: 5 large outage reports (5 weather)2018-05: 15 large outage reports (14 weather)2018-06: 4 large outage reports (4 weather)2018-07: 5 large outage reports (5 weather)2018-08: 3 large outage reports (3 weather)2018-09: 4 large outage reports (4 weather)2018-10: 11 large outage reports (11 weather)2018-11: 8 large outage reports (8 weather)2018-12: 6 large outage reports (6 weather)2019-01: 7 large outage reports (7 weather)2019-02: 10 large outage reports (10 weather)2019-03: 4 large outage reports (4 weather)2019-04: 5 large outage reports (5 weather)2019-05: 6 large outage reports (6 weather)2019-06: 10 large outage reports (10 weather)2019-07: 10 large outage reports (10 weather)2019-08: 4 large outage reports (2 weather)2019-09: 7 large outage reports (6 weather)2019-10: 9 large outage reports (9 weather)2019-11: 6 large outage reports (6 weather)2020-01: 3 large outage reports (3 weather)2020-02: 8 large outage reports (8 weather)2020-03: 4 large outage reports (4 weather)2020-04: 23 large outage reports (23 weather)2020-05: 6 large outage reports (6 weather)2020-06: 7 large outage reports (7 weather)2020-07: 6 large outage reports (6 weather)2020-08: 28 large outage reports (28 weather)2020-09: 8 large outage reports (7 weather)2020-10: 17 large outage reports (17 weather)2020-11: 8 large outage reports (8 weather)2020-12: 7 large outage reports (7 weather)2021-01: 9 large outage reports (9 weather)2021-02: 10 large outage reports (10 weather)2021-03: 3 large outage reports (3 weather)2021-04: 1 large outage reports (1 weather)2021-05: 3 large outage reports (3 weather)2021-06: 4 large outage reports (3 weather)2021-07: 8 large outage reports (8 weather)2021-08: 13 large outage reports (13 weather)2021-09: 10 large outage reports (10 weather)2021-10: 7 large outage reports (7 weather)2021-11: 2 large outage reports (2 weather)2021-12: 12 large outage reports (12 weather)2022-01: 7 large outage reports (7 weather)2022-02: 5 large outage reports (5 weather)2022-03: 5 large outage reports (5 weather)2022-04: 4 large outage reports (4 weather)2022-05: 3 large outage reports (3 weather)2022-06: 11 large outage reports (11 weather)2022-07: 4 large outage reports (4 weather)2022-08: 8 large outage reports (7 weather)2022-09: 9 large outage reports (9 weather)2022-10: 2 large outage reports (1 weather)2022-11: 8 large outage reports (7 weather)2022-12: 11 large outage reports (11 weather)2023-01: 6 large outage reports (6 weather)2023-02: 7 large outage reports (7 weather)2023-03: 15 large outage reports (15 weather)2023-04: 2 large outage reports (2 weather)2023-05: 1 large outage reports (1 weather)2023-06: 6 large outage reports (6 weather)2023-07: 18 large outage reports (18 weather)2023-08: 1 large outage reports (1 weather)2023-09: 4 large outage reports (4 weather)2023-10: 1 large outage reports (1 weather)2023-11: 2 large outage reports (2 weather)2023-12: 1 large outage reports (1 weather)2024-01: 15 large outage reports (15 weather)2024-02: 6 large outage reports (6 weather)2024-03: 8 large outage reports (7 weather)2024-04: 8 large outage reports (8 weather)2024-05: 19 large outage reports (19 weather)2024-06: 9 large outage reports (9 weather)2024-07: 6 large outage reports (6 weather)2024-08: 10 large outage reports (9 weather)2024-09: 14 large outage reports (13 weather)2024-10: 5 large outage reports (5 weather)2024-11: 7 large outage reports (7 weather)2024-12: 7 large outage reports (7 weather)2025-01: 7 large outage reports (7 weather)2025-02: 7 large outage reports (6 weather)2025-03: 10 large outage reports (10 weather)2025-04: 5 large outage reports (5 weather)2025-05: 6 large outage reports (6 weather)2025-06: 5 large outage reports (5 weather)2025-07: 12 large outage reports (12 weather)2025-08: 1 large outage reports (1 weather)2025-10: 2 large outage reports (2 weather)2025-11: 2 large outage reports (1 weather)2025-12: 7 large outage reports (7 weather)1. 2018-03: Winter storms12. 2020-04: Severe storms23. 2020-08: Storms Isaias and Laura34. 2020-10: Storms Zeta and Delta45. 2023-03: Severe storms56. 2023-07: Severe storms67. 2024-01: Severe storms78. 2024-05: Severe storms820152016201720182019202020212022202320242025

    Monthly count of OE-417 reports for outages affecting more than 50,000 customers. Numbered markers flag the eight busiest months, listed in the table below with the matching FEMA declaration titles for the states involved (OpenFEMA). Source: DOE OE-417 annual summaries, The Uptime Report analysis.

    Months with 13 or more weather-related large outage reports:

    Chart marker Month Weather-related large outage reports Most-reported states Matching FEMA declaration
    1 Mar 2018 20 NY, RI, MA Severe Winter Storm and Snowstorm; Severe Storm and Flooding
    May 2018 14 NY, MI, NH Severe Storms, Tornadoes, and Straight-Line Winds; Severe Storm and Flooding
    2 Apr 2020 23 MS, TX, KS Severe Storms, Tornadoes, Straight-Line Winds, and Flooding; Severe Storms, Tornadoes, and Straight-Line Winds
    3 Aug 2020 28 NY, LA, NJ Tropical Storm Isaias; Hurricane Laura
    4 Oct 2020 17 LA, MS, TX Hurricane Zeta; Hurricane Delta
    Aug 2021 13 MI, LA, IL Hurricane Henri; Tropical Storm Ida
    5 Mar 2023 15 WA, KY, VA Severe Storms, Straight-Line Winds, and Tornadoes; Severe Storms, Straight-Line Winds, Tornadoes, Flooding, Landslides, and Mudslides
    6 Jul 2023 18 MI, MD, MO Severe Storms, Straight-Line Winds, Tornadoes, and Flooding; Severe Storms and Flooding
    7 Jan 2024 15 WA, NC, MI Severe Storms and Flooding; Severe Winter Storms, Straight-Line Winds, Landslides, and Mudslides
    8 May 2024 19 TX, FL, KS Severe Storms, Straight-Line Winds, Tornadoes, and Flooding; Severe Storms, Straight-Line Winds, Tornadoes, Landslides, and Mudslides
    Sep 2024 13 SC, FL, NC Hurricane Helene; Hurricane Milton

    Every OE-417 report by cause

    The full set of OE-417 reports is broader than outages: it also covers attacks on equipment, cyber incidents, fuel shortages, and grid emergencies that did not black anyone out. Physical security reports have outnumbered weather reports in every year since 2022, but none of the 865 large outage reports was classified as physical security. The form, its alert criteria, and the filing portal have changed over time, so year-to-year totals are not strictly comparable.

    Year Weather Physical security Grid operations and equipment Cyber Fuel supply Other or unknown All reports Large outage reports Weather share of large
    2013 56 79 30 2 6 1 174 n/a n/a
    2014 87 73 31 3 17 3 214 n/a n/a
    2015 66 42 29 0 0 6 143 59 92%
    2016 42 44 38 4 7 6 141 44 93%
    2017 80 45 18 0 7 0 150 74 97%
    2018 102 58 55 0 5 0 220 81 99%
    2019 92 81 98 0 7 0 278 78 96%
    2020 166 94 113 3 7 0 383 125 99%
    2021 156 92 121 7 11 0 387 82 99%
    2022 95 163 118 9 5 0 390 77 96%
    2023 81 175 50 4 1 37 348 67 100%
    2024 133 180 69 62 43 135 622 114 97%
    2025 72 131 12 42 61 108 426 64 97%

    What this means for MSPs

    Size UPS runtime for shutdown, not ride-through. In 2025, the average interruption outside major event days lasted 116 minutes. A small UPS sized for a few minutes of runtime will not carry a server room through that; its job is to keep network gear up for brief flickers and to trigger a clean shutdown of servers and storage. Test that the shutdown agent actually fires, because that is the outcome most outages will produce.

    Set a generator threshold in hours, by state. Interruptions attributable to major event days averaged roughly 9.2 hours each in 2025 and 19.0 hours in 2024. For clients in the top of the table above, where five-year averages run from 9 to 26 hours a year, a standby generator or an agreed relocation plan belongs in the continuity conversation. For clients in the District of Columbia, Delaware, or Arizona, under two hours a year, a UPS plus cloud failover usually covers the risk.

    Compare the grid to your SLA. The average U.S. customer lost 422 minutes a year in 2021 to 2025, which works out to 99.92% grid availability, close to the 525.6 minutes a year allowed by a 99.9% SLA. In Louisiana it was 99.70%. An on-premises system with no generator cannot promise a higher number than the utility feeding it.

    Do not forget the phones and the internet edge. Business phone service is now mostly IP-based (see our VoIP statistics), so a power cut takes down the phones along with the firewall and switches unless they sit on the UPS. Cloud-hosted workloads keep running during a local outage, but staff only reach them if the office edge or their homes have power and connectivity.

    Treat it as a year-round risk. Large weather outages are not just a hurricane-season problem. From 2015 to 2025, every calendar month logged at least 50 weather-related large outage reports to the DOE (November was the quietest), and the busiest month, July, logged 91. June to September accounted for 37% of them, but December to February accounted for 23% and March to May for 26%, so generator load tests and UPS battery checks belong on a fixed schedule, not just before late summer.

    Frequently asked questions

    How many hours of power outages does the average American have per year?

    In 2025, the average U.S. electricity customer was without power for 269 minutes (4.5 hours) across 1.34 interruptions, based on utility reports to the EIA under the IEEE standard. The 2021 to 2025 average was 7.0 hours a year, and 2024 was the worst year in the series at 11.0 hours.

    What states have the most power outages?

    Averaged over 2021 to 2025, customers in Louisiana lost the most time (25.9 hours a year), followed by Maine (17.5) and West Virginia (16.8). West Virginia has the most everyday outage time once major event days are removed (7.9 hours a year). The District of Columbia has the least (0.8 hours).

    Are power outages getting worse in the US?

    Yes, mostly because of major events. Average outage time rose from 4.8 hours a year in 2013 to 2017 to 7.0 hours in 2021 to 2025. Time lost on major event days grew 70%, while everyday outage time grew 10%. Major events account for 91% of the increase.

    What causes most large power outages?

    Weather. Of the 865 reports utilities filed with the Department of Energy from 2015 to 2025 for outages affecting more than 50,000 customers, 841 (97%) gave weather or natural disaster as the cause.

    How long does a typical power outage last?

    In 2025, an average interruption outside major event days lasted 116 minutes (about 2 hours). Interruptions attributable to major event days averaged roughly 9.2 hours in 2025 and 19.0 hours in 2024.

    Download the data. power-outage-statistics-by-state-2013-2025.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Sources. U.S. Energy Information Administration, Form EIA-861 annual files 2013 to 2025 (Reliability and Sales to Ultimate Customers tables; 2025 final data released October 7, 2026). U.S. Department of Energy, Form OE-417 Electric Emergency Incident and Disturbance annual summaries, 2013 to 2025. FEMA OpenFEMA Disaster Declarations Summaries (v2). All retrieved October 2026.

    Definitions. SAIDI is the total minutes of sustained interruption per customer served in a year; SAIFI is the number of sustained interruptions per customer. Major event days follow IEEE Standard 1366 (2003 or 2012 edition), under which each utility identifies days beyond its normal operating conditions; the EIA notes these are usually severe weather but can include vegetation interference and atypical utility operations. We follow the EIA-861 instructions: an interruption counts if it lasts more than 5 minutes, and momentary interruptions are excluded. “Everyday outages” means SAIDI without major event days.

    Aggregation. State and national figures are customer-weighted averages of each utility’s reported SAIDI and SAIFI, using only utilities reporting under the IEEE standard, as the EIA does. Multi-state utilities report each state separately. National figures cover the 50 states and DC (territories excluded). Five-year averages are simple means of the five annual values. Average interruption length is SAIDI divided by SAIFI; the length attributable to major event days is the difference in SAIDI with and without major event days divided by the difference in SAIFI, an approximation because each figure is a separate customer-weighted average. Coverage is IEEE-reporting customers divided by total customers in the EIA sales file (bundled, delivery, and adjustment rows).

    Checks. Our national series matches EIA Electric Power Annual Table 11.1 exactly for every year from 2014 to 2024 except 2021 (0.6 minutes higher, likely a later data revision), including 662.6 minutes (11.0 hours) for 2024, which the EIA reported as 11 hours with 80% from major events, and 333.0 minutes for 2022, which the EIA reported as about five and one-half hours. Our 2024 state figures match the EIA’s published state values (Table 11.4 and the EIA-861 State Totals sheet) within one minute in 51 of 51 states (for example, South Carolina 3155.0 minutes, which the EIA described as nearly 53 hours). For 2025, the EIA’s own “State Totals” sheet omits several large utilities that appear in its utility-level file (for example PacifiCorp in Utah, Oregon, and Wyoming, and Delmarva Power in Delaware), so our 2025 figures differ from that sheet by more than one minute in 16 states; ours include every IEEE utility report.

    OE-417. Large outage reports are rows whose alert criterion is loss of electric service to more than 50,000 customers for one hour or more (criterion recorded from 2015). Cause categories are our grouping of the free-text event type: anything mentioning weather, natural disaster, storms, or wildfire counts as weather. Customer counts in OE-417 are initial estimates and often double-count across reports, so we do not sum them. Thirty-two 2023 rows with a blank start date are counted in 2023 and dated by restoration date. FEMA titles are matched to the busiest months by state and incident start date within the month.

    Limitations. About 21% of U.S. customers are served by utilities that report under another standard or not at all (many small cooperatives and municipal utilities file a short form without reliability data). SAIDI is an average: individual buildings can see far more or less. Major event day thresholds are utility-specific, so the split between everyday and major event outages is not identical across utilities.

    Not advice. This is an analysis of public reliability data, not an engineering assessment of any site’s power protection needs.

    Cite as:The Uptime Report. "Power Outage Statistics: Outage Hours Rose 46% in a Decade, and Major Storms Caused 91% of the Increase." October 2026. https://theuptimereport.com/power-outage-statistics/

    References

    1. U.S. EIA, Form EIA-861 detailed data files (2013 to 2025). Accessed October 2026.
    2. U.S. EIA, Electric Power Annual, Table 11.1: Reliability metrics of U.S. distribution system. Accessed October 2026.
    3. U.S. EIA, Electric Power Annual, Table 11.4: SAIDI values of U.S. distribution system by state. Accessed October 2026.
    4. U.S. EIA, “Hurricanes in 2024 led to the most hours without power in the United States in 10 years” (December 1, 2025). Accessed October 2026.
    5. U.S. EIA, “Electricity customers in Puerto Rico lose about 27 hours of power per year”. Accessed October 2026.
    6. U.S. EIA, “U.S. electricity customers averaged five and one-half hours of power interruptions in 2022” (January 25, 2024). Accessed October 2026.
    7. U.S. EIA, Form EIA-861 instructions, Schedule 3 Part B (distribution system reliability, IEEE). Accessed October 2026.
    8. U.S. Department of Energy, OE-417 Electric Emergency Incident and Disturbance Reports, annual summaries. Accessed October 2026.
    9. FEMA, OpenFEMA Disaster Declarations Summaries v2. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Cost of Downtime: The Median US Public Company Has $96K an Hour at Stake

    Uptime Report Research · Downtime Economics

    Cost of Downtime: The Median US Public Company Has $96K an Hour at Stake

    The cost of downtime starts with the revenue a company books every hour. We pulled fiscal 2025 revenue for 3,560 US-based SEC filers from the SEC’s XBRL data and divided by 8,760 hours. The median of the 3,001 companies listed on a US exchange takes in $96K an hour, or $1,607 a minute. That is revenue at stake, an upper bound on lost sales, not the full cost.

    Revenue per hour, largest US-listed companies

    AMZNAmazon.com$81.8Mper hour$1.36M/min
    WMTWalmart$81.4Mper hour$1.36M/min
    UNHUnitedHealth Group$51.1Mper hour$852K/min
    AAPLApple$47.5Mper hour$792K/min
    MCKMcKesson$46.1Mper hour$768K/min
    GOOGLAlphabet$46.0Mper hour$766K/min
    CVSCVS Health$45.9Mper hour$765K/min
    BRK-BBerkshire Hathaway$42.4Mper hour$707K/min
    XOMExxon Mobil$37.9Mper hour$632K/min
    CORCencora$36.7Mper hour$611K/min
    MSFTMicrosoft$32.2Mper hour$536K/min
    DALDelta Air Lines$7.2Mper hour$121K/min

    Fiscal year revenue that best matches calendar 2025 in SEC XBRL filings, divided by 8,760 hours. Delta is shown for the CrowdStrike case study below. Per-minute figures divide by 60 again.

    $96Kmedian revenue per hour, 3,001 US-listed companies
    $2.6Bcombined revenue per hour of all of them ($22.8 trillion a year)
    416companies with $1M or more an hour at stake (14%)
    45%share of five days of revenue that Delta reported losing to the CrowdStrike outage
    Read this first. Revenue per hour is revenue at stake: the most a company could lose in sales if every revenue-earning system stopped for that hour. It is not the full cost of downtime. It leaves out recovery labor, overtime, refunds, penalties, legal claims, and lost customers, and it overstates lost sales because much revenue is only delayed: customers rebook, reorder, or come back the next day.

    Which industries have the most revenue at stake per hour?

    Grouping the listed companies by their SEC industry code, insurance and health plans have the highest median, at $439K an hour across 94 companies, led by UnitedHealth Group, Berkshire Hathaway, and Cigna Group. Airlines and air freight are effectively tied at $425K, and construction and homebuilding ($338K) come third. Pharma and biotech sit at the bottom of the 19 groups, with a median of $7,091: 47% of listed pharma and biotech companies booked less than $50 million in revenue for the year. Software and IT services, the group closest to the MSP market, has a median of $68K an hour, below the all-company median of $96K.

    $0$100K$200K$300K$400K$500KInsurance and health plans: median $439K per hour across 94 listed companies (75th percentile $1.7M). Largest: UnitedHealth Group, $51.1M per hour.Insurance and health plansn=94$439KAirlines and air freight: median $425K per hour across 19 listed companies (75th percentile $2.4M). Largest: FedEx, $10.8M per hour.Airlines and air freightn=19$425KConstruction and homebuilding: median $338K per hour across 48 listed companies (75th percentile $750K). Largest: D.R. Horton, $3.9M per hour.Construction and homebuildingn=48$338KWholesale distribution: median $333K per hour across 80 listed companies (75th percentile $1.5M). Largest: McKesson, $46.1M per hour.Wholesale distributionn=80$333KUtilities and energy midstream: median $273K per hour across 102 listed companies (75th percentile $1.5M). Largest: Energy Transfer LP, $9.8M per hour.Utilities and energy midstreamn=102$273KBrokers and asset managers: median $271K per hour across 50 listed companies (75th percentile $739K). Largest: StoneX Group, $15.1M per hour.Brokers and asset managersn=50$271KRetail and restaurants: median $240K per hour across 181 listed companies (75th percentile $1.3M). Largest: Amazon.com, $81.8M per hour.Retail and restaurantsn=181$240KTransportation and logistics: median $192K per hour across 60 listed companies (75th percentile $1.2M). Largest: United Parcel Service, $10.1M per hour.Transportation and logisticsn=60$192KVehicles and aerospace: median $169K per hour across 77 listed companies (75th percentile $471K). Largest: Ford Motor, $21.4M per hour.Vehicles and aerospacen=77$169KHospitals and health services: median $155K per hour across 66 listed companies (75th percentile $369K). Largest: HCA Healthcare, $8.6M per hour.Hospitals and health servicesn=66$155KOil, gas, and mining: median $147K per hour across 131 listed companies (75th percentile $474K). Largest: Exxon Mobil, $37.9M per hour.Oil, gas, and miningn=131$147KOther services: median $126K per hour across 282 listed companies (75th percentile $457K). Largest: Walt Disney, $10.8M per hour.Other servicesn=282$126KTelecom and media: median $111K per hour across 59 listed companies (75th percentile $535K). Largest: Verizon Communications, $15.8M per hour.Telecom and median=59$111KOther manufacturing: median $106K per hour across 729 listed companies (75th percentile $420K). Largest: PepsiCo, $10.7M per hour.Other manufacturingn=729$106KComputer hardware and semiconductors: median $78K per hour across 168 listed companies (75th percentile $366K). Largest: Apple, $47.5M per hour.Computer hardware and semiconductorsn=168$78KBanks and lending: median $74K per hour across 107 listed companies (75th percentile $252K). Largest: JPMorgan Chase, $20.8M per hour.Banks and lendingn=107$74KSoftware and IT services: median $68K per hour across 288 listed companies (75th percentile $186K). Largest: Alphabet, $46.0M per hour.Software and IT servicesn=288$68KReal estate, REITs, and holding cos: median $54K per hour across 159 listed companies (75th percentile $176K). Largest: CBRE Group, $4.6M per hour.Real estate, REITs, and holding cosn=159$54KPharma and biotech: median $7,091 per hour across 290 listed companies (75th percentile $34K). Largest: Johnson & Johnson, $10.8M per hour.Pharma and biotechn=290$7,091

    Median fiscal 2025 revenue divided by 8,760 hours, US-listed companies grouped by SIC code; groups with at least 15 companies. Hover a bar for the 75th percentile and the largest company. Top three highlighted.

    Industry Companies Median per hour Median per minute 75th percentile per hour Largest company (per hour)
    Insurance and health plans 94 $439K $7,309 $1.7M UnitedHealth Group ($51.1M)
    Airlines and air freight 19 $425K $7,085 $2.4M FedEx ($10.8M)
    Construction and homebuilding 48 $338K $5,639 $750K D.R. Horton ($3.9M)
    Wholesale distribution 80 $333K $5,555 $1.5M McKesson ($46.1M)
    Utilities and energy midstream 102 $273K $4,553 $1.5M Energy Transfer LP ($9.8M)
    Brokers and asset managers 50 $271K $4,512 $739K StoneX Group ($15.1M)
    Retail and restaurants 181 $240K $4,001 $1.3M Amazon.com ($81.8M)
    Transportation and logistics 60 $192K $3,207 $1.2M United Parcel Service ($10.1M)
    Vehicles and aerospace 77 $169K $2,816 $471K Ford Motor ($21.4M)
    Hospitals and health services 66 $155K $2,579 $369K HCA Healthcare ($8.6M)
    Oil, gas, and mining 131 $147K $2,457 $474K Exxon Mobil ($37.9M)
    Other services 282 $126K $2,093 $457K Walt Disney ($10.8M)
    Telecom and media 59 $111K $1,856 $535K Verizon Communications ($15.8M)
    Other manufacturing 729 $106K $1,761 $420K PepsiCo ($10.7M)
    Computer hardware and semiconductors 168 $78K $1,308 $366K Apple ($47.5M)
    Banks and lending 107 $74K $1,228 $252K JPMorgan Chase ($20.8M)
    Software and IT services 288 $68K $1,126 $186K Alphabet ($46.0M)
    Real estate, REITs, and holding cos 159 $54K $906 $176K CBRE Group ($4.6M)
    Pharma and biotech 290 $7,091 $118 $34K Johnson & Johnson ($10.8M)

    What is the cost of downtime for the median company?

    The spread is enormous, so averages mislead. The mean listed company books $866K an hour, but that figure is pulled up by giants: the 100 largest companies account for 58% of all revenue in the group. The median is $96K an hour, which corresponds to annual revenue of about $844.6M. A quarter of listed companies take in less than $12K an hour; one in ten takes in more than $1.6M.

    0100200300400500600$1 to $3 per hour: 9 companies (0.3%)$3 to $10 per hour: 20 companies (0.7%)$10 to $32 per hour: 19 companies (0.6%)$32 to $100 per hour: 36 companies (1.2%)$100 to $316 per hour: 66 companies (2.2%)$316 to $1,000 per hour: 113 companies (3.8%)$1,000 to $3,162 per hour: 187 companies (6.2%)$3,162 to $10K per hour: 247 companies (8.2%)$10K to $32K per hour: 334 companies (11.1%)$32K to $100K per hour: 491 companies (16.4%)$100K to $316K per hour: 572 companies (19.1%)$316K to $1.0M per hour: 491 companies (16.4%)$1.0M to $3.2M per hour: 265 companies (8.8%)$3.2M to $10.0M per hour: 106 companies (3.5%)$10.0M to $31.6M per hour: 34 companies (1.1%)$31.6M to $100.0M per hour: 11 companies (0.4%)Median $96K/hrDelta $7.2M/hr$1$10$100$1,000$10K$100K$1M$10M$100MRevenue per hour (log scale, each bar is a half step of ten)

    Count of US-listed companies by fiscal 2025 revenue per hour. Of the 263 listed companies under $1K an hour, 83 are in pharma and biotech, the largest group.

    Revenue per hour Annual revenue Companies Share Cumulative
    Under $1K under $8.8M 263 8.8% 8.8%
    $1K to $10K $8.8M to $88M 434 14.5% 23.2%
    $10K to $100K $88M to $876M 825 27.5% 50.7%
    $100K to $1M $876M to $8.8B 1,063 35.4% 86.1%
    $1M to $10M $8.8B to $88B 371 12.4% 98.5%
    $10M and up over $88B 45 1.5% 100.0%

    For the small and midsize businesses that MSPs serve, the numbers are much smaller. A company with $10 million in annual revenue books about $1,142 an hour across the whole year, or about $4,444 per business hour if all its sales happen in a 9-hour day, 250 days a year.

    Calculate your downtime cost

    $0revenue at stake per hour
    $0per minute
    $0for the outage
    Revenue at stake = annual revenue x share dependent / revenue hours x hours down

    The default spreads revenue evenly over all 8,760 hours of the year, as the company figures in this report do. If your revenue lands in business hours, pick a shorter basis and count only outage hours inside them. Then add recovery costs and subtract sales that customers will make later.

    What real outages cost, according to the filings

    Companies rarely put a number on an outage, but when the hit is large enough they disclose it to investors. These are the figures in the filings themselves. To compare them with revenue at stake, the fourth column divides each dollar amount by the company’s revenue per hour in the year of the incident.

    Company and event What the filing quantifies Revenue per hour (incident year) Impact in hours of revenue Source
    Delta Air Lines
    CrowdStrike faulty update, July 19, 2024    		 $380M revenue + $170M expense $7.04M 54 hours Form 8-K, August 8, 2024
    UnitedHealth Group
    Change Healthcare cyberattack, February 2024    		 $279M lost revenue + $593M response costs (Q1 2024) $45.69M 6 hours Form 10-Q, Q1 2024
    MGM Resorts
    Cybersecurity issue, September 2023    		 $100M EBITDAR + under $10M one-time costs $1.85M 54 hours Form 8-K, October 5, 2023
    CrowdStrike (the vendor)
    Its own July 19, 2024 faulty update    		 $60.1M expenses, net of insurance (FY ended Jan 2025) $451K 133 hours Form 10-K, fiscal 2025
    AutoNation
    CDK Global dealer system outage, June 2024    		 $1.55 EPS; about $43M one-time staff pay $3.06M 14 hours Form 8-K Ex. 99.1, July 31, 2024; Form 10-Q, Q2 2024
    Sonic Automotive
    CDK Global dealer system outage, June 2024    		 $30.0M pre-tax income $1.62M 18 hours Form 10-Q, Q2 2024
    Asbury Automotive
    CDK Global dealer system outage, June 2024    		 $0.95 to $1.15 EPS $1.96M n/a Form 8-K Ex. 99.1, August 2, 2024
    Group 1 Automotive
    CDK Global dealer system outage, June 2024    		 $5.9M retention pay $2.28M 3 hours Form 10-Q, Q2 2024

    Hours of revenue = the first dollar figure in column two divided by revenue per hour (AutoNation uses its roughly $43 million one-time staff pay; Asbury disclosed only an earnings per share range). UnitedHealth’s lost revenue was at its Optum Insight unit, so dividing by group revenue understates the hit to that unit. These are different kinds of figures (revenue, pre-tax income, EBITDAR, expenses) and are not comparable with each other.

    Delta: what revenue at stake gets right and wrong

    Delta booked $61.6B of revenue in 2024, or $7.04M an hour. Five days of that is $844.4M. Delta’s August 8, 2024 Form 8-K put the direct revenue impact of the July 19 CrowdStrike outage at “$380 million, primarily driven by refunding customers for cancelled flights and providing customer compensation in the form of cash and SkyMiles”, or about 54 hours of average revenue. So the revenue Delta lost was about 45% of five days of revenue at stake. But Delta also reported “$170 million” of non-fuel expense, “primarily due to customer expense reimbursements and crew-related costs”, and its 2024 10-K says the disruption caused “approximately 7,000 cancellations of Delta flights over five days, impacting 1.4 million customers.” Revenue at stake overstated the lost sales and missed the recovery bill.

    The CDK dealer outage: a vendor goes down, every customer pays

    In June 2024 a cyber incident at CDK Global took down the dealer management system that many car dealers use for sales, service, and accounting. Four public dealer groups quantified it. Sonic Automotive estimated the hit to pre-tax income at about $30.0 million, “which includes approximately $11.6 million in additional compensation expenses.” AutoNation said the outage “reduced earnings per share by an estimated $1.55, including $0.79 of one-time costs”, and its 10-Q cites about $43 million paid to commission-based staff “to ensure business continuity.” Asbury put the hit at $0.95 to $1.15 per share and noted cyber insurance of $15.0 million with a $2.5 million deductible. Group 1 reported $5.9 million of one-time retention pay. Three of the four groups broke out pay to staff during the outage as a separate cost.

    CrowdStrike and the vendor side

    CrowdStrike’s 10-K for the fiscal year ended January 31, 2025 records $60.1M of expenses “net of insurance receivable recorded” relating to the July 19 incident, and says its customer commitment packages “that extend subscription periods will lengthen the applicable term over which we recognize revenue.” The vendor’s own direct expense was small next to what a single customer such as Delta reported. The two cyberattacks in the table, at UnitedHealth and MGM, produced the same mix of lost revenue or earnings plus response costs, and our tracker of every SEC Item 1.05 cybersecurity incident filing shows how often companies now disclose material incidents.

    Why the popular per-minute figures do not hold up

    Pages that rank for this search tend to lead with one per-minute number, often attributed to a 2014 Gartner blog post or to vendor surveys of IT leaders. The original Gartner blog URL now redirects to a general Gartner landing page, so we could not read the source and do not use the number. A single average cannot describe businesses whose hourly revenue ranges from under $1,000 to $81.8M. The SEC data lets any company find peers its own size.

    What this means for MSPs

    Use revenue at stake to size the conversation, not to close it. For a client, multiply annual revenue by the share that depends on the systems in question, divide by operating hours, and you have a defensible ceiling for lost sales per hour. Then add the costs the filings above show are real: staff paid to wait or work around the outage (AutoNation, Sonic, Group 1), customer refunds and reimbursements (Delta), and outside recovery help, which you can price with the hourly rates in federal IT contracts. Compare that total with what redundancy, tested backups, and a vendor outage plan cost per year.

    Two lessons stand out. First, third-party platforms are a single point of failure: the CDK and CrowdStrike cases hit companies whose own systems were not the root cause, so business continuity plans need a section on what happens when a key SaaS or security vendor goes down. Second, plan for physical events too: FEMA data on major disaster declarations by state shows how often disasters strike each state, and continuity plans should cover sites as well as software.

    Frequently asked questions

    What is the average cost of downtime?

    It depends almost entirely on company size. Across 3,001 US-listed companies in fiscal 2025, the median brings in $96K of revenue per hour ($1,607 per minute). The middle half sits between $12K and $428K per hour. That is revenue at stake during a full outage, an upper bound on lost sales, not the total cost.

    How do you calculate the cost of downtime?

    Start with revenue at stake: annual revenue times the share of revenue that depends on the affected systems, divided by 8,760 hours, times the hours down. Then subtract what customers will simply buy later and add recovery labor, overtime, refunds, penalties, and lost productivity. Delta’s filings show both sides: $380 million of direct revenue impact plus $170 million of extra expense.

    What is the average cost of downtime per industry?

    Measured as median revenue per hour for US-listed companies, insurance and health plans lead at $439K per hour, followed by airlines and air freight ($425K) and construction and homebuilding ($338K). Pharma and biotech has the lowest median of the 19 groups we measured, at $7,091.

    What does cost of downtime mean?

    It is the money a business loses while systems or operations are unavailable: lost or delayed revenue, idle staff, recovery and overtime costs, refunds and contractual penalties, and longer term damage such as lost customers. Public company filings usually report only the parts they can measure, such as lost revenue and one-time expenses.

    How much did the CrowdStrike outage cost Delta?

    Delta’s August 8, 2024 Form 8-K estimated a direct revenue impact of $380 million and $170 million of non-fuel expense from the July 19, 2024 outage, partly offset by $50 million of lower fuel expense. It said its legal claims against CrowdStrike and Microsoft total at least $500 million. About 7,000 flights were cancelled over five days.

    Look up a company: the 100 largest US-listed companies

    Click a column to sort. The downloadable CSV has all 3,769 US filers in the data, including subsidiaries, companies not listed on an exchange, and the excluded partial-revenue filers, each flagged.

    Rank Company Ticker Industry FY end Revenue Per hour Per minute
    1 Amazon.com AMZN Retail and restaurants 2025-12 $716.9B $81.84M $1.36M
    2 Walmart WMT Retail and restaurants 2026-01 $713.2B $81.41M $1.36M
    3 UnitedHealth Group UNH Insurance and health plans 2025-12 $447.6B $51.09M $852K
    4 Apple AAPL Computer hardware and semiconductors 2025-09 $416.2B $47.51M $792K
    5 McKesson MCK Wholesale distribution 2026-03 $403.4B $46.05M $768K
    6 Alphabet GOOGL Software and IT services 2025-12 $402.8B $45.99M $766K
    7 CVS Health CVS Retail and restaurants 2025-12 $402.1B $45.90M $765K
    8 Berkshire Hathaway BRK-B Insurance and health plans 2025-12 $371.4B $42.40M $707K
    9 Exxon Mobil XOM Oil, gas, and mining 2025-12 $332.2B $37.93M $632K
    10 Cencora COR Wholesale distribution 2025-09 $321.3B $36.68M $611K
    11 Microsoft MSFT Software and IT services 2025-06 $281.7B $32.16M $536K
    12 Costco Wholesale COST Retail and restaurants 2025-08 $275.2B $31.42M $524K
    13 Cigna Group CI Insurance and health plans 2025-12 $274.9B $31.38M $523K
    14 Cardinal Health CAH Wholesale distribution 2025-06 $222.6B $25.41M $423K
    15 Nvidia NVDA Computer hardware and semiconductors 2026-01 $215.9B $24.65M $411K
    16 Meta Platforms META Software and IT services 2025-12 $201.0B $22.94M $382K
    17 Elevance Health ELV Insurance and health plans 2025-12 $199.1B $22.73M $379K
    18 Centene CNC Insurance and health plans 2025-12 $194.8B $22.23M $371K
    19 Chevron CVX Oil, gas, and mining 2025-12 $189.0B $21.58M $360K
    20 Ford Motor F Vehicles and aerospace 2025-12 $187.3B $21.38M $356K
    21 General Motors GM Vehicles and aerospace 2025-12 $185.0B $21.12M $352K
    22 JPMorgan Chase JPM Banks and lending 2025-12 $182.4B $20.83M $347K
    23 Home Depot HD Retail and restaurants 2026-02 $164.7B $18.80M $313K
    24 Kroger KR Retail and restaurants 2026-01 $147.6B $16.85M $281K
    25 Verizon Communications VZ Telecom and media 2025-12 $138.2B $15.78M $263K
    26 Marathon Petroleum MPC Oil, gas, and mining 2025-12 $132.7B $15.15M $252K
    27 StoneX Group SNEX Brokers and asset managers 2025-09 $132.4B $15.11M $252K
    28 Phillips 66 PSX Oil, gas, and mining 2025-12 $132.4B $15.11M $252K
    29 Humana HUM Insurance and health plans 2025-12 $129.7B $14.80M $247K
    30 AT&T T Telecom and media 2025-12 $125.6B $14.34M $239K
    31 Comcast CMCSA Telecom and media 2025-12 $123.7B $14.12M $235K
    32 Valero Energy VLO Oil, gas, and mining 2025-12 $122.7B $14.01M $233K
    33 Dell Technologies DELL Computer hardware and semiconductors 2026-01 $113.5B $12.96M $216K
    34 Bank of America BAC Banks and lending 2025-12 $113.1B $12.91M $215K
    35 Target TGT Retail and restaurants 2026-01 $104.8B $11.96M $199K
    36 Tesla TSLA Vehicles and aerospace 2025-12 $94.8B $10.82M $180K
    37 FedEx FDX Airlines and air freight 2026-05 $94.7B $10.81M $180K
    38 Walt Disney DIS Other services 2025-09 $94.4B $10.78M $180K
    39 Johnson & Johnson JNJ Pharma and biotech 2025-12 $94.2B $10.75M $179K
    40 PepsiCo PEP Other manufacturing 2025-12 $93.9B $10.72M $179K
    41 Boeing BA Vehicles and aerospace 2025-12 $89.5B $10.21M $170K
    42 United Parcel Service UPS Transportation and logistics 2025-12 $88.7B $10.12M $169K
    43 RTX RTX Vehicles and aerospace 2025-12 $88.6B $10.11M $169K
    44 T-Mobile US TMUS Telecom and media 2025-12 $88.3B $10.08M $168K
    45 Progressive PGR Insurance and health plans 2025-12 $87.7B $10.01M $167K
    46 Lowe’s Companies LOW Retail and restaurants 2026-01 $86.3B $9.85M $164K
    47 Energy Transfer LP ET Utilities and energy midstream 2025-12 $85.5B $9.76M $163K
    48 Citigroup C Banks and lending 2025-12 $85.2B $9.73M $162K
    49 Sysco SYY Wholesale distribution 2026-06 $84.6B $9.65M $161K
    50 Procter & Gamble PG Other manufacturing 2025-06 $84.3B $9.62M $160K
    51 Wells Fargo WFC Banks and lending 2025-12 $83.7B $9.55M $159K
    52 Albertsons Companies ACI Retail and restaurants 2026-02 $83.2B $9.49M $158K
    53 Archer-Daniels-Midland ADM Other manufacturing 2025-12 $80.3B $9.16M $153K
    54 MetLife MET Insurance and health plans 2025-12 $77.1B $8.80M $147K
    55 HCA Healthcare HCA Hospitals and health services 2025-12 $75.6B $8.63M $144K
    56 Lockheed Martin LMT Vehicles and aerospace 2025-12 $75.0B $8.57M $143K
    57 American Express AXP Banks and lending 2025-12 $72.2B $8.25M $137K
    58 Morgan Stanley MS Brokers and asset managers 2025-12 $70.6B $8.06M $134K
    59 Performance Food Group PFGC Wholesale distribution 2026-06 $67.8B $7.74M $129K
    60 Allstate ALL Insurance and health plans 2025-12 $67.7B $7.73M $129K
    61 Caterpillar CAT Other manufacturing 2025-12 $67.6B $7.72M $129K
    62 IBM IBM Computer hardware and semiconductors 2025-12 $67.5B $7.71M $128K
    63 Oracle ORCL Software and IT services 2026-05 $67.4B $7.69M $128K
    64 Eli Lilly LLY Pharma and biotech 2025-12 $65.2B $7.44M $124K
    65 Merck & Co. MRK Pharma and biotech 2025-12 $65.0B $7.42M $124K
    66 Broadcom AVGO Computer hardware and semiconductors 2025-11 $63.9B $7.29M $122K
    67 Delta Air Lines DAL Airlines and air freight 2025-12 $63.4B $7.23M $121K
    68 Pfizer PFE Pharma and biotech 2025-12 $62.6B $7.14M $119K
    69 TD Synnex SNX Wholesale distribution 2025-11 $62.5B $7.14M $119K
    70 AbbVie ABBV Pharma and biotech 2025-12 $61.2B $6.98M $116K
    71 Prudential Financial PRU Insurance and health plans 2025-12 $60.8B $6.94M $116K
    72 Galaxy Digital GLXY Brokers and asset managers 2025-12 $60.4B $6.90M $115K
    73 TJX Companies TJX Retail and restaurants 2026-01 $60.4B $6.89M $115K
    74 United Airlines UAL Airlines and air freight 2025-12 $59.1B $6.74M $112K
    75 ConocoPhillips COP Oil, gas, and mining 2025-12 $58.9B $6.73M $112K
    76 Goldman Sachs Group GS Brokers and asset managers 2025-12 $58.3B $6.65M $111K
    77 Cisco Systems CSCO Computer hardware and semiconductors 2025-07 $56.7B $6.47M $108K
    78 HP HPQ Computer hardware and semiconductors 2025-10 $55.3B $6.31M $105K
    79 Charter Communications CHTR Telecom and media 2025-12 $54.8B $6.25M $104K
    80 American Airlines Group AAL Airlines and air freight 2025-12 $54.6B $6.24M $104K
    81 Tyson Foods TSN Other manufacturing 2025-09 $54.4B $6.21M $104K
    82 Capital One Financial COF Banks and lending 2025-12 $53.4B $6.10M $102K
    83 Intel INTC Computer hardware and semiconductors 2025-12 $52.9B $6.03M $101K
    84 Enterprise Products Partners EPD Utilities and energy midstream 2025-12 $52.6B $6.00M $100K
    85 Ingram Micro Holding INGM Wholesale distribution 2025-12 $52.6B $6.00M $100K
    86 General Dynamics GD Other manufacturing 2025-12 $52.5B $6.00M $100K
    87 Uber Technologies UBER Other services 2025-12 $52.0B $5.94M $99K
    88 Travelers Companies TRV Insurance and health plans 2025-12 $48.8B $5.57M $93K
    89 Bristol-Myers Squibb BMY Pharma and biotech 2025-12 $48.2B $5.50M $92K
    90 Coca-Cola KO Other manufacturing 2025-12 $47.9B $5.47M $91K
    91 NIKE NKE Other manufacturing 2026-05 $46.4B $5.30M $88K
    92 General Electric GE Other manufacturing 2025-12 $45.9B $5.23M $87K
    93 Deere DE Other manufacturing 2025-11 $45.7B $5.22M $87K
    94 Molina Healthcare MOH Insurance and health plans 2025-12 $45.4B $5.19M $86K
    95 Netflix NFLX Other services 2025-12 $45.2B $5.16M $86K
    96 Thermo Fisher Scientific TMO Other manufacturing 2025-12 $44.6B $5.09M $85K
    97 Abbott Laboratories ABT Pharma and biotech 2025-12 $44.3B $5.06M $84K
    98 Qualcomm QCOM Computer hardware and semiconductors 2025-09 $44.3B $5.06M $84K
    99 Plains All American Pipeline LP PAA Transportation and logistics 2025-12 $44.3B $5.05M $84K
    100 Dollar General DG Retail and restaurants 2026-01 $42.7B $4.88M $81K
    Download the data. cost-of-downtime-revenue-per-hour-sec-2025.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. SEC XBRL frames API, calendar period CY2025, retrieved October 2026, for the revenue concepts Revenues, RevenueFromContractWithCustomerExcludingAssessedTax, RevenueFromContractWithCustomerIncludingAssessedTax, and RevenuesNetOfInterestExpense (the older SalesRevenueNet concept returns no CY2025 data). Each frame holds one annual fact per company, the fiscal year that best matches calendar 2025, so fiscal years ending from mid 2025 to early 2026 are included. Company names, tickers, exchanges, and SIC codes come from the SEC submissions JSON for every company in the set.

    Revenue choice. Where a company reports several revenue concepts, we take the largest, except where the largest is exactly 1,000 or 1,000,000 times another revenue figure the company reported for the same year (a units error in the filing; 1 case, such as a company tagging $103.5 million as $103.5 billion). Revenue is as reported, so banks include interest income and commodity and crypto traders such as StoneX report gross trading revenue, which inflates their hourly figures relative to margins.

    Universe. 3,560 filers with a US location and positive revenue. The headline figures use the 3,001 with a listing on NYSE, Nasdaq, NYSE American, or Cboe, after removing listed pairs that report the identical revenue figure (holding companies and their operating partnerships). Subsidiaries that file their own reports, such as utility operating companies, remain in the CSV but not in the listed set. Listing status is as of October 2026, so companies taken private or delisted during 2026 drop out of the listed set. Exxon Mobil filed its 2025 report under its former registrant; its XOM listing now belongs to the new ExxonMobil Holdings Corp, so we count it as listed. For banks, insurers, and real estate companies (SIC 6000 to 6799), contract revenue under ASC 606 leaves out interest, premiums, and rent, so we drop the 209 such filers that report only that concept rather than total revenue. This lowers coverage among banks. The median across all 3,560 filers is $70K an hour.

    Definitions. Revenue per hour = annual revenue / 8,760. Revenue per minute = revenue per hour / 60. Industry groups combine SIC codes (for example, 7370 to 7379 for software and IT services; 4512, 4513, and 4522 for airlines and air freight). Medians are reported for groups with at least 15 listed companies.

    Outage figures. Every incident figure is quoted from the company’s own SEC filing, linked in the table. “Hours of revenue” divides that figure by revenue per hour from the CY2024 frame (CY2023 for MGM), and is a scale comparison only.

    Limitations. Revenue at stake is an upper bound on direct lost sales for a full outage. It excludes recovery costs, penalties, legal claims, and reputational harm, and much revenue is recoverable. Revenue is not spread evenly across hours, and most outages hit only some systems.

    Not advice. This is an analysis of public filings, not a financial or insurance recommendation.

    Cite as:The Uptime Report. "Cost of Downtime: The Median US Public Company Has $96K an Hour at Stake." October 2026. https://theuptimereport.com/cost-of-downtime/

    References

    1. SEC, EDGAR application programming interfaces (XBRL frames and submissions). Accessed October 2026.
    2. SEC XBRL frames, us-gaap Revenues, USD, CY2025. Accessed October 2026.
    3. SEC XBRL frames, us-gaap RevenueFromContractWithCustomerExcludingAssessedTax, USD, CY2025. Accessed October 2026.
    4. Delta Air Lines, Form 8-K, August 8, 2024. Accessed October 2026.
    5. Delta Air Lines, Form 10-K for 2024. Accessed October 2026.
    6. CrowdStrike Holdings, Form 10-K for fiscal 2025. Accessed October 2026.
    7. AutoNation, Form 8-K Exhibit 99.1, July 31, 2024. Accessed October 2026.
    8. AutoNation, Form 10-Q, quarter ended June 30, 2024. Accessed October 2026.
    9. Sonic Automotive, Form 10-Q, quarter ended June 30, 2024. Accessed October 2026.
    10. Asbury Automotive Group, Form 8-K Exhibit 99.1, August 2, 2024. Accessed October 2026.
    11. Asbury Automotive Group, Form 10-Q, quarter ended June 30, 2024. Accessed October 2026.
    12. Group 1 Automotive, Form 10-Q, quarter ended June 30, 2024. Accessed October 2026.
    13. UnitedHealth Group, Form 10-Q, quarter ended March 31, 2024. Accessed October 2026.
    14. MGM Resorts International, Form 8-K, October 5, 2023. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Cybersecurity Statistics 2026: Published Flaws Doubled, and Federal Patch Deadlines Fell to 3 Days

    Uptime Report Research · Sourced Fact Sheet

    Cybersecurity Statistics 2026: Published Flaws Doubled, and Federal Patch Deadlines Fell to 3 Days

    These cybersecurity statistics 2026 each trace to a primary dataset. The National Vulnerability Database published 74,838 CVEs from January to September 2026, 103% more than a year earlier. CISA confirmed only 255 new exploited flaws through Oct 8, 2026, but now gives agencies as little as 3 days to fix them, and the FBI logged $20.9 billion in 2025 cybercrime losses.

    This page is built so that every number has a path back to its data. It has 70 numbered figures, and every card names its primary source in a chip you can click. 50 come from 21 of our own research reports, each linked from the card as the analysis. The rest we read directly from the FBI, CISA, and the UK government for this page, plus 3 clearly labeled figures from Verizon’s own breach dataset. We also computed fresh numbers from CISA’s live catalog, including a sharp change in federal patch deadlines.

    74,838CVEs published, Jan to Sep 2026 (+103%)
    255CISA KEV additions, Jan 1 to Oct 8, 2026
    52%of 2026 KEV deadlines are 3 days or less
    $20.9Bcybercrime losses reported to the FBI, 2025
    802large healthcare breaches, 2025 (a record)

    What changed in 2026, like for like

    Comparing the same months of 2026 and 2025 separates growth from partial-year noise. Vulnerability disclosure roughly doubled in the NVD and tripled at Microsoft. Evidence of exploitation rose by about a third, Microsoft’s exploited zero-days held flat, and large healthcare breaches ran slightly behind 2025.

    -50%+0%+50%+100%+150%+200%+250%Microsoft CVEs fixed, Jan to Sep 2026 vs 2025: +219%Microsoft CVEs fixedJan to Sep+219%CVEs published (NVD), Jan to Sep 2026 vs 2025: +103%CVEs published (NVD)Jan to Sep+103%SEC Item 1.05 filings, Jan to Sep 2026 vs 2025: +55%SEC Item 1.05 filingsJan to Sep+55%CISA KEV additions, Jan 1 to Oct 8 2026 vs 2025: +30%CISA KEV additionsJan 1 to Oct 8+30%Microsoft exploited zero-days, Jan to Sep 2026 vs 2025: -5%Microsoft exploited zero-daysJan to Sep-5%Large healthcare breaches (HHS), Jan 1 to Sep 21 2026 vs 2025: -6%Large healthcare breaches (HHS)Jan 1 to Sep 21-6%
    Percent change, 2026 vs the same period of 2025. SEC filings are small counts (17 vs 11). Sources: NIST NVD, Microsoft MSRC, SEC EDGAR, CISA KEV 2026.10.08, HHS OCR breach portal. Analysis: The Uptime Report.

    The gap between the top two bars and the rest is the main story for anyone setting patch priorities. Published vulnerabilities rose 103%, but CISA’s list of flaws with evidence of real attacks grew 30%. In Microsoft’s own data, 2,859 CVEs were fixed in nine months while the exploited count went from 20 to 19. A team that patches by volume falls behind; a team that patches by exploitation evidence has a list that grew far more slowly.

    01Vulnerabilities

    Disclosure volume is the most quoted number in this field and the easiest to misread. The NVD count doubled, but much of that is more organizations numbering their own flaws, and NIST now scores only a small share of new records.

    2103%year-over-year increase · Jan to Sep 2026 vs 2025

    Growth in published CVEs over the same nine months of 2025 (36,824), which we rechecked month by month against the NVD API in October 2026.

    NIST National Vulnerability Database

    315,074CVEs in one month · Sep 2026

    CVEs published in September 2026 alone, the highest monthly total since at least January 2025; monthly publications rose every month from April.

    NIST National Vulnerability Database

    6554CVE Numbering Authorities · Oct 2026

    Organizations on the CVE Program’s published list that may assign CVE IDs. 453 are vendors numbering flaws in their own products, so CVE totals measure disclosure activity as much as risk.

    CVE Program list of CNAs

    8993CVEs in one release · Sep 2026

    Microsoft-assigned CVEs in the September 2026 Patch Tuesday, the largest monthly release since our series began in January 2021.

    Microsoft Security Update Guide

    02Exploitation

    Exploitation is the better risk signal. CISA’s catalog lists only flaws with evidence of real attacks, and it grew far more slowly than the disclosure count.

    10255KEV additions · Jan 1 to Oct 8, 2026

    Vulnerabilities CISA added to the catalog in 2026, 30% more than the 196 added by the same date in 2025 and already above the 245 added in all of 2025.

    CISA Known Exploited Vulnerabilities catalog

    1119exploited Microsoft zero-days · Jan to Sep 2026

    Microsoft CVEs flagged as exploited in the wild in 2026, against 20 in the same months of 2025. The patch count tripled; the zero-day count did not.

    Microsoft Security Update Guide

    13389Microsoft entries in KEV · as of Oct 8, 2026

    Microsoft products in the KEV catalog, the most of any vendor and nearly four times Cisco’s 100. The catalog spans 288 vendors.

    CISA Known Exploited Vulnerabilities catalog

    1529old CVEs newly confirmed exploited · Jan 1 to Oct 8, 2026

    2026 KEV additions for CVEs numbered in 2021 or earlier. Across the catalog, 21.3% of entries were added five or more years after the CVE was assigned.

    CISA Known Exploited Vulnerabilities catalog

    1631%of breaches began with an exploit · Nov 2024 to Oct 2025 incidents

    Share of breaches with a known initial access vector that started with exploitation of a vulnerability, now the top vector in Verizon’s own 2026 DBIR dataset, while credential abuse fell to 13%.

    Verizon 2026 DBIR (vendor dataset)

    03Ransomware

    Ransomware complaints to the FBI rose again in 2025, and CISA’s joint advisories show how groups get in: mostly through exposed applications and remote access, with phishing second.

    18$32.3Mreported ransomware losses · 2025

    Ransomware losses victims reported to IC3 in 2025 ($32,320,105), up from $12.5 million in 2024. The FBI says the figure does not normally include lost business, time, or remediation costs.

    FBI IC3 2025 Internet Crime Report

    19460healthcare ransomware complaints · 2025

    Ransomware complaints to IC3 from the healthcare and public health sector, the most of any critical infrastructure sector, ahead of critical manufacturing with 355.

    FBI IC3 2025 Internet Crime Report

    2063new ransomware variants · 2025

    New ransomware variants the FBI identified through IC3 complaints in 2025, an average of 5.25 a month. Akira was the most reported variant.

    FBI IC3 2025 Internet Crime Report

    2118%from legal services · 2025

    Share of the more than 1,400 ransomware complaints from organizations outside critical sectors that came from legal services, the top industry, ahead of contracting services at 17%.

    FBI IC3 2025 Internet Crime Report

    2391%exposed services or apps · Jun 2022 to Aug 2026

    Advisories in which initial access included an exploited internet-facing application or an external remote service such as a VPN or RDP gateway (20 of 22).

    CISA #StopRansomware advisories

    2459%of advisories cite phishing · Jun 2022 to Aug 2026

    Advisories that list phishing as an entry route (13 of 22): common, but second to exploits, and most groups use more than one door.

    CISA #StopRansomware advisories

    2548%of breaches involved ransomware · Nov 2024 to Oct 2025 incidents

    Share of breaches in Verizon’s 2026 DBIR dataset that involved ransomware, up from 44% the year before. In the same dataset, 69% of ransomware victims did not pay.

    Verizon 2026 DBIR (vendor dataset)

    04Breaches

    Breach counts depend on who is counting. These come from a federal regulator’s portal, a public breach catalog, a government survey, and FBI complaints, each with its own scope.

    27140.5Mpeople affected · 2025

    Individuals affected by large healthcare breaches reported in 2025, down from 290.1 million in 2024, the year of the Change Healthcare breach.

    HHS OCR breach portal

    2835%involved a vendor · 2025

    Share of 2025 healthcare breaches with a business associate present, the vendor category that includes MSPs with access to patient data. Those breaches covered 64% of everyone affected.

    HHS OCR breach portal

    29566large healthcare breaches · Jan 1 to Sep 21, 2026

    Healthcare breaches reported to HHS so far in 2026, 6% fewer than the 605 reported by the same date in 2025. Hacking caused 85.3%, up from 80.8% in 2025.

    HHS OCR breach portal

    3013.2Bbreached accounts · as of Sep 30, 2026

    Accounts across the 980 verified breaches in Have I Been Pwned. One person can appear in many breaches, so this counts accounts, not people.

    Have I Been Pwned breach catalog

    3262%expose phone numbers · Jan to Sep 2026

    Share of 2026 HIBP additions that include phone numbers, now ahead of passwords: raw material for SMS phishing, voice phishing, and help desk impersonation.

    Have I Been Pwned breach catalog

    3343%of UK businesses breached · 12 months to 2025/26 survey

    Share of UK businesses that identified a cyber breach or attack in the previous 12 months, about 612,000 firms, in the UK government’s official survey. Among large businesses it was 69%.

    UK Cyber Security Breaches Survey 2025/2026

    3448%involved a third party · Nov 2024 to Oct 2025 incidents

    Share of breaches in Verizon’s 2026 DBIR dataset with third-party involvement, up 60% on the prior year’s dataset. Every MSP is a third party to its clients.

    Verizon 2026 DBIR (vendor dataset)

    05Phishing, BEC and fraud

    By dollars, the FBI’s data is dominated by fraud, not malware. Business email compromise alone was reported at about 94 times the ransomware loss figure in 2025, though ransomware losses are known to be badly under-reported.

    35$20.9Breported cybercrime losses · 2025

    Losses reported to the FBI’s IC3 in 2025 ($20.877 billion), up 26% from 2024, across 1,008,597 complaints.

    FBI IC3 2025 Internet Crime Report

    3685%of losses were fraud · 2025

    Share of 2025 IC3 losses from cyber-enabled fraud ($17.7 billion), even though fraud made up 45% of complaints.

    FBI IC3 2025 Internet Crime Report

    37191,561phishing and spoofing complaints · 2025

    Phishing and spoofing complaints to IC3, the most reported crime type in 2025, though down from 298,878 in 2023.

    FBI IC3 2025 Internet Crime Report

    38$3.05Bbusiness email compromise losses · 2025

    BEC losses reported in 2025 ($3,046,598,558) from 24,768 complaints, the second-largest loss category and 10% above 2024.

    FBI IC3 2025 Internet Crime Report

    39$8.65Binvestment fraud losses · 2025

    Investment fraud losses reported to IC3 in 2025, the largest category. Cryptocurrency investment fraud alone accounted for $7.2 billion.

    FBI IC3 2025 Internet Crime Report

    40$11.4Bcrypto-related losses · 2025

    Losses in 2025 complaints involving cryptocurrency, from 181,565 complaints: more than half of everything reported to IC3.

    FBI IC3 2025 Internet Crime Report

    41$7.7Blost by people 60 and over · 2025

    Losses reported by complainants aged 60 and over in 2025 ($7.748 billion), up 59% from 2024, from 201,266 complaints averaging $38,500.

    FBI IC3 2025 Internet Crime Report

    42$893MAI-related losses · 2025

    Losses in IC3 complaints that referenced artificial intelligence, across 22,364 complaints. Businesses reported more than $30 million lost to BEC scams involving AI.

    FBI IC3 2025 Internet Crime Report

    4358%of attempted thefts frozen · 2025

    Success rate of the FBI Recovery Asset Team’s Financial Fraud Kill Chain, which froze $679 million of $1.16 billion in attempted fraudulent transfers. Speed of reporting decides recovery.

    FBI IC3 2025 Internet Crime Report

    4438%of UK businesses phished · 12 months to 2025/26 survey

    Share of UK businesses hit by phishing in the previous 12 months, by far the most common type of breach or attack and the most disruptive for 69% of those breached.

    UK Cyber Security Breaches Survey 2025/2026

    4547%of UK businesses use 2FA · 2025/26 survey

    Share of UK businesses with two-factor authentication in place, against 81% with updated malware protection, in the same official survey.

    UK Cyber Security Breaches Survey 2025/2026

    06Regulation and disclosure

    Disclosure rules and enforcement are tightening on timing. The clearest 2026 change in our data is how little time federal agencies now get to fix exploited flaws.

    4714Item 1.05 filings · Apr to Sep 2026

    Item 1.05 filings in the second and third quarters of 2026, seven in each, the highest two-quarter total since the first half of 2024.

    SEC EDGAR, Form 8-K Item 1.05

    4852%of 2026 KEV deadlines are 3 days or less · Jan 1 to Oct 8, 2026

    Share of 2026 KEV additions that gave federal agencies 3 days or less to remediate under BOD 22-01 (132 of 255). In 2025, 92% carried the standard 21 days. This is our own count from the catalog’s due dates.

    CISA Known Exploited Vulnerabilities catalog

    49021-day deadlines since March 5 · Mar 6 to Oct 8, 2026

    KEV entries given the long-standing 21-day deadline after March 5, 2026. All 203 additions since then carry 14 days or less, and 78 of the 100 added in July to September carry 3 days or less.

    CISA Known Exploited Vulnerabilities catalog

    51$240,000median HIPAA penalty · 2024 to 2026

    Median verified HIPAA settlement or penalty in 2024 to 2026, 85% below the $1,600,000 median of 2016 to 2019. More cases, smaller amounts.

    HHS OCR resolution agreements and penalties

    5487%filed after day 30 · 2025 filings

    Share of 2025 Washington notices filed more than 30 days after discovery. The law allows some delays, and the data does not record which exception applied.

    Washington AG data breach notices

    55165 daysmedian for ransomware notices · 2024 to 2026 filings

    Median discovery-to-notice time for ransomware breach notices filed in Washington in 2024 to 2026, up from 36 days in 2020 to 2021. Other breach types barely slowed.

    Washington AG data breach notices

    07Workforce

    Is cybersecurity oversaturated in 2026? The BLS still projects fast growth for security analysts, while broader tech hiring is slow and routine support roles are projected to shrink.

    58-3%projected support jobs change · 2025 to 2035

    Projected change for computer support specialists (903,100 jobs in 2025). Network and computer systems administrators are projected to fall 4%.

    BLS Occupational Outlook Handbook

    60$176,120top metro median for security · May 2025

    Median security analyst pay in San Jose, the top-paying metro. Washington, DC is the largest market, with 16,560 analysts at $148,950, per our metro pay leaderboard.

    BLS OEWS, May 2025

    6255%fewer tech job openings · Apr 2022 to Aug 2026

    Drop in information sector job openings from the April 2022 peak of 274,000 to 123,000 in August 2026, while the sector’s 2026 layoff rate (1.74%) ran above the national 1.07%, per our JOLTS labor dashboard.

    BLS JOLTS

    08MSP market

    The managed services market behind these numbers: more firms, fewer staff per firm, higher wages, and modest revenue growth compared with hosting and software.

    636,972managed IT establishments · Q1 2026

    Establishments in NAICS 541513, the industry code closest to MSPs, up 10.6% from 6,304 in Q1 2023, in our MSP industry census.

    BLS QCEW

    64-5.1%managed IT jobs · Q1 2023 to Q1 2026

    Change in private employment in the same industry, from 79,383 to 75,313: more firms, fewer people.

    BLS QCEW

    65+14.3%average weekly wage · Q1 2023 to Q1 2026

    Rise in the industry’s average weekly wage, from $2,892 to $3,306, which raises the labor cost inside every flat-rate contract.

    BLS QCEW

    The patch deadline change, month by month

    Under Binding Operational Directive 22-01, each KEV entry carries a date by which federal civilian agencies must fix it. Through 2025, nearly every entry got 21 days. Counting the due dates in the catalog, that changed in early 2026: 132 of 255 entries added in 2026 carry 3 days or less, and none added after March 5 carries more than 14 days. The catalog records the dates, not the reason, so we report the change without attributing a cause.

    21 days4 to 12 days14 days3 days or less

    2025-01: 12 added with 21 days deadlines2025-01: 2 added with 4 to 12 days deadlinesJan 20252025-02: 27 added with 21 days deadlines2025-03: 32 added with 21 days deadlines2025-04: 14 added with 21 days deadlines2025-04: 1 added with 4 to 12 days deadlines2025-05: 24 added with 21 days deadlines2025-06: 20 added with 21 days deadlines2025-07: 16 added with 21 days deadlines2025-07: 4 added with 3 days or less deadlinesJul 20252025-08: 12 added with 21 days deadlines2025-08: 2 added with 4 to 12 days deadlines2025-08: 1 added with 3 days or less deadlines2025-09: 14 added with 21 days deadlines2025-09: 2 added with 3 days or less deadlines2025-10: 31 added with 21 days deadlines2025-11: 9 added with 21 days deadlines2025-11: 2 added with 4 to 12 days deadlines2025-12: 15 added with 21 days deadlines2025-12: 5 added with 4 to 12 days deadlines2026-01: 15 added with 21 days deadlines2026-01: 2 added with 3 days or less deadlinesJan 20262026-02: 22 added with 21 days deadlines2026-02: 6 added with 3 days or less deadlines2026-03: 7 added with 21 days deadlines2026-03: 14 added with 14 days deadlines2026-03: 5 added with 3 days or less deadlines2026-04: 23 added with 14 days deadlines2026-04: 8 added with 3 days or less deadlines2026-05: 1 added with 4 to 12 days deadlines2026-05: 13 added with 14 days deadlines2026-05: 7 added with 3 days or less deadlines2026-06: 6 added with 14 days deadlines2026-06: 17 added with 3 days or less deadlines2026-07: 4 added with 14 days deadlines2026-07: 22 added with 3 days or less deadlinesJul 20262026-08: 9 added with 14 days deadlines2026-08: 22 added with 3 days or less deadlines2026-09: 9 added with 14 days deadlines2026-09: 34 added with 3 days or less deadlines010203040Last 21-day deadline: March 5, 2026

    KEV entries added per month by days between dateAdded and dueDate, January 2025 to September 2026. Source: CISA KEV catalog, version 2026.10.08. Analysis: The Uptime Report.

    Private organizations are not bound by the directive, but the catalog is widely used as a patch priority list. If the federal clock is now 3 days for most new entries, a 30-day patch cycle leaves an exploited flaw open roughly ten times longer than agencies are allowed.

    Source register

    Every primary source behind the 70 figures, how many cards use it, and the Uptime Report analysis that goes deeper. Chips on each card link to the same sources.

    Primary source Publisher Figures Cards Our analysis
    FBI IC3 2025 Internet Crime Report FBI Internet Crime Complaint Center 14 #17, #18, #19, #20, #21, #35, #36, #37, #38, #39, #40, #41, #42, #43 Ransomware Reported to the FBI: A Five-Year Trend
    CISA Known Exploited Vulnerabilities catalog CISA 7 #9, #10, #13, #14, #15, #48, #49 Known Exploited Vulnerabilities: An Analysis of the CISA KEV Catalog
    NIST National Vulnerability Database NIST 5 #1, #2, #3, #4, #5 CVE Statistics 2026: Vulnerabilities Published Per Year
    Microsoft Security Update Guide Microsoft Security Response Center 4 #7, #8, #11, #12 Patch Tuesday Statistics 2026
    HHS OCR breach portal HHS Office for Civil Rights 4 #26, #27, #28, #29 Healthcare Data Breach Report 2026
    Verizon 2026 DBIR Verizon 3 #16, #25, #34 Read directly for this page
    CISA #StopRansomware advisories CISA, FBI and partner agencies 3 #22, #23, #24 Ransomware Initial Access Vectors: 25 CISA Advisories
    Have I Been Pwned breach catalog Have I Been Pwned 3 #30, #31, #32 Data Breach Statistics 2026: Inside 980 Breaches
    UK Cyber Security Breaches Survey 2025/2026 UK DSIT and Home Office 3 #33, #44, #45 Read directly for this page
    HHS OCR resolution agreements and penalties HHS Office for Civil Rights 3 #50, #51, #52 HIPAA Enforcement Tracker: Every OCR Penalty and Settlement
    Washington AG data breach notices Washington State Attorney General 3 #53, #54, #55 How Long Do Companies Take to Report a Data Breach?
    BLS Occupational Outlook Handbook U.S. Bureau of Labor Statistics 3 #56, #57, #58 IT and Cybersecurity Jobs Outlook 2026
    BLS QCEW U.S. Bureau of Labor Statistics 3 #63, #64, #65 MSP Industry Statistics 2026
    SEC EDGAR, Form 8-K Item 1.05 U.S. Securities and Exchange Commission 2 #46, #47 SEC Cybersecurity Incident Disclosures: Every Item 1.05 Filing
    BLS OEWS, May 2025 U.S. Bureau of Labor Statistics 2 #59, #60 Highest Paying Cities for IT Jobs 2026; IT Salaries by State 2026
    CVE Program list of CNAs CVE Program 1 #6 CVE Statistics 2026: Vulnerabilities Published Per Year
    GSA CALC+ labor rates U.S. General Services Administration 1 #61 IT Hourly Rates 2026: What Contracts Pay by Role
    BLS JOLTS U.S. Bureau of Labor Statistics 1 #62 The Tech Job Market in 2026
    Census County Business Patterns U.S. Census Bureau 1 #66 IT Services Firms by State: A Census Atlas
    Census Quarterly Services Survey U.S. Census Bureau 1 #67 IT Services Industry Growth 2026
    USAspending.gov U.S. Department of the Treasury 1 #68 Federal IT Spending 2026
    FCC voice subscription data Federal Communications Commission 1 #69 VoIP Statistics 2026
    FEMA OpenFEMA declarations FEMA 1 #70 Disaster Declarations by State

    What this means for MSPs

    Patch by exploitation, on a shorter clock. With 74,838 CVEs in nine months, severity scores alone cannot set priority, especially when NIST scores only about 10% of new records. Feed the KEV catalog into your RMM or vulnerability scanner and treat a KEV hit on an internet-facing device as an emergency change; the federal deadline for most new entries is now 3 days.

    Edge devices first. Exposed applications and remote access gateways appear in 91% of CISA’s ransomware advisories that list initial access, and edge vendors are overrepresented among ransomware-linked KEV entries. Firewalls, VPNs, file transfer servers, and remote management tools belong at the top of the queue, with MFA on every remote login.

    Sell fraud controls, not only malware controls. BEC losses reported to the FBI ($3.05 billion) dwarf reported ransomware losses. Payment verification by phone, mailbox rule monitoring, and fast reporting matter: the FBI’s Financial Fraud Kill Chain froze 58% of the attempted theft it handled in 2025.

    Remember you are the third party. In 2025, 35% of large healthcare breaches involved a business associate, and Verizon’s dataset puts third-party involvement at 48% of breaches. Client contracts, cyber insurance questionnaires, and HIPAA risk analyses will keep asking how the MSP itself is secured.

    Plan for the bill and the clock. Washington breach notices now take a median 134 days to file, and ransomware cases 165. Incident response retainers, forensic access, and tested backups decide how fast a client can meet notice deadlines. For continuity planning, 85% of U.S. counties had a major disaster declaration in the last decade.

    Frequently asked questions

    Will cyber attacks increase in 2026?

    The available 2026 measures mostly point up. CISA added 255 exploited vulnerabilities to its catalog through Oct 8, 2026, 30% ahead of the same point in 2025, and published CVEs rose 103% from January to September. FBI-reported losses rose 26% in 2025 to $20.877 billion. One counter-signal: large healthcare breaches reported to HHS were running 6% behind 2025 through Sep 21.

    How many cyber attacks happen per year?

    No dataset counts every attack. The closest U.S. measure is complaints to the FBI’s IC3, which received 1,008,597 in 2025, about 2,760 a day. In the UK government’s survey, 43% of businesses identified a breach or attack in the previous 12 months.

    What is the most common type of cyber attack?

    By complaint count, phishing and spoofing: 191,561 IC3 complaints in 2025. In the UK survey, phishing hit 38% of businesses. For ransomware entry specifically, exploitation of public-facing applications led, appearing in 16 of 22 CISA advisories that list initial access (73%).

    Where do 90% of all cyber incidents begin?

    We found no primary dataset that supports a 90% figure for any single starting point. In Verizon’s 2026 DBIR dataset, exploitation of vulnerabilities was the initial access vector for 31% of breaches with a known vector, and phishing for 16% of breaches. In CISA’s ransomware advisories, 77% list two or more entry routes.

    Is cybersecurity a good career in 2026?

    By BLS data, security analyst jobs are projected to grow 21% from 2025 to 2035, adding 40,600 positions, with a 2025 median pay of $129,180. The wider tech market is slower: information sector job openings were 55% below their 2022 peak in August 2026. This is published labor data, not career advice.

    How much does cybercrime cost each year?

    Losses reported to the FBI’s IC3 reached $20.877 billion in 2025, up 26% from 2024. Investment fraud ($8.65 billion) and business email compromise ($3.05 billion) were the largest categories. Reported ransomware losses were $32.3 million, a figure the FBI says excludes downtime and remediation.

    Download the data. cybersecurity-statistics-2026-sourced.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    What we did. On October 13, 2026 we downloaded the live text of all 21 Uptime Report research reports and took each headline figure together with the primary dataset it was computed from. We then read primary sources directly for figures our reports do not cover: the FBI IC3 2025 Internet Crime Report (PDF), the UK Cyber Security Breaches Survey 2025/2026 (published April 30, 2026), the BLS Occupational Outlook Handbook, and the Verizon 2026 Data Breach Investigations Report. Before the page is generated, the build script checks that every quoted figure appears word for word in the saved copy of its source; a mismatch stops the build.

    Our own computations. KEV figures use the CISA catalog JSON feed, version 2026.10.08 (1,739 entries). Deadline length is dueDate minus dateAdded in days. CVE counts use the NVD CVE API 2.0 totalResults for each calendar month by publish date, January 2025 to September 2026, which reproduce the 49,972 (2025) and 74,838 (January to September 2026) totals in our CVE report exactly. Healthcare 2026 figures use our extract of the HHS OCR breach portal (8,009 breaches, latest submission September 21, 2026) and compare January 1 to Sep 21 in both years.

    Periods. Every card carries its own period. Calendar-year figures are labeled with the year; partial-year figures are compared only with the same dates a year earlier. Federal fiscal years run October to September. The Verizon DBIR covers incidents from November 1, 2024 to October 31, 2025.

    Limitations. Complaint and breach counts measure what was reported, not everything that happened. IC3 losses are victim-reported and exclude most downtime and recovery costs. KEV inclusion depends on CISA’s evidence threshold. HHS covers only breaches of 500 or more health records; Washington notices only breaches affecting more than 500 residents. Verizon’s DBIR is one company’s dataset of incidents from its own caseload and contributors, used here for 3 figures and labeled as such. The UK survey reflects breaches organizations identified and chose to report.

    Not advice. This is a compilation of public data, not security, legal, or career advice.

    Cite as:The Uptime Report. "Cybersecurity Statistics 2026: Published Flaws Doubled, and Federal Patch Deadlines Fell to 3 Days." October 2026. https://theuptimereport.com/cybersecurity-statistics-2026/

    References

    1. NIST, NIST National Vulnerability Database. Accessed October 2026.
    2. CVE Program, CVE Program list of CNAs. Accessed October 2026.
    3. Microsoft Security Response Center, Microsoft Security Update Guide. Accessed October 2026.
    4. CISA, CISA Known Exploited Vulnerabilities catalog. Accessed October 2026.
    5. CISA, KEV catalog JSON feed, version 2026.10.08. Accessed October 2026.
    6. CISA, Binding Operational Directive 22-01. Accessed October 2026.
    7. CISA, FBI and partner agencies, CISA #StopRansomware advisories. Accessed October 2026.
    8. FBI Internet Crime Complaint Center, FBI IC3 2025 Internet Crime Report. Accessed October 2026.
    9. HHS Office for Civil Rights, HHS OCR breach portal. Accessed October 2026.
    10. HHS Office for Civil Rights, HHS OCR resolution agreements and penalties. Accessed October 2026.
    11. Have I Been Pwned, Have I Been Pwned breach catalog. Accessed October 2026.
    12. Washington State Attorney General, Washington AG data breach notices. Accessed October 2026.
    13. U.S. Securities and Exchange Commission, SEC EDGAR, Form 8-K Item 1.05. Accessed October 2026.
    14. UK DSIT and Home Office, UK Cyber Security Breaches Survey 2025/2026. Accessed October 2026.
    15. Verizon, Verizon 2026 DBIR. Accessed October 2026.
    16. U.S. Bureau of Labor Statistics, BLS Occupational Outlook Handbook. Accessed October 2026.
    17. U.S. Bureau of Labor Statistics, BLS Occupational Outlook Handbook. Accessed October 2026.
    18. U.S. Bureau of Labor Statistics, BLS OEWS, May 2025. Accessed October 2026.
    19. U.S. General Services Administration, GSA CALC+ labor rates. Accessed October 2026.
    20. U.S. Bureau of Labor Statistics, BLS JOLTS. Accessed October 2026.
    21. U.S. Bureau of Labor Statistics, BLS QCEW. Accessed October 2026.
    22. U.S. Census Bureau, Census County Business Patterns. Accessed October 2026.
    23. U.S. Census Bureau, Census Quarterly Services Survey. Accessed October 2026.
    24. U.S. Department of the Treasury, USAspending.gov. Accessed October 2026.
    25. Federal Communications Commission, FCC voice subscription data. Accessed October 2026.
    26. FEMA, FEMA OpenFEMA declarations. Accessed October 2026.
    27. U.S. Bureau of Labor Statistics, Occupational Outlook Handbook, Network and Computer Systems Administrators. Accessed October 2026.
    28. U.S. Securities and Exchange Commission, press release 2023-139 on cybersecurity disclosure rules. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Cyber Insurance Statistics: U.S. Premiums Fell for the First Time in 2024 as Loss Ratios Turned Back Up

    Uptime Report Research · Insurance Market Data

    Cyber Insurance Statistics: U.S. Premiums Fell for the First Time in 2024 as Loss Ratios Turned Back Up

    Cyber insurance statistics from insurers’ NAIC regulatory filings show U.S. cyber premiums fell 7.1% to $9.14B in 2024, the first drop on record, after rising 142% from 2020 to 2023. Policies in force held at 4.37 million, and the top-20 insurers’ loss ratio, which fell from 67% to 45% after the rate spike, rose to an estimated 51%.

    We built this scorecard from every National Association of Insurance Commissioners (NAIC) annual report on the cyber insurance market we could retrieve, covering data years 2015 through 2024. The NAIC compiles them from the Cybersecurity Insurance Supplement that U.S.-domiciled insurers file with their annual statements, plus premium data for alien (non-U.S.) surplus lines insurers. We transcribed the figures from each report, used the latest restated value for every year, and computed the shares, per-policy premiums and loss ratio estimates below ourselves.

    Direct written premium, 2024$9.14B-7.1% vs 2023
    Top-20 loss ratio, 202451%+8 pts our estimate
    Policies in force, 20244.37M-0.03% vs 2023
    Top-10 share, 202449.6%from 67.6% in 2020
    Claims reported, 2024~46.9K+40% derived

    Cyber insurance premiums and loss ratios by year

    U.S.-domiciled insurers Alien surplus lines insurers Top-20 group loss ratio (right axis; hollow points and * are our estimates)

    $0B$2B$4B$6B$8B$10B0%20%40%60%80%2015: total $1.42B, U.S.-domiciled insurers $1.42B, alien surplus lines not reported1.420152016: total $2.38B, U.S.-domiciled insurers $1.67B, alien surplus lines $0.71B2.420162017: total $3.09B, U.S.-domiciled insurers $1.89B, alien surplus lines $1.20B3.120172018: total $3.16B, U.S.-domiciled insurers $2.03B, alien surplus lines $1.13B3.220182019: total $3.36B, U.S.-domiciled insurers $2.26B, alien surplus lines $1.09B3.420192020: total $4.07B, U.S.-domiciled insurers $2.75B, alien surplus lines $1.31B4.120202021: total $6.54B, U.S.-domiciled insurers $4.83B, alien surplus lines $1.72B6.520212022: total $9.69B, U.S.-domiciled insurers $7.26B, alien surplus lines $2.42B9.720222023: total $9.84B, U.S.-domiciled insurers $7.25B, alien surplus lines $2.60B9.820232024: total $9.14B, U.S.-domiciled insurers $7.08B, alien surplus lines $2.06B9.120242017: top-20 loss ratio 32.4% (NAIC)32%2018: top-20 loss ratio 35.3% (NAIC)35%2019: top-20 loss ratio 44.6% (NAIC)45%2020: top-20 loss ratio 66.9% (NAIC)67%2021: top-20 loss ratio 66.4% (NAIC)66%2022: top-20 loss ratio 44.6% (NAIC)45%2023: top-20 loss ratio 42.8% (our estimate)43%*2024: top-20 loss ratio 50.8% (our estimate)51%*Direct written premiumLoss ratio

    Bars: U.S. cyber direct written premium in billions of dollars. Alien surplus lines data were not collected for 2015. Loss ratio: direct losses plus defense and cost containment over premium for the 20 largest groups, as reported by the NAIC for 2017 to 2022; 2023 and 2024 are our premium-weighted average of the NAIC’s published top-20 group ratios. Source: NAIC annual cyber insurance market reports.

    From 2016, the first year with alien surplus lines data, to the 2023 peak, premium grew 4.1 times, from $2.38B to $9.84B. Premium went from $1.42B in 2015 (U.S.-domiciled insurers only) to $3.36B in 2019, then jumped 61% in 2021 and 48% in 2022 to $9.69B. Growth then stopped: +1.6% in 2023 and -7.1% in 2024.

    Did premium growth stall after the 2021 to 2022 rate spike?

    Yes, and the slowdown is a price story more than a demand story. Dividing domestic premium by domestic policies in force gives a rough average premium per policy. It sat between $677 and $726 from 2017 to 2020, rose 171% to $1,856 by 2022, then eased 13% to $1,621 in 2024. Meanwhile the policy count grew 11.7% in 2023 before flattening. In 2023, more policies at lower average prices kept premium flat. In 2024, the count stopped growing and premium fell.

    Where the 2024 drop came fromTotal premium fell $700M from 2023. Alien surplus lines insurers accounted for $535M of that (76%); U.S.-domiciled insurers for $165M (-2.3%).
    Surplus lines took overDomestic surplus lines insurers wrote $4.35B in 2024, against $2.74B for admitted insurers. In 2019 the split was $1.64B admitted and $0.61B surplus lines.
    The 2025 previewThe NAIC has not yet published 2025 data. AM Best, which also works from the Cyber Supplement, reports $7.5B in 2025 premium, up from $7.1B, mainly from business moved onshore from offshore entities.

    Are cyber insurance loss ratios falling?

    They fell, and now they are rising again. The loss ratio for the top 20 groups climbed from 32.4% in 2017 to 66.9% in 2020, a rise the NAIC’s 2022 report attributes primarily to sizable ransomware claim payments. Prices then rose faster than losses, and the ratio dropped to 44.6% in 2022. The NAIC stopped publishing an aggregate ratio after that, but it still publishes each top-20 group’s ratio. Weighting those by premium, we get 42.8% for 2023 and 50.8% for 2024.

    Two checks support the direction. First, our method reproduces the NAIC’s own figure within 2.0 points for 2020 to 2022 (2020: 68.5% vs 66.9%, 2021: 65.9% vs 66.4%, 2022: 46.6% vs 44.6%). Second, Starr reported a 0.0% ratio in 2023 and 96.3% in 2024; leaving Starr out still shows a rise, from 44.9% to 48.5%. AM Best’s 2026 report puts the industry-wide ratio at 53.0% in 2025, up 4.3 points and the second consecutive annual increase, which implies about 48.7% for 2024. Pricing caught up with losses in 2021 and 2022; since then premium per policy has eased while the loss ratio has climbed back. For the threat side of that equation, compare our five-year trend in ransomware reported to the FBI.

    Stand-alone vs package cyber insurance

    Stand-alone cyber policy Cyber coverage in a package policy

    2015*2015: stand-alone 34.1% of cyber premium2015: package 65.9% of cyber premium34%66%20162016: stand-alone 57.2% of cyber premium2016: package 42.8% of cyber premium57%43%20172017: stand-alone 57.0% of cyber premium2017: package 43.0% of cyber premium57%43%20182018: stand-alone 60.0% of cyber premium2018: package 40.0% of cyber premium60%40%20192019: stand-alone 64.2% of cyber premium2019: package 35.8% of cyber premium64%36%20202020: stand-alone 63.5% of cyber premium2020: package 36.5% of cyber premium63%37%20212021: stand-alone 69.3% of cyber premium2021: package 30.7% of cyber premium69%31%20222022: stand-alone 74.1% of cyber premium2022: package 25.9% of cyber premium74%26%20232023: stand-alone 70.4% of cyber premium2023: package 29.6% of cyber premium70%30%New reporting categories from the 2024 data year (U.S.-domiciled insurers): not comparable with the rows above20242024: primary 65% of premium, 41.6% of policiesPrimary 65%2024: excess 31% of premium, 3.3% of policiesExcess 31%2024: endorsement 4% of premium, 55.1% of policiesEndorsement 4%

    Share of direct written premium, U.S.-domiciled plus alien surplus lines insurers. *2015 is U.S.-domiciled insurers only, and about 45% of that year’s package premium was an NAIC extrapolation. 2022 shares use the split published in the 2023 report, before a small restatement of the domestic total.

    Stand-alone policies went from 34% of reported premium in 2015 to 74% in 2022 and 70% in 2023. Package cyber premium also grew, from $1.02B in 2016 to $2.91B in 2023, but far more slowly than stand-alone premium, which rose from $1.36B to $6.93B.

    From the 2024 data year, the supplement replaced the two-way split with primary, excess and endorsement. The NAIC says “packaged” was meant to mean cyber written as an endorsement, so the 4% endorsement share is not a collapse from the 30% package share of 2023. It is a cleaner definition. What the new split does show is how thin endorsement cover is: endorsements are 55.1% of policies but 4% of premium, while primary policies are 41.6% of policies and 65% of premium. On those rounded shares, the average primary policy carries about 22 times the premium of the average endorsement.

    Top cyber insurance companies by premium

    The 2024 league table below ranks groups by U.S. cyber direct written premium among U.S.-domiciled insurers, the basis the NAIC uses. Market share is our calculation against the $7.08B domestic total. Lloyd’s and other alien surplus lines carriers are not in this table.

    Rank 2024 Group Direct written premium Share of domestic market Loss ratio with DCC Rank 2023 Rank 2020 Premium vs 2022
    1 Chubb $561M 7.9% 36.1% 1 1 -7%
    2 Travelers $535M 7.6% 54.0% 4 4 +70%
    3 Fairfax Financial $361M 5.1% 39.7% 3 8 -36%
    4 Tokio Marine $356M 5.0% 43.5% 5 11 -3%
    5 AXA $340M 4.8% 36.0% 2 2 -35%
    6 Arch $285M 4.0% 41.7% 7 >20 -18%
    7 At-Bay $281M 4.0% 55.8% 32 >20 n/a
    8 AIG $277M 3.9% 49.3% 8 3 -8%
    9 Sompo $263M 3.7% 57.8% 9 12 +6%
    10 Starr $255M 3.6% 96.3% 10 >20 n/a
    11 CNA $240M 3.4% 74.8% 11 7 +5%
    12 AXIS Capital $205M 2.9% 26.7% 14 6 +5%
    13 AmTrust $202M 2.9% 48.3% 18 >20 n/a
    14 Berkshire Hathaway $188M 2.6% 85.7% 6 16 -18%
    15 Hartford $186M 2.6% 11.5% 16 9 +22%
    16 Beazley $185M 2.6% 9.2% 19 5 +6%
    17 QBE $184M 2.6% 89.3% >20 >20 n/a
    18 Liberty Mutual $170M 2.4% 70.7% 15 14 -18%
    19 Zurich $168M 2.4% 78.3% 13 13 -33%
    20 Ascot $157M 2.2% 45.2% 17 >20 -6%

    DCC: defense and cost containment expenses. Group names shortened from NAIC labels (for example, “St Paul Travelers Grp.” is Travelers and “At Bay Specialty Ins. Grp.” is At-Bay). At-Bay’s 2023 rank of 32 is as printed by the NAIC. “>20” means outside that year’s top 20. Starr is listed with a 0.0% loss ratio in the NAIC’s 2023 table.

    How concentrated is the cyber insurance market?

    Less than it was. In 2020, Chubb alone wrote 14.7% of domestic cyber premium and the top 10 groups wrote 67.6%. By 2024, Chubb was still first with 7.9%, but the top 10 held 49.6% and the top 20 held 76.2%. The Herfindahl index across the top 20 groups (the sum of squared market shares) fell from 608 to 340; counting only the top 20 makes this a slight undercount of the full index. Cyber is still concentrated by the standards of insurance as a whole: GAO found that 10 groups wrote nearly 70% of cyber premium in 2019 but only 18% of all property and casualty premium. The newest climber is At-Bay, which went from 32nd in 2023 to 7th in 2024.

    Cyber insurance claims statistics

    U.S.-domiciled insurers reported 33,561 cyber claims in 2023, or 7.7 per 1,000 policies in force. For 2024, the NAIC published closed-claim counts and closure rates rather than a single total: 38,496 claims closed at an 82.05% closure rate, which implies about 46,918 reported claims (10.7 per 1,000 policies). That matches the NAIC’s statement that claims rose almost 40%.

    Most closed claims ended without a payment: 28,555 closed without payment against 9,941 with one, so 25.8% were paid. Excess policies showed the starkest gap, 10,802 unpaid closures to 514 paid (about 21 to 1). Public companies face a separate disclosure regime for material incidents; our tracker of SEC 8-K Item 1.05 cybersecurity incident disclosures covers those.

    2024 policy type Share of premium Share of policies Closed with payment Closed without payment Closure rate
    Primary 65% 41.6% 8,838 16,422 83.93%
    Excess 31% 3.3% 514 10,802 76.84%
    Endorsement 4% 55.1% 589 1,331 91.52%
    Total 100% 100% 9,941 28,555 82.05%

    The full cyber insurance market table, 2015 to 2024

    Year Total premium Change U.S.-domiciled Alien surplus lines Stand-alone share Policies in force Premium per policy Top-20 loss ratio Report
    2015 $1.42B $1.42B not reported 34% n/a n/a n/a NAIC
    2016 $2.38B +68.3% $1.67B $0.71B 57% 2,110,571 $794 n/a NAIC
    2017 $3.09B +29.5% $1.89B $1.20B 57% 2,603,970 $726 32.4% restated
    2018 $3.16B +2.2% $2.03B $1.13B 60% 2,996,820 $677 35.3% NAIC
    2019 $3.36B +6.3% $2.26B $1.09B 64% 3,314,005 $683 44.6% NAIC
    2020 $4.07B +21.1% $2.75B $1.31B 63% 4,019,428 $685 66.9% NAIC
    2021 $6.54B +61.0% $4.83B $1.72B 69% 3,747,986 $1,288 66.4% NAIC
    2022 $9.69B +48.0% $7.26B $2.42B 74% 3,913,123 $1,856 44.6% NAIC
    2023 $9.84B +1.6% $7.25B $2.60B 70% 4,369,741 $1,659 42.8%* NAIC
    2024 $9.14B -7.1% $7.08B $2.06B new split 4,368,614 $1,621 50.8%* NAIC

    Policies in force and premium per policy cover U.S.-domiciled insurers only. *Our premium-weighted estimate from the NAIC’s top-20 group table. The 2017 report (2016 data) supplies 2016 figures; 2017 data come from the restated tables in later reports because we could not retrieve the 2018 edition.

    What changed in the data between years

    • 2015 and 2016 package premium was partly estimated. Many insurers could not separate cyber premium inside package policies, so the NAIC grossed up the reported amount. For 2015 it divided reported package premium of $515.1 million by 55.23% to reach $932.6 million; for 2016, $434.5 million became $863.8 million. By the 2019 data year only five insurers needed estimates ($9.6 million), and the NAIC stopped estimating for 2020.
    • Alien surplus lines were added for 2016 and restated more than once. The 2019 report put 2018 alien premium at $1.57 billion and the total market at about $3.6 billion; later tables show $1.13 billion and $3.16 billion. The 2020 report’s 2019 total of $3.15 billion used alien premium of $887.6 million, later restated to $1.09 billion, which turns the reported 0.2% dip in 2019 into a 6.3% gain.
    • Small restatements continue. Domestic 2022 premium is $7.237 billion in the 2023 report and $7.265 billion in the 2025 report; 2019 policies in force moved from 3,314,347 to 3,314,005.
    • Loss ratio reporting changed. The 2019 and 2020 reports gave separate stand-alone and package ratios; the 2021 to 2023 reports gave one combined top-20 figure; the 2024 and 2025 reports give only group-level ratios.
    • New categories from the 2024 data year. Identity theft reporting was dropped, the stand-alone/package split became primary/excess/endorsement, and a new Part 5 adds state-level premium for the first time.

    What this means for MSPs

    Expect underwriting questions about controls, not just price. New York’s insurance regulator advised cyber insurers in 2021 that they should gather information on insureds’ “corporate governance and controls, vulnerability management, access controls, encryption, endpoint monitoring, boundary defenses, incident response planning and third-party security policies.” The NAIC’s 2023 report says insurers “may require an insured to use two-factor authentication and patch its computer systems in an acceptable timeframe,” and describes endorsements tied to critical known vulnerabilities in the National Vulnerability Database that give the insured 30 to 45 days to patch before coverage restrictions start. Where a client’s policy carries such an endorsement, your patch window is a coverage term. Our CVE statistics report shows how fast that queue is growing.

    Document what you run. The NAIC’s 2024 report describes a common “failure to maintain security” exclusion for insureds that do not keep minimum security standards, and lists better backup procedures and rehearsed restarts among the practices that help. Keep evidence of MFA coverage, endpoint monitoring, patch timelines and tested restores in a form a client can hand to an underwriter or claims adjuster.

    Check what kind of policy the client actually has. 55% of policies in force are endorsements carrying 4% of premium. A client who says “we have cyber” may have a thin add-on to a package policy, not a stand-alone primary policy. And with 26% of closed 2024 claims paid, the policy wording and the client’s control attestations matter as much as the limit.

    Read the soft market carefully. Average premium per policy is down 13% from the 2022 peak, so renewals may look cheaper. The last time the loss ratio climbed while premium per policy held flat, from 2017 to 2020 (the ratio doubled while premium per policy stayed between $677 and $726), it ended in the 2021 price spike. Budget renewals with that history in mind.

    Frequently asked questions

    How big is the U.S. cyber insurance market?

    U.S. cyber insurance direct written premium was $9.14B in 2024, according to the NAIC: $7.08B from U.S.-domiciled insurers and $2.06B from alien (non-U.S.) surplus lines insurers. That is down 7.1% from the 2023 peak of $9.84B, the first annual decline since the NAIC began collecting the data for 2015.

    What are the top 5 cyber insurance companies?

    Ranked by 2024 U.S. direct written premium among U.S.-domiciled groups, the top five were Chubb ($561M), Travelers ($535M), Fairfax Financial ($361M), Tokio Marine ($356M) and AXA ($340M). Together they wrote 30.4% of domestic cyber premium, down from 47.6% in 2020.

    What are the statistics for cyber insurance claims?

    U.S.-domiciled insurers reported 33,561 cyber claims in 2023. For 2024, the NAIC counts 38,496 closed claims at an 82.05% closure rate, which implies about 46,918 reported claims, up roughly 40%. Only 25.8% of closed 2024 claims were closed with a payment.

    Are cyber insurance loss ratios going up or down?

    Down, then up. The NAIC’s top-20 group loss ratio fell from 66.9% in 2020 to 44.6% in 2022 after the rate spike. Our premium-weighted estimate from the NAIC’s own top-20 tables puts 2024 at 50.8%, up from 42.8% in 2023. AM Best reports the industry ratio rose again to 53.0% in 2025.

    How many cyber insurance policies are in force in the U.S.?

    4,368,614 policies were in force at U.S.-domiciled insurers in 2024, essentially flat (-0.03%) from 4,369,741 in 2023. 55.1% of them were endorsements to other policies, which carried only 4% of premium.

    Download the data. us-cyber-insurance-market-naic-2015-2024.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Source. NAIC annual reports on the cyber insurance market for data years 2015, 2016 and 2018 to 2024, built from the Property and Casualty Annual Statement Cybersecurity Insurance (formerly Cybersecurity and Identity Theft) Coverage Supplement and from alien surplus lines data collected by the NAIC International Insurers Department. Retrieved October 2026. Three older editions are no longer on the NAIC site and were retrieved from the Internet Archive copies of their NAIC URLs. We could not retrieve the 2018 edition (2017 data).

    What we did. We downloaded each PDF, transcribed premium, policy, loss ratio, claims and top-20 group figures (including tables published only as images), and used the most recent restated figure for each data year. Year-over-year changes, stand-alone shares, premium per policy, market shares, top-5/10/20 concentration, the Herfindahl index across the top 20 groups, and the 2023 and 2024 loss ratio estimates are our calculations. The 2024 reported-claim figure is derived as closed claims divided by the NAIC’s total closure rate. The 2024 alien surplus lines figure is the NAIC total minus the domestic total.

    Definitions. Direct written premium is premium on policies written in the year before reinsurance. Loss ratio with DCC is direct losses incurred plus defense and cost containment expenses over premium. The NAIC’s top-20 figure is described as an average; it is close to, but not exactly, a premium-weighted average of the group ratios, so our estimates for 2023 and 2024 are approximations.

    Limitations. Policies in force and group rankings exclude alien surplus lines insurers such as Lloyd’s syndicates. Package premium is reported only where insurers can estimate it. Large companies that insure cyber risk through captives are not captured, a gap AM Best also notes. The 2024 three-way split percentages are rounded by the NAIC, and the report does not say whether its premium split includes alien insurers. Earlier reports’ figures differ from later restatements; see “What changed in the data between years.”

    Not advice. This is an analysis of public regulatory data, not insurance, legal or coverage advice for any organization.

    Cite as:The Uptime Report. "Cyber Insurance Statistics: U.S. Premiums Fell for the First Time in 2024 as Loss Ratios Turned Back Up." October 2026. https://theuptimereport.com/cyber-insurance-statistics/

    References

    1. NAIC, Report on the Cybersecurity Insurance Market (2025, data year 2024). Accessed October 2026.
    2. NAIC, Report on the Cyber Insurance Market (October 15, 2024, data year 2023). Accessed October 2026.
    3. NAIC, Report on the Cybersecurity Insurance Market (November 3, 2023, data year 2022). Accessed October 2026.
    4. NAIC, Report on the Cyber Insurance Market (October 18, 2022, data year 2021). Accessed October 2026.
    5. NAIC, Report on the Cybersecurity Insurance Market (2021, data year 2020). Accessed October 2026.
    6. NAIC, Report on the Cybersecurity Insurance and Identity Theft Coverage Supplement (December 4, 2020, data year 2019), Internet Archive copy of the NAIC URL. Accessed October 2026.
    7. NAIC, Report on the Cybersecurity Insurance and Identity Theft Coverage Supplement (September 12, 2019, data year 2018), Internet Archive copy of the NAIC URL. Accessed October 2026.
    8. NAIC, Report on the Cybersecurity Insurance Coverage Supplement (August 6, 2017, data year 2016). Accessed October 2026.
    9. NAIC, Report on the Cybersecurity Insurance Coverage Supplement (August 27, 2016, data year 2015). Accessed October 2026.
    10. U.S. GAO, Cyber Insurance: Insurers and Policyholders Face Challenges in an Evolving Market (GAO-21-477, May 2021). Accessed October 2026.
    11. AM Best, Best’s Market Segment Report: U.S. Cyber Market’s Premium Grows Slightly; Surplus Lines Writers Continue to Increase Role (June 26, 2026). Accessed October 2026.
    12. New York Department of Financial Services, Insurance Circular Letter No. 2 (2021): Cyber Insurance Risk Framework. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Remote Work Statistics 2026: Telework Is Holding at 22%, and the Federal Return to Office Explains Most of the Dip

    Uptime Report Research · Workforce Data

    Remote Work Statistics 2026: Telework Is Holding at 22%, and the Federal Return to Office Explains Most of the Dip

    Remote work statistics from the Bureau of Labor Statistics show that 22.1% of U.S. workers teleworked in an average month of January to September 2026, barely below 22.6% in the same months of 2024. Just under half of them, 10.6% of all workers, teleworked every hour they worked. Federal employees account for most of the decline: their telework rate fell from 33.9% to 17.4%.

    22.1%of people at work teleworked, avg month January to September 2026
    10.6%teleworked all their hours; 11.5% some hours (hybrid)
    62.0%of computer and mathematical workers teleworked, down from 68.4% in 2024
    33.9% to 17.4%federal employees teleworking, 2024 to 2026 (January to September)
    34.5%did some work at home on days worked in 2025, vs 23.7% in 2019 (ATUS)

    Many remote work statistics pages recycle older surveys. This one is built from the government’s own monthly count. We downloaded every telework series BLS has published from the Current Population Survey since the questions were added in October 2022, 47 months of data through Sep 2026, and ranked, compared, and decomposed them. The short answer to whether remote work is fading: the national rate peaked at 23.8% in Oct 2024 and has eased since, but outside the federal government it has barely moved.

    The telework atlas: 22 occupations, every month since 2022

    Each cell is the share of people at work in that occupation group who teleworked or worked at home for pay during the survey week. Rows are sorted by the 2026 average. Hover a cell for the exact value.

    0%5%10%20%30%40%50%60%70%not collected
    20222023202420252026ONDJFMAMJJASONDJFMAMJJASONDJFMAMJJASONDJFMAMJJASComputer and mathematicalComputer and mathematical, Oct 2022: 59.5% teleworkedComputer and mathematical, Nov 2022: 59.2% teleworkedComputer and mathematical, Dec 2022: 62.3% teleworkedComputer and mathematical, Jan 2023: 63.5% teleworkedComputer and mathematical, Feb 2023: 66.6% teleworkedComputer and mathematical, Mar 2023: 63.9% teleworkedComputer and mathematical, Apr 2023: 61.0% teleworkedComputer and mathematical, May 2023: 61.3% teleworkedComputer and mathematical, Jun 2023: 63.5% teleworkedComputer and mathematical, Jul 2023: 63.9% teleworkedComputer and mathematical, Aug 2023: 63.7% teleworkedComputer and mathematical, Sep 2023: 63.1% teleworkedComputer and mathematical, Oct 2023: 61.7% teleworkedComputer and mathematical, Nov 2023: 64.9% teleworkedComputer and mathematical, Dec 2023: 66.0% teleworkedComputer and mathematical, Jan 2024: 70.2% teleworkedComputer and mathematical, Feb 2024: 68.5% teleworkedComputer and mathematical, Mar 2024: 68.3% teleworkedComputer and mathematical, Apr 2024: 64.4% teleworkedComputer and mathematical, May 2024: 66.5% teleworkedComputer and mathematical, Jun 2024: 67.1% teleworkedComputer and mathematical, Jul 2024: 68.7% teleworkedComputer and mathematical, Aug 2024: 70.0% teleworkedComputer and mathematical, Sep 2024: 71.8% teleworkedComputer and mathematical, Oct 2024: 68.9% teleworkedComputer and mathematical, Nov 2024: 68.5% teleworkedComputer and mathematical, Dec 2024: 69.5% teleworkedComputer and mathematical, Jan 2025: 69.9% teleworkedComputer and mathematical, Feb 2025: 67.9% teleworkedComputer and mathematical, Mar 2025: 65.7% teleworkedComputer and mathematical, Apr 2025: 63.2% teleworkedComputer and mathematical, May 2025: 63.2% teleworkedComputer and mathematical, Jun 2025: 63.4% teleworkedComputer and mathematical, Jul 2025: 64.4% teleworkedComputer and mathematical, Aug 2025: 65.0% teleworkedComputer and mathematical, Sep 2025: 65.7% teleworkedComputer and mathematical, Oct 2025: not collectedComputer and mathematical, Nov 2025: 66.5% teleworkedComputer and mathematical, Dec 2025: 63.7% teleworkedComputer and mathematical, Jan 2026: 66.3% teleworkedComputer and mathematical, Feb 2026: 63.3% teleworkedComputer and mathematical, Mar 2026: 63.2% teleworkedComputer and mathematical, Apr 2026: 59.2% teleworkedComputer and mathematical, May 2026: 59.3% teleworkedComputer and mathematical, Jun 2026: 59.4% teleworkedComputer and mathematical, Jul 2026: 62.5% teleworkedComputer and mathematical, Aug 2026: 60.8% teleworkedComputer and mathematical, Sep 2026: 63.7% teleworkedBusiness and financial operationsBusiness and financial operations, Oct 2022: 49.6% teleworkedBusiness and financial operations, Nov 2022: 51.2% teleworkedBusiness and financial operations, Dec 2022: 50.6% teleworkedBusiness and financial operations, Jan 2023: 51.9% teleworkedBusiness and financial operations, Feb 2023: 52.2% teleworkedBusiness and financial operations, Mar 2023: 51.6% teleworkedBusiness and financial operations, Apr 2023: 49.1% teleworkedBusiness and financial operations, May 2023: 50.0% teleworkedBusiness and financial operations, Jun 2023: 49.1% teleworkedBusiness and financial operations, Jul 2023: 51.7% teleworkedBusiness and financial operations, Aug 2023: 51.4% teleworkedBusiness and financial operations, Sep 2023: 52.2% teleworkedBusiness and financial operations, Oct 2023: 53.3% teleworkedBusiness and financial operations, Nov 2023: 55.0% teleworkedBusiness and financial operations, Dec 2023: 58.1% teleworkedBusiness and financial operations, Jan 2024: 58.4% teleworkedBusiness and financial operations, Feb 2024: 58.2% teleworkedBusiness and financial operations, Mar 2024: 58.5% teleworkedBusiness and financial operations, Apr 2024: 56.1% teleworkedBusiness and financial operations, May 2024: 54.8% teleworkedBusiness and financial operations, Jun 2024: 55.4% teleworkedBusiness and financial operations, Jul 2024: 55.5% teleworkedBusiness and financial operations, Aug 2024: 55.6% teleworkedBusiness and financial operations, Sep 2024: 59.4% teleworkedBusiness and financial operations, Oct 2024: 59.8% teleworkedBusiness and financial operations, Nov 2024: 59.6% teleworkedBusiness and financial operations, Dec 2024: 58.0% teleworkedBusiness and financial operations, Jan 2025: 59.2% teleworkedBusiness and financial operations, Feb 2025: 57.6% teleworkedBusiness and financial operations, Mar 2025: 58.2% teleworkedBusiness and financial operations, Apr 2025: 55.8% teleworkedBusiness and financial operations, May 2025: 54.8% teleworkedBusiness and financial operations, Jun 2025: 54.1% teleworkedBusiness and financial operations, Jul 2025: 53.4% teleworkedBusiness and financial operations, Aug 2025: 54.5% teleworkedBusiness and financial operations, Sep 2025: 54.2% teleworkedBusiness and financial operations, Oct 2025: not collectedBusiness and financial operations, Nov 2025: 58.0% teleworkedBusiness and financial operations, Dec 2025: 55.6% teleworkedBusiness and financial operations, Jan 2026: 56.1% teleworkedBusiness and financial operations, Feb 2026: 55.2% teleworkedBusiness and financial operations, Mar 2026: 55.0% teleworkedBusiness and financial operations, Apr 2026: 54.8% teleworkedBusiness and financial operations, May 2026: 52.9% teleworkedBusiness and financial operations, Jun 2026: 54.1% teleworkedBusiness and financial operations, Jul 2026: 53.9% teleworkedBusiness and financial operations, Aug 2026: 52.8% teleworkedBusiness and financial operations, Sep 2026: 53.8% teleworkedLegalLegal, Oct 2022: 43.9% teleworkedLegal, Nov 2022: 43.8% teleworkedLegal, Dec 2022: 42.1% teleworkedLegal, Jan 2023: 46.2% teleworkedLegal, Feb 2023: 48.2% teleworkedLegal, Mar 2023: 46.7% teleworkedLegal, Apr 2023: 45.0% teleworkedLegal, May 2023: 48.4% teleworkedLegal, Jun 2023: 45.5% teleworkedLegal, Jul 2023: 49.6% teleworkedLegal, Aug 2023: 47.3% teleworkedLegal, Sep 2023: 48.3% teleworkedLegal, Oct 2023: 46.7% teleworkedLegal, Nov 2023: 50.0% teleworkedLegal, Dec 2023: 52.6% teleworkedLegal, Jan 2024: 52.4% teleworkedLegal, Feb 2024: 54.8% teleworkedLegal, Mar 2024: 52.7% teleworkedLegal, Apr 2024: 50.9% teleworkedLegal, May 2024: 53.2% teleworkedLegal, Jun 2024: 53.6% teleworkedLegal, Jul 2024: 55.2% teleworkedLegal, Aug 2024: 53.1% teleworkedLegal, Sep 2024: 57.5% teleworkedLegal, Oct 2024: 56.4% teleworkedLegal, Nov 2024: 51.2% teleworkedLegal, Dec 2024: 54.4% teleworkedLegal, Jan 2025: 52.6% teleworkedLegal, Feb 2025: 54.7% teleworkedLegal, Mar 2025: 53.5% teleworkedLegal, Apr 2025: 47.5% teleworkedLegal, May 2025: 51.6% teleworkedLegal, Jun 2025: 52.9% teleworkedLegal, Jul 2025: 55.4% teleworkedLegal, Aug 2025: 50.0% teleworkedLegal, Sep 2025: 54.7% teleworkedLegal, Oct 2025: not collectedLegal, Nov 2025: 56.8% teleworkedLegal, Dec 2025: 50.3% teleworkedLegal, Jan 2026: 55.2% teleworkedLegal, Feb 2026: 55.7% teleworkedLegal, Mar 2026: 52.7% teleworkedLegal, Apr 2026: 52.3% teleworkedLegal, May 2026: 52.1% teleworkedLegal, Jun 2026: 50.6% teleworkedLegal, Jul 2026: 50.8% teleworkedLegal, Aug 2026: 54.8% teleworkedLegal, Sep 2026: 50.6% teleworkedArts, design, and mediaArts, design, entertainment, sports, and media, Oct 2022: 40.5% teleworkedArts, design, entertainment, sports, and media, Nov 2022: 40.4% teleworkedArts, design, entertainment, sports, and media, Dec 2022: 41.7% teleworkedArts, design, entertainment, sports, and media, Jan 2023: 42.9% teleworkedArts, design, entertainment, sports, and media, Feb 2023: 44.1% teleworkedArts, design, entertainment, sports, and media, Mar 2023: 41.6% teleworkedArts, design, entertainment, sports, and media, Apr 2023: 38.5% teleworkedArts, design, entertainment, sports, and media, May 2023: 41.8% teleworkedArts, design, entertainment, sports, and media, Jun 2023: 41.3% teleworkedArts, design, entertainment, sports, and media, Jul 2023: 40.0% teleworkedArts, design, entertainment, sports, and media, Aug 2023: 42.5% teleworkedArts, design, entertainment, sports, and media, Sep 2023: 41.9% teleworkedArts, design, entertainment, sports, and media, Oct 2023: 43.6% teleworkedArts, design, entertainment, sports, and media, Nov 2023: 45.5% teleworkedArts, design, entertainment, sports, and media, Dec 2023: 43.2% teleworkedArts, design, entertainment, sports, and media, Jan 2024: 46.8% teleworkedArts, design, entertainment, sports, and media, Feb 2024: 47.3% teleworkedArts, design, entertainment, sports, and media, Mar 2024: 51.6% teleworkedArts, design, entertainment, sports, and media, Apr 2024: 47.9% teleworkedArts, design, entertainment, sports, and media, May 2024: 49.7% teleworkedArts, design, entertainment, sports, and media, Jun 2024: 46.8% teleworkedArts, design, entertainment, sports, and media, Jul 2024: 46.7% teleworkedArts, design, entertainment, sports, and media, Aug 2024: 45.8% teleworkedArts, design, entertainment, sports, and media, Sep 2024: 46.7% teleworkedArts, design, entertainment, sports, and media, Oct 2024: 50.2% teleworkedArts, design, entertainment, sports, and media, Nov 2024: 48.9% teleworkedArts, design, entertainment, sports, and media, Dec 2024: 48.4% teleworkedArts, design, entertainment, sports, and media, Jan 2025: 46.5% teleworkedArts, design, entertainment, sports, and media, Feb 2025: 47.5% teleworkedArts, design, entertainment, sports, and media, Mar 2025: 46.9% teleworkedArts, design, entertainment, sports, and media, Apr 2025: 45.5% teleworkedArts, design, entertainment, sports, and media, May 2025: 49.9% teleworkedArts, design, entertainment, sports, and media, Jun 2025: 48.1% teleworkedArts, design, entertainment, sports, and media, Jul 2025: 48.0% teleworkedArts, design, entertainment, sports, and media, Aug 2025: 45.6% teleworkedArts, design, entertainment, sports, and media, Sep 2025: 44.1% teleworkedArts, design, entertainment, sports, and media, Oct 2025: not collectedArts, design, entertainment, sports, and media, Nov 2025: 46.4% teleworkedArts, design, entertainment, sports, and media, Dec 2025: 47.2% teleworkedArts, design, entertainment, sports, and media, Jan 2026: 47.1% teleworkedArts, design, entertainment, sports, and media, Feb 2026: 44.0% teleworkedArts, design, entertainment, sports, and media, Mar 2026: 48.2% teleworkedArts, design, entertainment, sports, and media, Apr 2026: 46.5% teleworkedArts, design, entertainment, sports, and media, May 2026: 50.9% teleworkedArts, design, entertainment, sports, and media, Jun 2026: 47.3% teleworkedArts, design, entertainment, sports, and media, Jul 2026: 48.6% teleworkedArts, design, entertainment, sports, and media, Aug 2026: 44.1% teleworkedArts, design, entertainment, sports, and media, Sep 2026: 44.4% teleworkedManagementManagement, Oct 2022: 30.4% teleworkedManagement, Nov 2022: 32.1% teleworkedManagement, Dec 2022: 31.5% teleworkedManagement, Jan 2023: 33.2% teleworkedManagement, Feb 2023: 34.1% teleworkedManagement, Mar 2023: 32.6% teleworkedManagement, Apr 2023: 31.4% teleworkedManagement, May 2023: 32.4% teleworkedManagement, Jun 2023: 31.2% teleworkedManagement, Jul 2023: 32.9% teleworkedManagement, Aug 2023: 33.0% teleworkedManagement, Sep 2023: 34.2% teleworkedManagement, Oct 2023: 33.8% teleworkedManagement, Nov 2023: 34.7% teleworkedManagement, Dec 2023: 37.5% teleworkedManagement, Jan 2024: 38.3% teleworkedManagement, Feb 2024: 38.6% teleworkedManagement, Mar 2024: 39.4% teleworkedManagement, Apr 2024: 35.8% teleworkedManagement, May 2024: 36.1% teleworkedManagement, Jun 2024: 37.0% teleworkedManagement, Jul 2024: 37.8% teleworkedManagement, Aug 2024: 38.8% teleworkedManagement, Sep 2024: 40.4% teleworkedManagement, Oct 2024: 40.3% teleworkedManagement, Nov 2024: 40.1% teleworkedManagement, Dec 2024: 38.7% teleworkedManagement, Jan 2025: 40.2% teleworkedManagement, Feb 2025: 40.4% teleworkedManagement, Mar 2025: 38.6% teleworkedManagement, Apr 2025: 36.5% teleworkedManagement, May 2025: 35.9% teleworkedManagement, Jun 2025: 36.5% teleworkedManagement, Jul 2025: 37.5% teleworkedManagement, Aug 2025: 37.3% teleworkedManagement, Sep 2025: 37.7% teleworkedManagement, Oct 2025: not collectedManagement, Nov 2025: 37.8% teleworkedManagement, Dec 2025: 38.0% teleworkedManagement, Jan 2026: 39.0% teleworkedManagement, Feb 2026: 38.7% teleworkedManagement, Mar 2026: 38.7% teleworkedManagement, Apr 2026: 37.2% teleworkedManagement, May 2026: 37.1% teleworkedManagement, Jun 2026: 36.6% teleworkedManagement, Jul 2026: 37.0% teleworkedManagement, Aug 2026: 36.4% teleworkedManagement, Sep 2026: 37.7% teleworkedArchitecture and engineeringArchitecture and engineering, Oct 2022: 33.4% teleworkedArchitecture and engineering, Nov 2022: 33.9% teleworkedArchitecture and engineering, Dec 2022: 37.2% teleworkedArchitecture and engineering, Jan 2023: 35.7% teleworkedArchitecture and engineering, Feb 2023: 33.4% teleworkedArchitecture and engineering, Mar 2023: 33.6% teleworkedArchitecture and engineering, Apr 2023: 33.3% teleworkedArchitecture and engineering, May 2023: 31.5% teleworkedArchitecture and engineering, Jun 2023: 32.9% teleworkedArchitecture and engineering, Jul 2023: 32.1% teleworkedArchitecture and engineering, Aug 2023: 34.1% teleworkedArchitecture and engineering, Sep 2023: 38.3% teleworkedArchitecture and engineering, Oct 2023: 37.6% teleworkedArchitecture and engineering, Nov 2023: 35.5% teleworkedArchitecture and engineering, Dec 2023: 38.4% teleworkedArchitecture and engineering, Jan 2024: 41.5% teleworkedArchitecture and engineering, Feb 2024: 40.3% teleworkedArchitecture and engineering, Mar 2024: 39.5% teleworkedArchitecture and engineering, Apr 2024: 40.3% teleworkedArchitecture and engineering, May 2024: 37.7% teleworkedArchitecture and engineering, Jun 2024: 38.6% teleworkedArchitecture and engineering, Jul 2024: 41.2% teleworkedArchitecture and engineering, Aug 2024: 39.1% teleworkedArchitecture and engineering, Sep 2024: 41.7% teleworkedArchitecture and engineering, Oct 2024: 40.2% teleworkedArchitecture and engineering, Nov 2024: 37.1% teleworkedArchitecture and engineering, Dec 2024: 38.4% teleworkedArchitecture and engineering, Jan 2025: 40.6% teleworkedArchitecture and engineering, Feb 2025: 39.1% teleworkedArchitecture and engineering, Mar 2025: 37.0% teleworkedArchitecture and engineering, Apr 2025: 40.0% teleworkedArchitecture and engineering, May 2025: 36.8% teleworkedArchitecture and engineering, Jun 2025: 35.0% teleworkedArchitecture and engineering, Jul 2025: 35.9% teleworkedArchitecture and engineering, Aug 2025: 35.9% teleworkedArchitecture and engineering, Sep 2025: 37.2% teleworkedArchitecture and engineering, Oct 2025: not collectedArchitecture and engineering, Nov 2025: 37.9% teleworkedArchitecture and engineering, Dec 2025: 38.4% teleworkedArchitecture and engineering, Jan 2026: 39.1% teleworkedArchitecture and engineering, Feb 2026: 36.4% teleworkedArchitecture and engineering, Mar 2026: 39.5% teleworkedArchitecture and engineering, Apr 2026: 37.4% teleworkedArchitecture and engineering, May 2026: 36.1% teleworkedArchitecture and engineering, Jun 2026: 34.9% teleworkedArchitecture and engineering, Jul 2026: 35.6% teleworkedArchitecture and engineering, Aug 2026: 35.3% teleworkedArchitecture and engineering, Sep 2026: 34.3% teleworkedCommunity and social servicesCommunity and social services, Oct 2022: 26.1% teleworkedCommunity and social services, Nov 2022: 26.7% teleworkedCommunity and social services, Dec 2022: 28.1% teleworkedCommunity and social services, Jan 2023: 27.1% teleworkedCommunity and social services, Feb 2023: 29.5% teleworkedCommunity and social services, Mar 2023: 28.8% teleworkedCommunity and social services, Apr 2023: 28.4% teleworkedCommunity and social services, May 2023: 29.6% teleworkedCommunity and social services, Jun 2023: 29.6% teleworkedCommunity and social services, Jul 2023: 30.2% teleworkedCommunity and social services, Aug 2023: 33.2% teleworkedCommunity and social services, Sep 2023: 28.0% teleworkedCommunity and social services, Oct 2023: 27.5% teleworkedCommunity and social services, Nov 2023: 32.0% teleworkedCommunity and social services, Dec 2023: 34.4% teleworkedCommunity and social services, Jan 2024: 35.6% teleworkedCommunity and social services, Feb 2024: 36.1% teleworkedCommunity and social services, Mar 2024: 32.1% teleworkedCommunity and social services, Apr 2024: 32.2% teleworkedCommunity and social services, May 2024: 35.5% teleworkedCommunity and social services, Jun 2024: 35.3% teleworkedCommunity and social services, Jul 2024: 35.1% teleworkedCommunity and social services, Aug 2024: 33.9% teleworkedCommunity and social services, Sep 2024: 37.0% teleworkedCommunity and social services, Oct 2024: 36.1% teleworkedCommunity and social services, Nov 2024: 34.0% teleworkedCommunity and social services, Dec 2024: 34.6% teleworkedCommunity and social services, Jan 2025: 37.5% teleworkedCommunity and social services, Feb 2025: 36.9% teleworkedCommunity and social services, Mar 2025: 34.8% teleworkedCommunity and social services, Apr 2025: 30.3% teleworkedCommunity and social services, May 2025: 33.0% teleworkedCommunity and social services, Jun 2025: 31.2% teleworkedCommunity and social services, Jul 2025: 30.1% teleworkedCommunity and social services, Aug 2025: 31.8% teleworkedCommunity and social services, Sep 2025: 32.5% teleworkedCommunity and social services, Oct 2025: not collectedCommunity and social services, Nov 2025: 36.6% teleworkedCommunity and social services, Dec 2025: 38.6% teleworkedCommunity and social services, Jan 2026: 37.0% teleworkedCommunity and social services, Feb 2026: 36.8% teleworkedCommunity and social services, Mar 2026: 36.8% teleworkedCommunity and social services, Apr 2026: 35.4% teleworkedCommunity and social services, May 2026: 37.0% teleworkedCommunity and social services, Jun 2026: 40.0% teleworkedCommunity and social services, Jul 2026: 39.8% teleworkedCommunity and social services, Aug 2026: 34.2% teleworkedCommunity and social services, Sep 2026: 31.4% teleworkedLife, physical, social scienceLife, physical, and social science, Oct 2022: 37.0% teleworkedLife, physical, and social science, Nov 2022: 32.7% teleworkedLife, physical, and social science, Dec 2022: 36.3% teleworkedLife, physical, and social science, Jan 2023: 37.5% teleworkedLife, physical, and social science, Feb 2023: 40.2% teleworkedLife, physical, and social science, Mar 2023: 39.9% teleworkedLife, physical, and social science, Apr 2023: 34.1% teleworkedLife, physical, and social science, May 2023: 31.8% teleworkedLife, physical, and social science, Jun 2023: 34.4% teleworkedLife, physical, and social science, Jul 2023: 36.3% teleworkedLife, physical, and social science, Aug 2023: 37.7% teleworkedLife, physical, and social science, Sep 2023: 35.0% teleworkedLife, physical, and social science, Oct 2023: 36.7% teleworkedLife, physical, and social science, Nov 2023: 38.9% teleworkedLife, physical, and social science, Dec 2023: 40.7% teleworkedLife, physical, and social science, Jan 2024: 40.5% teleworkedLife, physical, and social science, Feb 2024: 41.8% teleworkedLife, physical, and social science, Mar 2024: 38.2% teleworkedLife, physical, and social science, Apr 2024: 38.1% teleworkedLife, physical, and social science, May 2024: 36.8% teleworkedLife, physical, and social science, Jun 2024: 39.0% teleworkedLife, physical, and social science, Jul 2024: 38.6% teleworkedLife, physical, and social science, Aug 2024: 42.5% teleworkedLife, physical, and social science, Sep 2024: 43.2% teleworkedLife, physical, and social science, Oct 2024: 38.2% teleworkedLife, physical, and social science, Nov 2024: 40.6% teleworkedLife, physical, and social science, Dec 2024: 38.5% teleworkedLife, physical, and social science, Jan 2025: 38.6% teleworkedLife, physical, and social science, Feb 2025: 38.6% teleworkedLife, physical, and social science, Mar 2025: 34.9% teleworkedLife, physical, and social science, Apr 2025: 30.7% teleworkedLife, physical, and social science, May 2025: 31.0% teleworkedLife, physical, and social science, Jun 2025: 30.8% teleworkedLife, physical, and social science, Jul 2025: 31.9% teleworkedLife, physical, and social science, Aug 2025: 32.7% teleworkedLife, physical, and social science, Sep 2025: 36.3% teleworkedLife, physical, and social science, Oct 2025: not collectedLife, physical, and social science, Nov 2025: 33.9% teleworkedLife, physical, and social science, Dec 2025: 33.0% teleworkedLife, physical, and social science, Jan 2026: 36.4% teleworkedLife, physical, and social science, Feb 2026: 34.8% teleworkedLife, physical, and social science, Mar 2026: 32.7% teleworkedLife, physical, and social science, Apr 2026: 34.1% teleworkedLife, physical, and social science, May 2026: 33.8% teleworkedLife, physical, and social science, Jun 2026: 33.7% teleworkedLife, physical, and social science, Jul 2026: 34.9% teleworkedLife, physical, and social science, Aug 2026: 35.3% teleworkedLife, physical, and social science, Sep 2026: 33.1% teleworkedOffice and administrative supportOffice and administrative support, Oct 2022: 20.7% teleworkedOffice and administrative support, Nov 2022: 21.3% teleworkedOffice and administrative support, Dec 2022: 22.4% teleworkedOffice and administrative support, Jan 2023: 21.0% teleworkedOffice and administrative support, Feb 2023: 22.3% teleworkedOffice and administrative support, Mar 2023: 22.4% teleworkedOffice and administrative support, Apr 2023: 20.5% teleworkedOffice and administrative support, May 2023: 20.5% teleworkedOffice and administrative support, Jun 2023: 21.1% teleworkedOffice and administrative support, Jul 2023: 21.9% teleworkedOffice and administrative support, Aug 2023: 20.2% teleworkedOffice and administrative support, Sep 2023: 22.6% teleworkedOffice and administrative support, Oct 2023: 21.4% teleworkedOffice and administrative support, Nov 2023: 22.4% teleworkedOffice and administrative support, Dec 2023: 25.2% teleworkedOffice and administrative support, Jan 2024: 25.6% teleworkedOffice and administrative support, Feb 2024: 25.2% teleworkedOffice and administrative support, Mar 2024: 24.5% teleworkedOffice and administrative support, Apr 2024: 23.5% teleworkedOffice and administrative support, May 2024: 24.1% teleworkedOffice and administrative support, Jun 2024: 24.3% teleworkedOffice and administrative support, Jul 2024: 26.1% teleworkedOffice and administrative support, Aug 2024: 25.7% teleworkedOffice and administrative support, Sep 2024: 27.5% teleworkedOffice and administrative support, Oct 2024: 26.7% teleworkedOffice and administrative support, Nov 2024: 26.2% teleworkedOffice and administrative support, Dec 2024: 25.8% teleworkedOffice and administrative support, Jan 2025: 25.7% teleworkedOffice and administrative support, Feb 2025: 25.7% teleworkedOffice and administrative support, Mar 2025: 24.6% teleworkedOffice and administrative support, Apr 2025: 23.5% teleworkedOffice and administrative support, May 2025: 25.0% teleworkedOffice and administrative support, Jun 2025: 25.2% teleworkedOffice and administrative support, Jul 2025: 25.1% teleworkedOffice and administrative support, Aug 2025: 25.4% teleworkedOffice and administrative support, Sep 2025: 25.1% teleworkedOffice and administrative support, Oct 2025: not collectedOffice and administrative support, Nov 2025: 25.5% teleworkedOffice and administrative support, Dec 2025: 25.7% teleworkedOffice and administrative support, Jan 2026: 26.6% teleworkedOffice and administrative support, Feb 2026: 25.3% teleworkedOffice and administrative support, Mar 2026: 25.3% teleworkedOffice and administrative support, Apr 2026: 23.4% teleworkedOffice and administrative support, May 2026: 24.0% teleworkedOffice and administrative support, Jun 2026: 23.4% teleworkedOffice and administrative support, Jul 2026: 24.0% teleworkedOffice and administrative support, Aug 2026: 22.8% teleworkedOffice and administrative support, Sep 2026: 23.5% teleworkedSales and relatedSales and related, Oct 2022: 17.9% teleworkedSales and related, Nov 2022: 19.2% teleworkedSales and related, Dec 2022: 20.6% teleworkedSales and related, Jan 2023: 19.8% teleworkedSales and related, Feb 2023: 20.3% teleworkedSales and related, Mar 2023: 19.0% teleworkedSales and related, Apr 2023: 19.1% teleworkedSales and related, May 2023: 19.7% teleworkedSales and related, Jun 2023: 19.8% teleworkedSales and related, Jul 2023: 20.4% teleworkedSales and related, Aug 2023: 19.7% teleworkedSales and related, Sep 2023: 20.3% teleworkedSales and related, Oct 2023: 19.8% teleworkedSales and related, Nov 2023: 20.9% teleworkedSales and related, Dec 2023: 23.0% teleworkedSales and related, Jan 2024: 24.2% teleworkedSales and related, Feb 2024: 24.3% teleworkedSales and related, Mar 2024: 25.4% teleworkedSales and related, Apr 2024: 24.3% teleworkedSales and related, May 2024: 24.4% teleworkedSales and related, Jun 2024: 24.1% teleworkedSales and related, Jul 2024: 23.3% teleworkedSales and related, Aug 2024: 24.0% teleworkedSales and related, Sep 2024: 25.2% teleworkedSales and related, Oct 2024: 24.8% teleworkedSales and related, Nov 2024: 24.4% teleworkedSales and related, Dec 2024: 23.5% teleworkedSales and related, Jan 2025: 24.7% teleworkedSales and related, Feb 2025: 25.5% teleworkedSales and related, Mar 2025: 24.0% teleworkedSales and related, Apr 2025: 23.1% teleworkedSales and related, May 2025: 23.0% teleworkedSales and related, Jun 2025: 22.8% teleworkedSales and related, Jul 2025: 23.3% teleworkedSales and related, Aug 2025: 24.0% teleworkedSales and related, Sep 2025: 23.8% teleworkedSales and related, Oct 2025: not collectedSales and related, Nov 2025: 24.6% teleworkedSales and related, Dec 2025: 23.6% teleworkedSales and related, Jan 2026: 23.4% teleworkedSales and related, Feb 2026: 22.9% teleworkedSales and related, Mar 2026: 23.9% teleworkedSales and related, Apr 2026: 23.7% teleworkedSales and related, May 2026: 24.8% teleworkedSales and related, Jun 2026: 24.4% teleworkedSales and related, Jul 2026: 23.5% teleworkedSales and related, Aug 2026: 23.9% teleworkedSales and related, Sep 2026: 24.3% teleworkedEducation and libraryEducation, training, and library, Oct 2022: 9.8% teleworkedEducation, training, and library, Nov 2022: 9.5% teleworkedEducation, training, and library, Dec 2022: 9.8% teleworkedEducation, training, and library, Jan 2023: 10.7% teleworkedEducation, training, and library, Feb 2023: 10.5% teleworkedEducation, training, and library, Mar 2023: 12.4% teleworkedEducation, training, and library, Apr 2023: 12.3% teleworkedEducation, training, and library, May 2023: 11.6% teleworkedEducation, training, and library, Jun 2023: 13.2% teleworkedEducation, training, and library, Jul 2023: 18.2% teleworkedEducation, training, and library, Aug 2023: 15.9% teleworkedEducation, training, and library, Sep 2023: 11.8% teleworkedEducation, training, and library, Oct 2023: 12.1% teleworkedEducation, training, and library, Nov 2023: 13.2% teleworkedEducation, training, and library, Dec 2023: 14.0% teleworkedEducation, training, and library, Jan 2024: 14.8% teleworkedEducation, training, and library, Feb 2024: 13.8% teleworkedEducation, training, and library, Mar 2024: 14.3% teleworkedEducation, training, and library, Apr 2024: 13.9% teleworkedEducation, training, and library, May 2024: 14.3% teleworkedEducation, training, and library, Jun 2024: 16.7% teleworkedEducation, training, and library, Jul 2024: 21.2% teleworkedEducation, training, and library, Aug 2024: 17.4% teleworkedEducation, training, and library, Sep 2024: 15.0% teleworkedEducation, training, and library, Oct 2024: 16.4% teleworkedEducation, training, and library, Nov 2024: 16.5% teleworkedEducation, training, and library, Dec 2024: 15.6% teleworkedEducation, training, and library, Jan 2025: 16.9% teleworkedEducation, training, and library, Feb 2025: 16.4% teleworkedEducation, training, and library, Mar 2025: 15.0% teleworkedEducation, training, and library, Apr 2025: 13.9% teleworkedEducation, training, and library, May 2025: 13.6% teleworkedEducation, training, and library, Jun 2025: 16.9% teleworkedEducation, training, and library, Jul 2025: 18.6% teleworkedEducation, training, and library, Aug 2025: 14.2% teleworkedEducation, training, and library, Sep 2025: 13.3% teleworkedEducation, training, and library, Oct 2025: not collectedEducation, training, and library, Nov 2025: 14.2% teleworkedEducation, training, and library, Dec 2025: 14.3% teleworkedEducation, training, and library, Jan 2026: 14.3% teleworkedEducation, training, and library, Feb 2026: 15.3% teleworkedEducation, training, and library, Mar 2026: 14.8% teleworkedEducation, training, and library, Apr 2026: 14.7% teleworkedEducation, training, and library, May 2026: 12.8% teleworkedEducation, training, and library, Jun 2026: 16.3% teleworkedEducation, training, and library, Jul 2026: 19.1% teleworkedEducation, training, and library, Aug 2026: 15.3% teleworkedEducation, training, and library, Sep 2026: 13.0% teleworkedHealthcare practitionersHealthcare practitioners and technical, Oct 2022: 8.9% teleworkedHealthcare practitioners and technical, Nov 2022: 9.8% teleworkedHealthcare practitioners and technical, Dec 2022: 9.6% teleworkedHealthcare practitioners and technical, Jan 2023: 10.1% teleworkedHealthcare practitioners and technical, Feb 2023: 10.1% teleworkedHealthcare practitioners and technical, Mar 2023: 10.2% teleworkedHealthcare practitioners and technical, Apr 2023: 8.5% teleworkedHealthcare practitioners and technical, May 2023: 9.0% teleworkedHealthcare practitioners and technical, Jun 2023: 10.2% teleworkedHealthcare practitioners and technical, Jul 2023: 11.5% teleworkedHealthcare practitioners and technical, Aug 2023: 10.3% teleworkedHealthcare practitioners and technical, Sep 2023: 10.7% teleworkedHealthcare practitioners and technical, Oct 2023: 9.9% teleworkedHealthcare practitioners and technical, Nov 2023: 10.1% teleworkedHealthcare practitioners and technical, Dec 2023: 12.0% teleworkedHealthcare practitioners and technical, Jan 2024: 12.4% teleworkedHealthcare practitioners and technical, Feb 2024: 13.1% teleworkedHealthcare practitioners and technical, Mar 2024: 14.0% teleworkedHealthcare practitioners and technical, Apr 2024: 13.2% teleworkedHealthcare practitioners and technical, May 2024: 12.4% teleworkedHealthcare practitioners and technical, Jun 2024: 12.8% teleworkedHealthcare practitioners and technical, Jul 2024: 14.3% teleworkedHealthcare practitioners and technical, Aug 2024: 14.1% teleworkedHealthcare practitioners and technical, Sep 2024: 13.9% teleworkedHealthcare practitioners and technical, Oct 2024: 13.8% teleworkedHealthcare practitioners and technical, Nov 2024: 13.5% teleworkedHealthcare practitioners and technical, Dec 2024: 14.3% teleworkedHealthcare practitioners and technical, Jan 2025: 12.9% teleworkedHealthcare practitioners and technical, Feb 2025: 13.4% teleworkedHealthcare practitioners and technical, Mar 2025: 14.1% teleworkedHealthcare practitioners and technical, Apr 2025: 11.4% teleworkedHealthcare practitioners and technical, May 2025: 12.1% teleworkedHealthcare practitioners and technical, Jun 2025: 12.5% teleworkedHealthcare practitioners and technical, Jul 2025: 13.7% teleworkedHealthcare practitioners and technical, Aug 2025: 12.4% teleworkedHealthcare practitioners and technical, Sep 2025: 13.5% teleworkedHealthcare practitioners and technical, Oct 2025: not collectedHealthcare practitioners and technical, Nov 2025: 14.2% teleworkedHealthcare practitioners and technical, Dec 2025: 14.1% teleworkedHealthcare practitioners and technical, Jan 2026: 13.4% teleworkedHealthcare practitioners and technical, Feb 2026: 13.9% teleworkedHealthcare practitioners and technical, Mar 2026: 12.3% teleworkedHealthcare practitioners and technical, Apr 2026: 12.2% teleworkedHealthcare practitioners and technical, May 2026: 12.3% teleworkedHealthcare practitioners and technical, Jun 2026: 12.5% teleworkedHealthcare practitioners and technical, Jul 2026: 12.0% teleworkedHealthcare practitioners and technical, Aug 2026: 12.9% teleworkedHealthcare practitioners and technical, Sep 2026: 12.2% teleworkedHealthcare supportHealthcare support, Oct 2022: 4.1% teleworkedHealthcare support, Nov 2022: 5.3% teleworkedHealthcare support, Dec 2022: 5.4% teleworkedHealthcare support, Jan 2023: 5.2% teleworkedHealthcare support, Feb 2023: 7.2% teleworkedHealthcare support, Mar 2023: 6.7% teleworkedHealthcare support, Apr 2023: 5.8% teleworkedHealthcare support, May 2023: 6.6% teleworkedHealthcare support, Jun 2023: 7.1% teleworkedHealthcare support, Jul 2023: 5.7% teleworkedHealthcare support, Aug 2023: 6.4% teleworkedHealthcare support, Sep 2023: 7.3% teleworkedHealthcare support, Oct 2023: 6.2% teleworkedHealthcare support, Nov 2023: 7.4% teleworkedHealthcare support, Dec 2023: 8.9% teleworkedHealthcare support, Jan 2024: 9.7% teleworkedHealthcare support, Feb 2024: 9.2% teleworkedHealthcare support, Mar 2024: 7.7% teleworkedHealthcare support, Apr 2024: 8.3% teleworkedHealthcare support, May 2024: 8.2% teleworkedHealthcare support, Jun 2024: 7.6% teleworkedHealthcare support, Jul 2024: 10.1% teleworkedHealthcare support, Aug 2024: 9.5% teleworkedHealthcare support, Sep 2024: 9.2% teleworkedHealthcare support, Oct 2024: 10.7% teleworkedHealthcare support, Nov 2024: 9.3% teleworkedHealthcare support, Dec 2024: 9.7% teleworkedHealthcare support, Jan 2025: 10.9% teleworkedHealthcare support, Feb 2025: 11.0% teleworkedHealthcare support, Mar 2025: 9.9% teleworkedHealthcare support, Apr 2025: 9.7% teleworkedHealthcare support, May 2025: 10.1% teleworkedHealthcare support, Jun 2025: 9.2% teleworkedHealthcare support, Jul 2025: 8.4% teleworkedHealthcare support, Aug 2025: 10.8% teleworkedHealthcare support, Sep 2025: 11.5% teleworkedHealthcare support, Oct 2025: not collectedHealthcare support, Nov 2025: 10.9% teleworkedHealthcare support, Dec 2025: 9.9% teleworkedHealthcare support, Jan 2026: 10.4% teleworkedHealthcare support, Feb 2026: 10.4% teleworkedHealthcare support, Mar 2026: 10.6% teleworkedHealthcare support, Apr 2026: 10.9% teleworkedHealthcare support, May 2026: 11.1% teleworkedHealthcare support, Jun 2026: 11.3% teleworkedHealthcare support, Jul 2026: 12.8% teleworkedHealthcare support, Aug 2026: 11.8% teleworkedHealthcare support, Sep 2026: 11.3% teleworkedPersonal care and servicePersonal care and service, Oct 2022: 6.8% teleworkedPersonal care and service, Nov 2022: 6.5% teleworkedPersonal care and service, Dec 2022: 6.8% teleworkedPersonal care and service, Jan 2023: 8.5% teleworkedPersonal care and service, Feb 2023: 8.6% teleworkedPersonal care and service, Mar 2023: 8.5% teleworkedPersonal care and service, Apr 2023: 6.3% teleworkedPersonal care and service, May 2023: 8.9% teleworkedPersonal care and service, Jun 2023: 7.4% teleworkedPersonal care and service, Jul 2023: 8.2% teleworkedPersonal care and service, Aug 2023: 7.9% teleworkedPersonal care and service, Sep 2023: 7.3% teleworkedPersonal care and service, Oct 2023: 7.6% teleworkedPersonal care and service, Nov 2023: 7.7% teleworkedPersonal care and service, Dec 2023: 9.7% teleworkedPersonal care and service, Jan 2024: 10.3% teleworkedPersonal care and service, Feb 2024: 10.2% teleworkedPersonal care and service, Mar 2024: 11.7% teleworkedPersonal care and service, Apr 2024: 11.2% teleworkedPersonal care and service, May 2024: 11.5% teleworkedPersonal care and service, Jun 2024: 11.8% teleworkedPersonal care and service, Jul 2024: 10.7% teleworkedPersonal care and service, Aug 2024: 12.2% teleworkedPersonal care and service, Sep 2024: 10.4% teleworkedPersonal care and service, Oct 2024: 10.5% teleworkedPersonal care and service, Nov 2024: 11.6% teleworkedPersonal care and service, Dec 2024: 11.0% teleworkedPersonal care and service, Jan 2025: 11.6% teleworkedPersonal care and service, Feb 2025: 12.3% teleworkedPersonal care and service, Mar 2025: 10.5% teleworkedPersonal care and service, Apr 2025: 10.7% teleworkedPersonal care and service, May 2025: 11.5% teleworkedPersonal care and service, Jun 2025: 10.4% teleworkedPersonal care and service, Jul 2025: 9.3% teleworkedPersonal care and service, Aug 2025: 8.5% teleworkedPersonal care and service, Sep 2025: 10.2% teleworkedPersonal care and service, Oct 2025: not collectedPersonal care and service, Nov 2025: 11.0% teleworkedPersonal care and service, Dec 2025: 11.3% teleworkedPersonal care and service, Jan 2026: 10.8% teleworkedPersonal care and service, Feb 2026: 10.5% teleworkedPersonal care and service, Mar 2026: 11.1% teleworkedPersonal care and service, Apr 2026: 9.5% teleworkedPersonal care and service, May 2026: 11.0% teleworkedPersonal care and service, Jun 2026: 9.9% teleworkedPersonal care and service, Jul 2026: 9.3% teleworkedPersonal care and service, Aug 2026: 10.1% teleworkedPersonal care and service, Sep 2026: 9.6% teleworkedProtective serviceProtective service, Oct 2022: 3.9% teleworkedProtective service, Nov 2022: 4.2% teleworkedProtective service, Dec 2022: 3.9% teleworkedProtective service, Jan 2023: 4.1% teleworkedProtective service, Feb 2023: 5.8% teleworkedProtective service, Mar 2023: 5.1% teleworkedProtective service, Apr 2023: 4.8% teleworkedProtective service, May 2023: 4.0% teleworkedProtective service, Jun 2023: 4.0% teleworkedProtective service, Jul 2023: 4.9% teleworkedProtective service, Aug 2023: 4.6% teleworkedProtective service, Sep 2023: 5.7% teleworkedProtective service, Oct 2023: 5.7% teleworkedProtective service, Nov 2023: 5.5% teleworkedProtective service, Dec 2023: 4.9% teleworkedProtective service, Jan 2024: 6.1% teleworkedProtective service, Feb 2024: 6.8% teleworkedProtective service, Mar 2024: 8.2% teleworkedProtective service, Apr 2024: 5.9% teleworkedProtective service, May 2024: 7.0% teleworkedProtective service, Jun 2024: 5.9% teleworkedProtective service, Jul 2024: 5.7% teleworkedProtective service, Aug 2024: 6.7% teleworkedProtective service, Sep 2024: 7.2% teleworkedProtective service, Oct 2024: 7.8% teleworkedProtective service, Nov 2024: 5.8% teleworkedProtective service, Dec 2024: 6.9% teleworkedProtective service, Jan 2025: 6.5% teleworkedProtective service, Feb 2025: 8.2% teleworkedProtective service, Mar 2025: 7.8% teleworkedProtective service, Apr 2025: 5.8% teleworkedProtective service, May 2025: 5.8% teleworkedProtective service, Jun 2025: 5.4% teleworkedProtective service, Jul 2025: 7.0% teleworkedProtective service, Aug 2025: 7.3% teleworkedProtective service, Sep 2025: 7.1% teleworkedProtective service, Oct 2025: not collectedProtective service, Nov 2025: 7.4% teleworkedProtective service, Dec 2025: 6.3% teleworkedProtective service, Jan 2026: 5.2% teleworkedProtective service, Feb 2026: 8.4% teleworkedProtective service, Mar 2026: 8.2% teleworkedProtective service, Apr 2026: 7.2% teleworkedProtective service, May 2026: 6.7% teleworkedProtective service, Jun 2026: 6.2% teleworkedProtective service, Jul 2026: 7.6% teleworkedProtective service, Aug 2026: 5.7% teleworkedProtective service, Sep 2026: 7.0% teleworkedFarming, fishing, and forestryFarming, fishing, and forestry, Oct 2022: 0.9% teleworkedFarming, fishing, and forestry, Nov 2022: 0.5% teleworkedFarming, fishing, and forestry, Dec 2022: 1.2% teleworkedFarming, fishing, and forestry, Jan 2023: 1.2% teleworkedFarming, fishing, and forestry, Feb 2023: 2.7% teleworkedFarming, fishing, and forestry, Mar 2023: 1.0% teleworkedFarming, fishing, and forestry, Apr 2023: 1.6% teleworkedFarming, fishing, and forestry, May 2023: 1.8% teleworkedFarming, fishing, and forestry, Jun 2023: 0.7% teleworkedFarming, fishing, and forestry, Jul 2023: 2.0% teleworkedFarming, fishing, and forestry, Aug 2023: 3.0% teleworkedFarming, fishing, and forestry, Sep 2023: 3.5% teleworkedFarming, fishing, and forestry, Oct 2023: 1.5% teleworkedFarming, fishing, and forestry, Nov 2023: 2.1% teleworkedFarming, fishing, and forestry, Dec 2023: 5.0% teleworkedFarming, fishing, and forestry, Jan 2024: 0.8% teleworkedFarming, fishing, and forestry, Feb 2024: 2.9% teleworkedFarming, fishing, and forestry, Mar 2024: 3.2% teleworkedFarming, fishing, and forestry, Apr 2024: 1.8% teleworkedFarming, fishing, and forestry, May 2024: 4.6% teleworkedFarming, fishing, and forestry, Jun 2024: 2.7% teleworkedFarming, fishing, and forestry, Jul 2024: 4.8% teleworkedFarming, fishing, and forestry, Aug 2024: 4.6% teleworkedFarming, fishing, and forestry, Sep 2024: 4.7% teleworkedFarming, fishing, and forestry, Oct 2024: 5.6% teleworkedFarming, fishing, and forestry, Nov 2024: 5.5% teleworkedFarming, fishing, and forestry, Dec 2024: 4.8% teleworkedFarming, fishing, and forestry, Jan 2025: 4.8% teleworkedFarming, fishing, and forestry, Feb 2025: 5.8% teleworkedFarming, fishing, and forestry, Mar 2025: 5.0% teleworkedFarming, fishing, and forestry, Apr 2025: 5.3% teleworkedFarming, fishing, and forestry, May 2025: 5.4% teleworkedFarming, fishing, and forestry, Jun 2025: 5.3% teleworkedFarming, fishing, and forestry, Jul 2025: 6.7% teleworkedFarming, fishing, and forestry, Aug 2025: 5.1% teleworkedFarming, fishing, and forestry, Sep 2025: 5.7% teleworkedFarming, fishing, and forestry, Oct 2025: not collectedFarming, fishing, and forestry, Nov 2025: 8.8% teleworkedFarming, fishing, and forestry, Dec 2025: 7.7% teleworkedFarming, fishing, and forestry, Jan 2026: 6.6% teleworkedFarming, fishing, and forestry, Feb 2026: 7.1% teleworkedFarming, fishing, and forestry, Mar 2026: 5.1% teleworkedFarming, fishing, and forestry, Apr 2026: 5.9% teleworkedFarming, fishing, and forestry, May 2026: 4.9% teleworkedFarming, fishing, and forestry, Jun 2026: 4.2% teleworkedFarming, fishing, and forestry, Jul 2026: 3.8% teleworkedFarming, fishing, and forestry, Aug 2026: 3.7% teleworkedFarming, fishing, and forestry, Sep 2026: 6.3% teleworkedProductionProduction, Oct 2022: 1.9% teleworkedProduction, Nov 2022: 2.8% teleworkedProduction, Dec 2022: 3.5% teleworkedProduction, Jan 2023: 3.6% teleworkedProduction, Feb 2023: 3.6% teleworkedProduction, Mar 2023: 3.8% teleworkedProduction, Apr 2023: 3.8% teleworkedProduction, May 2023: 3.5% teleworkedProduction, Jun 2023: 2.8% teleworkedProduction, Jul 2023: 3.1% teleworkedProduction, Aug 2023: 3.8% teleworkedProduction, Sep 2023: 2.7% teleworkedProduction, Oct 2023: 3.7% teleworkedProduction, Nov 2023: 3.8% teleworkedProduction, Dec 2023: 3.5% teleworkedProduction, Jan 2024: 4.8% teleworkedProduction, Feb 2024: 5.3% teleworkedProduction, Mar 2024: 4.8% teleworkedProduction, Apr 2024: 4.5% teleworkedProduction, May 2024: 4.0% teleworkedProduction, Jun 2024: 4.7% teleworkedProduction, Jul 2024: 4.1% teleworkedProduction, Aug 2024: 4.2% teleworkedProduction, Sep 2024: 4.7% teleworkedProduction, Oct 2024: 4.5% teleworkedProduction, Nov 2024: 4.2% teleworkedProduction, Dec 2024: 4.4% teleworkedProduction, Jan 2025: 4.6% teleworkedProduction, Feb 2025: 4.9% teleworkedProduction, Mar 2025: 5.1% teleworkedProduction, Apr 2025: 4.3% teleworkedProduction, May 2025: 4.3% teleworkedProduction, Jun 2025: 4.1% teleworkedProduction, Jul 2025: 4.7% teleworkedProduction, Aug 2025: 5.3% teleworkedProduction, Sep 2025: 5.2% teleworkedProduction, Oct 2025: not collectedProduction, Nov 2025: 5.4% teleworkedProduction, Dec 2025: 5.5% teleworkedProduction, Jan 2026: 5.0% teleworkedProduction, Feb 2026: 5.8% teleworkedProduction, Mar 2026: 4.7% teleworkedProduction, Apr 2026: 4.9% teleworkedProduction, May 2026: 3.9% teleworkedProduction, Jun 2026: 4.7% teleworkedProduction, Jul 2026: 5.8% teleworkedProduction, Aug 2026: 4.8% teleworkedProduction, Sep 2026: 4.7% teleworkedInstallation and repairInstallation, maintenance, and repair, Oct 2022: 2.4% teleworkedInstallation, maintenance, and repair, Nov 2022: 3.8% teleworkedInstallation, maintenance, and repair, Dec 2022: 3.1% teleworkedInstallation, maintenance, and repair, Jan 2023: 2.5% teleworkedInstallation, maintenance, and repair, Feb 2023: 2.0% teleworkedInstallation, maintenance, and repair, Mar 2023: 2.2% teleworkedInstallation, maintenance, and repair, Apr 2023: 2.3% teleworkedInstallation, maintenance, and repair, May 2023: 2.8% teleworkedInstallation, maintenance, and repair, Jun 2023: 2.3% teleworkedInstallation, maintenance, and repair, Jul 2023: 3.4% teleworkedInstallation, maintenance, and repair, Aug 2023: 2.8% teleworkedInstallation, maintenance, and repair, Sep 2023: 2.3% teleworkedInstallation, maintenance, and repair, Oct 2023: 3.2% teleworkedInstallation, maintenance, and repair, Nov 2023: 2.9% teleworkedInstallation, maintenance, and repair, Dec 2023: 3.1% teleworkedInstallation, maintenance, and repair, Jan 2024: 4.4% teleworkedInstallation, maintenance, and repair, Feb 2024: 4.4% teleworkedInstallation, maintenance, and repair, Mar 2024: 4.3% teleworkedInstallation, maintenance, and repair, Apr 2024: 4.4% teleworkedInstallation, maintenance, and repair, May 2024: 3.4% teleworkedInstallation, maintenance, and repair, Jun 2024: 3.4% teleworkedInstallation, maintenance, and repair, Jul 2024: 4.0% teleworkedInstallation, maintenance, and repair, Aug 2024: 3.8% teleworkedInstallation, maintenance, and repair, Sep 2024: 4.8% teleworkedInstallation, maintenance, and repair, Oct 2024: 5.2% teleworkedInstallation, maintenance, and repair, Nov 2024: 4.4% teleworkedInstallation, maintenance, and repair, Dec 2024: 4.1% teleworkedInstallation, maintenance, and repair, Jan 2025: 4.2% teleworkedInstallation, maintenance, and repair, Feb 2025: 3.7% teleworkedInstallation, maintenance, and repair, Mar 2025: 4.4% teleworkedInstallation, maintenance, and repair, Apr 2025: 4.2% teleworkedInstallation, maintenance, and repair, May 2025: 4.1% teleworkedInstallation, maintenance, and repair, Jun 2025: 3.6% teleworkedInstallation, maintenance, and repair, Jul 2025: 4.0% teleworkedInstallation, maintenance, and repair, Aug 2025: 4.1% teleworkedInstallation, maintenance, and repair, Sep 2025: 4.3% teleworkedInstallation, maintenance, and repair, Oct 2025: not collectedInstallation, maintenance, and repair, Nov 2025: 4.6% teleworkedInstallation, maintenance, and repair, Dec 2025: 4.1% teleworkedInstallation, maintenance, and repair, Jan 2026: 3.7% teleworkedInstallation, maintenance, and repair, Feb 2026: 4.3% teleworkedInstallation, maintenance, and repair, Mar 2026: 4.1% teleworkedInstallation, maintenance, and repair, Apr 2026: 4.2% teleworkedInstallation, maintenance, and repair, May 2026: 4.3% teleworkedInstallation, maintenance, and repair, Jun 2026: 4.3% teleworkedInstallation, maintenance, and repair, Jul 2026: 5.0% teleworkedInstallation, maintenance, and repair, Aug 2026: 4.3% teleworkedInstallation, maintenance, and repair, Sep 2026: 4.9% teleworkedBuilding and grounds cleaningBuilding and grounds cleaning and maintenance, Oct 2022: 1.4% teleworkedBuilding and grounds cleaning and maintenance, Nov 2022: 0.9% teleworkedBuilding and grounds cleaning and maintenance, Dec 2022: 1.5% teleworkedBuilding and grounds cleaning and maintenance, Jan 2023: 1.6% teleworkedBuilding and grounds cleaning and maintenance, Feb 2023: 1.9% teleworkedBuilding and grounds cleaning and maintenance, Mar 2023: 2.0% teleworkedBuilding and grounds cleaning and maintenance, Apr 2023: 1.4% teleworkedBuilding and grounds cleaning and maintenance, May 2023: 1.8% teleworkedBuilding and grounds cleaning and maintenance, Jun 2023: 2.0% teleworkedBuilding and grounds cleaning and maintenance, Jul 2023: 1.2% teleworkedBuilding and grounds cleaning and maintenance, Aug 2023: 1.7% teleworkedBuilding and grounds cleaning and maintenance, Sep 2023: 2.2% teleworkedBuilding and grounds cleaning and maintenance, Oct 2023: 1.7% teleworkedBuilding and grounds cleaning and maintenance, Nov 2023: 1.3% teleworkedBuilding and grounds cleaning and maintenance, Dec 2023: 2.0% teleworkedBuilding and grounds cleaning and maintenance, Jan 2024: 3.0% teleworkedBuilding and grounds cleaning and maintenance, Feb 2024: 2.8% teleworkedBuilding and grounds cleaning and maintenance, Mar 2024: 4.1% teleworkedBuilding and grounds cleaning and maintenance, Apr 2024: 2.4% teleworkedBuilding and grounds cleaning and maintenance, May 2024: 2.0% teleworkedBuilding and grounds cleaning and maintenance, Jun 2024: 3.3% teleworkedBuilding and grounds cleaning and maintenance, Jul 2024: 3.2% teleworkedBuilding and grounds cleaning and maintenance, Aug 2024: 3.7% teleworkedBuilding and grounds cleaning and maintenance, Sep 2024: 3.6% teleworkedBuilding and grounds cleaning and maintenance, Oct 2024: 3.8% teleworkedBuilding and grounds cleaning and maintenance, Nov 2024: 2.8% teleworkedBuilding and grounds cleaning and maintenance, Dec 2024: 3.1% teleworkedBuilding and grounds cleaning and maintenance, Jan 2025: 2.9% teleworkedBuilding and grounds cleaning and maintenance, Feb 2025: 3.6% teleworkedBuilding and grounds cleaning and maintenance, Mar 2025: 3.0% teleworkedBuilding and grounds cleaning and maintenance, Apr 2025: 3.2% teleworkedBuilding and grounds cleaning and maintenance, May 2025: 3.1% teleworkedBuilding and grounds cleaning and maintenance, Jun 2025: 2.7% teleworkedBuilding and grounds cleaning and maintenance, Jul 2025: 2.3% teleworkedBuilding and grounds cleaning and maintenance, Aug 2025: 2.9% teleworkedBuilding and grounds cleaning and maintenance, Sep 2025: 3.1% teleworkedBuilding and grounds cleaning and maintenance, Oct 2025: not collectedBuilding and grounds cleaning and maintenance, Nov 2025: 2.9% teleworkedBuilding and grounds cleaning and maintenance, Dec 2025: 2.7% teleworkedBuilding and grounds cleaning and maintenance, Jan 2026: 2.5% teleworkedBuilding and grounds cleaning and maintenance, Feb 2026: 2.4% teleworkedBuilding and grounds cleaning and maintenance, Mar 2026: 4.0% teleworkedBuilding and grounds cleaning and maintenance, Apr 2026: 3.0% teleworkedBuilding and grounds cleaning and maintenance, May 2026: 3.3% teleworkedBuilding and grounds cleaning and maintenance, Jun 2026: 2.7% teleworkedBuilding and grounds cleaning and maintenance, Jul 2026: 3.3% teleworkedBuilding and grounds cleaning and maintenance, Aug 2026: 3.2% teleworkedBuilding and grounds cleaning and maintenance, Sep 2026: 3.9% teleworkedConstruction and extractionConstruction and extraction, Oct 2022: 1.4% teleworkedConstruction and extraction, Nov 2022: 1.2% teleworkedConstruction and extraction, Dec 2022: 1.1% teleworkedConstruction and extraction, Jan 2023: 1.9% teleworkedConstruction and extraction, Feb 2023: 2.2% teleworkedConstruction and extraction, Mar 2023: 1.7% teleworkedConstruction and extraction, Apr 2023: 1.6% teleworkedConstruction and extraction, May 2023: 1.6% teleworkedConstruction and extraction, Jun 2023: 2.4% teleworkedConstruction and extraction, Jul 2023: 2.2% teleworkedConstruction and extraction, Aug 2023: 1.6% teleworkedConstruction and extraction, Sep 2023: 1.7% teleworkedConstruction and extraction, Oct 2023: 1.6% teleworkedConstruction and extraction, Nov 2023: 1.9% teleworkedConstruction and extraction, Dec 2023: 1.9% teleworkedConstruction and extraction, Jan 2024: 2.6% teleworkedConstruction and extraction, Feb 2024: 2.7% teleworkedConstruction and extraction, Mar 2024: 2.7% teleworkedConstruction and extraction, Apr 2024: 1.7% teleworkedConstruction and extraction, May 2024: 2.3% teleworkedConstruction and extraction, Jun 2024: 2.7% teleworkedConstruction and extraction, Jul 2024: 3.1% teleworkedConstruction and extraction, Aug 2024: 2.6% teleworkedConstruction and extraction, Sep 2024: 2.9% teleworkedConstruction and extraction, Oct 2024: 3.0% teleworkedConstruction and extraction, Nov 2024: 3.7% teleworkedConstruction and extraction, Dec 2024: 3.3% teleworkedConstruction and extraction, Jan 2025: 3.2% teleworkedConstruction and extraction, Feb 2025: 3.7% teleworkedConstruction and extraction, Mar 2025: 2.8% teleworkedConstruction and extraction, Apr 2025: 2.8% teleworkedConstruction and extraction, May 2025: 4.1% teleworkedConstruction and extraction, Jun 2025: 3.3% teleworkedConstruction and extraction, Jul 2025: 3.3% teleworkedConstruction and extraction, Aug 2025: 3.1% teleworkedConstruction and extraction, Sep 2025: 3.4% teleworkedConstruction and extraction, Oct 2025: not collectedConstruction and extraction, Nov 2025: 3.8% teleworkedConstruction and extraction, Dec 2025: 3.6% teleworkedConstruction and extraction, Jan 2026: 3.3% teleworkedConstruction and extraction, Feb 2026: 3.3% teleworkedConstruction and extraction, Mar 2026: 3.5% teleworkedConstruction and extraction, Apr 2026: 2.7% teleworkedConstruction and extraction, May 2026: 3.4% teleworkedConstruction and extraction, Jun 2026: 2.4% teleworkedConstruction and extraction, Jul 2026: 2.5% teleworkedConstruction and extraction, Aug 2026: 2.1% teleworkedConstruction and extraction, Sep 2026: 2.2% teleworkedTransportation and movingTransportation and material moving, Oct 2022: 1.1% teleworkedTransportation and material moving, Nov 2022: 0.8% teleworkedTransportation and material moving, Dec 2022: 1.1% teleworkedTransportation and material moving, Jan 2023: 1.4% teleworkedTransportation and material moving, Feb 2023: 1.4% teleworkedTransportation and material moving, Mar 2023: 1.4% teleworkedTransportation and material moving, Apr 2023: 1.4% teleworkedTransportation and material moving, May 2023: 1.3% teleworkedTransportation and material moving, Jun 2023: 1.1% teleworkedTransportation and material moving, Jul 2023: 0.8% teleworkedTransportation and material moving, Aug 2023: 1.0% teleworkedTransportation and material moving, Sep 2023: 1.5% teleworkedTransportation and material moving, Oct 2023: 1.3% teleworkedTransportation and material moving, Nov 2023: 1.6% teleworkedTransportation and material moving, Dec 2023: 1.6% teleworkedTransportation and material moving, Jan 2024: 1.6% teleworkedTransportation and material moving, Feb 2024: 2.1% teleworkedTransportation and material moving, Mar 2024: 2.1% teleworkedTransportation and material moving, Apr 2024: 1.9% teleworkedTransportation and material moving, May 2024: 2.1% teleworkedTransportation and material moving, Jun 2024: 2.0% teleworkedTransportation and material moving, Jul 2024: 2.1% teleworkedTransportation and material moving, Aug 2024: 1.7% teleworkedTransportation and material moving, Sep 2024: 2.2% teleworkedTransportation and material moving, Oct 2024: 1.9% teleworkedTransportation and material moving, Nov 2024: 2.1% teleworkedTransportation and material moving, Dec 2024: 1.8% teleworkedTransportation and material moving, Jan 2025: 1.7% teleworkedTransportation and material moving, Feb 2025: 2.2% teleworkedTransportation and material moving, Mar 2025: 1.6% teleworkedTransportation and material moving, Apr 2025: 1.7% teleworkedTransportation and material moving, May 2025: 1.9% teleworkedTransportation and material moving, Jun 2025: 1.4% teleworkedTransportation and material moving, Jul 2025: 2.1% teleworkedTransportation and material moving, Aug 2025: 2.1% teleworkedTransportation and material moving, Sep 2025: 2.2% teleworkedTransportation and material moving, Oct 2025: not collectedTransportation and material moving, Nov 2025: 1.7% teleworkedTransportation and material moving, Dec 2025: 2.2% teleworkedTransportation and material moving, Jan 2026: 2.5% teleworkedTransportation and material moving, Feb 2026: 2.2% teleworkedTransportation and material moving, Mar 2026: 1.8% teleworkedTransportation and material moving, Apr 2026: 2.1% teleworkedTransportation and material moving, May 2026: 2.1% teleworkedTransportation and material moving, Jun 2026: 2.0% teleworkedTransportation and material moving, Jul 2026: 2.9% teleworkedTransportation and material moving, Aug 2026: 1.7% teleworkedTransportation and material moving, Sep 2026: 2.0% teleworkedFood preparation and servingFood preparation and serving related, Oct 2022: 0.7% teleworkedFood preparation and serving related, Nov 2022: 0.4% teleworkedFood preparation and serving related, Dec 2022: 0.8% teleworkedFood preparation and serving related, Jan 2023: 0.8% teleworkedFood preparation and serving related, Feb 2023: 0.6% teleworkedFood preparation and serving related, Mar 2023: 0.5% teleworkedFood preparation and serving related, Apr 2023: 0.5% teleworkedFood preparation and serving related, May 2023: 0.7% teleworkedFood preparation and serving related, Jun 2023: 0.7% teleworkedFood preparation and serving related, Jul 2023: 1.1% teleworkedFood preparation and serving related, Aug 2023: 1.0% teleworkedFood preparation and serving related, Sep 2023: 1.0% teleworkedFood preparation and serving related, Oct 2023: 1.0% teleworkedFood preparation and serving related, Nov 2023: 1.3% teleworkedFood preparation and serving related, Dec 2023: 1.0% teleworkedFood preparation and serving related, Jan 2024: 1.2% teleworkedFood preparation and serving related, Feb 2024: 1.6% teleworkedFood preparation and serving related, Mar 2024: 2.0% teleworkedFood preparation and serving related, Apr 2024: 1.1% teleworkedFood preparation and serving related, May 2024: 1.4% teleworkedFood preparation and serving related, Jun 2024: 1.6% teleworkedFood preparation and serving related, Jul 2024: 1.4% teleworkedFood preparation and serving related, Aug 2024: 1.2% teleworkedFood preparation and serving related, Sep 2024: 1.7% teleworkedFood preparation and serving related, Oct 2024: 1.4% teleworkedFood preparation and serving related, Nov 2024: 1.1% teleworkedFood preparation and serving related, Dec 2024: 1.2% teleworkedFood preparation and serving related, Jan 2025: 1.2% teleworkedFood preparation and serving related, Feb 2025: 1.3% teleworkedFood preparation and serving related, Mar 2025: 1.4% teleworkedFood preparation and serving related, Apr 2025: 1.7% teleworkedFood preparation and serving related, May 2025: 1.6% teleworkedFood preparation and serving related, Jun 2025: 1.7% teleworkedFood preparation and serving related, Jul 2025: 1.6% teleworkedFood preparation and serving related, Aug 2025: 1.9% teleworkedFood preparation and serving related, Sep 2025: 1.7% teleworkedFood preparation and serving related, Oct 2025: not collectedFood preparation and serving related, Nov 2025: 1.6% teleworkedFood preparation and serving related, Dec 2025: 0.9% teleworkedFood preparation and serving related, Jan 2026: 0.8% teleworkedFood preparation and serving related, Feb 2026: 1.0% teleworkedFood preparation and serving related, Mar 2026: 1.1% teleworkedFood preparation and serving related, Apr 2026: 1.1% teleworkedFood preparation and serving related, May 2026: 0.9% teleworkedFood preparation and serving related, Jun 2026: 1.3% teleworkedFood preparation and serving related, Jul 2026: 0.9% teleworkedFood preparation and serving related, Aug 2026: 1.3% teleworkedFood preparation and serving related, Sep 2026: 1.4% teleworked

    Source: BLS Current Population Survey telework series, not seasonally adjusted, Oct 2022 to Sep 2026. Oct 2025 data were not collected because of the federal government shutdown.

    The atlas splits the workforce into two worlds. In 2026, telework rates of 40% or more were limited to 4 occupation groups: computer and mathematical, business and financial operations, legal, and arts, design, entertainment, sports, and media. At the other end, 8 groups never reached 10% in any month since 2022: protective service, farming, fishing, and forestry, production, installation, maintenance, and repair, building and grounds cleaning and maintenance, construction and extraction, transportation and material moving, and food preparation and serving related. Most rows change little from month to month; the visible swings are in the darkest rows at the top.

    Which occupations telework the most

    January to September 2026 same months of 2024

    0%10%20%30%40%50%60%70%Computer and mathematicalComputer and mathematical: 68.4% in Jan to Sep 2024Computer and mathematical: 62.0% in Jan to Sep 2026 (-6.4 points vs 2024)62.0%Business and financial operationsBusiness and financial operations: 56.9% in Jan to Sep 2024Business and financial operations: 54.3% in Jan to Sep 2026 (-2.6 points vs 2024)54.3%LegalLegal: 53.7% in Jan to Sep 2024Legal: 52.8% in Jan to Sep 2026 (-1.0 points vs 2024)52.8%Arts, design, and mediaArts, design, entertainment, sports, and media: 47.7% in Jan to Sep 2024Arts, design, entertainment, sports, and media: 46.8% in Jan to Sep 2026 (-0.9 points vs 2024)46.8%ManagementManagement: 38.0% in Jan to Sep 2024Management: 37.6% in Jan to Sep 2026 (-0.4 points vs 2024)37.6%Architecture and engineeringArchitecture and engineering: 40.0% in Jan to Sep 2024Architecture and engineering: 36.5% in Jan to Sep 2026 (-3.5 points vs 2024)36.5%Community and social servicesCommunity and social services: 34.8% in Jan to Sep 2024Community and social services: 36.5% in Jan to Sep 2026 (+1.7 points vs 2024)36.5%Life, physical, social scienceLife, physical, and social science: 39.9% in Jan to Sep 2024Life, physical, and social science: 34.3% in Jan to Sep 2026 (-5.5 points vs 2024)34.3%Office and administrative supportOffice and administrative support: 25.2% in Jan to Sep 2024Office and administrative support: 24.3% in Jan to Sep 2026 (-0.9 points vs 2024)24.3%Sales and relatedSales and related: 24.4% in Jan to Sep 2024Sales and related: 23.9% in Jan to Sep 2026 (-0.5 points vs 2024)23.9%Education and libraryEducation, training, and library: 15.7% in Jan to Sep 2024Education, training, and library: 15.1% in Jan to Sep 2026 (-0.6 points vs 2024)15.1%Healthcare practitionersHealthcare practitioners and technical: 13.4% in Jan to Sep 2024Healthcare practitioners and technical: 12.6% in Jan to Sep 2026 (-0.7 points vs 2024)12.6%Healthcare supportHealthcare support: 8.8% in Jan to Sep 2024Healthcare support: 11.2% in Jan to Sep 2026 (+2.3 points vs 2024)11.2%Personal care and servicePersonal care and service: 11.1% in Jan to Sep 2024Personal care and service: 10.2% in Jan to Sep 2026 (-0.9 points vs 2024)10.2%Protective serviceProtective service: 6.6% in Jan to Sep 2024Protective service: 6.9% in Jan to Sep 2026 (+0.3 points vs 2024)6.9%Farming, fishing, and forestryFarming, fishing, and forestry: 3.3% in Jan to Sep 2024Farming, fishing, and forestry: 5.3% in Jan to Sep 2026 (+1.9 points vs 2024)5.3%ProductionProduction: 4.6% in Jan to Sep 2024Production: 4.9% in Jan to Sep 2026 (+0.4 points vs 2024)4.9%Installation and repairInstallation, maintenance, and repair: 4.1% in Jan to Sep 2024Installation, maintenance, and repair: 4.3% in Jan to Sep 2026 (+0.2 points vs 2024)4.3%Building and grounds cleaningBuilding and grounds cleaning and maintenance: 3.1% in Jan to Sep 2024Building and grounds cleaning and maintenance: 3.1% in Jan to Sep 2026 (+0.0 points vs 2024)3.1%Construction and extractionConstruction and extraction: 2.6% in Jan to Sep 2024Construction and extraction: 2.8% in Jan to Sep 2026 (+0.2 points vs 2024)2.8%Transportation and movingTransportation and material moving: 2.0% in Jan to Sep 2024Transportation and material moving: 2.1% in Jan to Sep 2026 (+0.2 points vs 2024)2.1%Food preparation and servingFood preparation and serving related: 1.5% in Jan to Sep 2024Food preparation and serving related: 1.1% in Jan to Sep 2026 (-0.4 points vs 2024)1.1%

    Average monthly telework rate, January to September. Same months are compared because the data are not seasonally adjusted.

    Computer and mathematical remain the most remote group at 62.0%, but they also fell further than any other occupation group: down 6.4 points from 68.4% in 2024. The drop is split between hybrid and full-time remote work. The share of computer and math workers teleworking some hours went from 28.8% to 26.8%, and the share teleworking all hours from 39.6% to 35.2%. Even so, more than 6 in 10 people in these jobs still telework in a typical week. For anyone hiring technical staff, telework remains the norm for the role, in a labor market where our analysis of the 2026 tech job market found openings far below their 2022 peak.

    Occupation group 2024 2025 2026 Change, pts 2026 some hours 2026 all hours
    Computer and mathematical 68.4% 65.4% 62.0% -6.4 26.8% 35.2%
    Business and financial operations 56.9% 55.8% 54.3% -2.6 26.5% 27.8%
    Legal 53.7% 52.5% 52.8% -1.0 34.0% 18.8%
    Arts, design, entertainment, sports, and media 47.7% 46.9% 46.8% -0.9 21.3% 25.5%
    Management 38.0% 37.8% 37.6% -0.4 21.0% 16.6%
    Architecture and engineering 40.0% 37.5% 36.5% -3.5 24.5% 12.1%
    Community and social services 34.8% 33.1% 36.5% +1.7 25.7% 10.8%
    Life, physical, and social science 39.9% 33.9% 34.3% -5.5 23.0% 11.3%
    Office and administrative support 25.2% 25.0% 24.3% -0.9 10.4% 13.8%
    Sales and related 24.4% 23.8% 23.9% -0.5 12.3% 11.6%
    Education, training, and library 15.7% 15.4% 15.1% -0.6 9.7% 5.3%
    Healthcare practitioners and technical 13.4% 12.9% 12.6% -0.7 7.5% 5.1%
    Healthcare support 8.8% 10.2% 11.2% +2.3 2.6% 8.6%
    Personal care and service 11.1% 10.6% 10.2% -0.9 3.3% 6.9%
    Protective service 6.6% 6.8% 6.9% +0.3 4.4% 2.5%
    Farming, fishing, and forestry 3.3% 5.5% 5.3% +1.9 1.9% 3.4%
    Production 4.6% 4.7% 4.9% +0.4 2.2% 2.7%
    Installation, maintenance, and repair 4.1% 4.1% 4.3% +0.2 2.4% 1.9%
    Building and grounds cleaning and maintenance 3.1% 3.0% 3.1% +0.0 1.9% 1.2%
    Construction and extraction 2.6% 3.3% 2.8% +0.2 2.2% 0.6%
    Transportation and material moving 2.0% 1.9% 2.1% +0.2 1.3% 0.8%
    Food preparation and serving related 1.5% 1.6% 1.1% -0.4 0.7% 0.4%

    Average of monthly rates, January to September of each year. Some hours and all hours are shares of all people at work in the group and sum to the total.

    Is telework rising or falling in 2026?

    All telework Some hours (hybrid) All hours (fully remote)

    0%5%10%15%20%25%Jan 2023Jan 2024Jan 2025Jan 2026All telework, Oct 2022: 17.9%All telework, Nov 2022: 18.5%All telework, Dec 2022: 19.0%All telework, Jan 2023: 19.4%All telework, Feb 2023: 20.0%All telework, Mar 2023: 19.5%All telework, Apr 2023: 18.5%All telework, May 2023: 18.9%All telework, Jun 2023: 19.0%All telework, Jul 2023: 19.9%All telework, Aug 2023: 19.5%All telework, Sep 2023: 19.8%All telework, Oct 2023: 19.8%All telework, Nov 2023: 20.5%All telework, Dec 2023: 21.9%All telework, Jan 2024: 22.9%All telework, Feb 2024: 22.7%All telework, Mar 2024: 23.0%All telework, Apr 2024: 21.5%All telework, May 2024: 21.7%All telework, Jun 2024: 22.3%All telework, Jul 2024: 23.0%All telework, Aug 2024: 22.8%All telework, Sep 2024: 23.7%All telework, Oct 2024: 23.8%All telework, Nov 2024: 23.3%All telework, Dec 2024: 23.1%All telework, Jan 2025: 23.6%All telework, Feb 2025: 23.7%All telework, Mar 2025: 22.8%All telework, Apr 2025: 21.6%All telework, May 2025: 21.5%All telework, Jun 2025: 21.6%All telework, Jul 2025: 22.1%All telework, Aug 2025: 22.1%All telework, Sep 2025: 22.3%All telework, Nov 2025: 22.9%All telework, Dec 2025: 22.5%All telework, Jan 2026: 23.0%All telework, Feb 2026: 22.7%All telework, Mar 2026: 22.6%All telework, Apr 2026: 21.7%All telework, May 2026: 21.8%All telework, Jun 2026: 21.7%All telework, Jul 2026: 22.2%All telework, Aug 2026: 21.6%All telework, Sep 2026: 21.9%Some hours (hybrid), Oct 2022: 8.1%Some hours (hybrid), Nov 2022: 8.4%Some hours (hybrid), Dec 2022: 8.7%Some hours (hybrid), Jan 2023: 8.7%Some hours (hybrid), Feb 2023: 9.4%Some hours (hybrid), Mar 2023: 9.0%Some hours (hybrid), Apr 2023: 8.4%Some hours (hybrid), May 2023: 8.9%Some hours (hybrid), Jun 2023: 8.9%Some hours (hybrid), Jul 2023: 9.3%Some hours (hybrid), Aug 2023: 9.2%Some hours (hybrid), Sep 2023: 9.8%Some hours (hybrid), Oct 2023: 9.6%Some hours (hybrid), Nov 2023: 10.4%Some hours (hybrid), Dec 2023: 11.4%Some hours (hybrid), Jan 2024: 11.8%Some hours (hybrid), Feb 2024: 11.8%Some hours (hybrid), Mar 2024: 12.1%Some hours (hybrid), Apr 2024: 11.3%Some hours (hybrid), May 2024: 11.4%Some hours (hybrid), Jun 2024: 11.5%Some hours (hybrid), Jul 2024: 11.5%Some hours (hybrid), Aug 2024: 11.7%Some hours (hybrid), Sep 2024: 12.6%Some hours (hybrid), Oct 2024: 12.7%Some hours (hybrid), Nov 2024: 12.4%Some hours (hybrid), Dec 2024: 12.5%Some hours (hybrid), Jan 2025: 12.5%Some hours (hybrid), Feb 2025: 12.9%Some hours (hybrid), Mar 2025: 12.4%Some hours (hybrid), Apr 2025: 11.4%Some hours (hybrid), May 2025: 11.6%Some hours (hybrid), Jun 2025: 11.5%Some hours (hybrid), Jul 2025: 11.3%Some hours (hybrid), Aug 2025: 11.4%Some hours (hybrid), Sep 2025: 11.6%Some hours (hybrid), Nov 2025: 12.3%Some hours (hybrid), Dec 2025: 12.1%Some hours (hybrid), Jan 2026: 12.3%Some hours (hybrid), Feb 2026: 12.3%Some hours (hybrid), Mar 2026: 12.1%Some hours (hybrid), Apr 2026: 11.3%Some hours (hybrid), May 2026: 11.3%Some hours (hybrid), Jun 2026: 11.1%Some hours (hybrid), Jul 2026: 11.2%Some hours (hybrid), Aug 2026: 11.0%Some hours (hybrid), Sep 2026: 11.2%All hours (fully remote), Oct 2022: 9.7%All hours (fully remote), Nov 2022: 10.1%All hours (fully remote), Dec 2022: 10.3%All hours (fully remote), Jan 2023: 10.7%All hours (fully remote), Feb 2023: 10.6%All hours (fully remote), Mar 2023: 10.6%All hours (fully remote), Apr 2023: 10.1%All hours (fully remote), May 2023: 10.0%All hours (fully remote), Jun 2023: 10.1%All hours (fully remote), Jul 2023: 10.6%All hours (fully remote), Aug 2023: 10.3%All hours (fully remote), Sep 2023: 10.0%All hours (fully remote), Oct 2023: 10.1%All hours (fully remote), Nov 2023: 10.0%All hours (fully remote), Dec 2023: 10.5%All hours (fully remote), Jan 2024: 11.1%All hours (fully remote), Feb 2024: 10.9%All hours (fully remote), Mar 2024: 10.9%All hours (fully remote), Apr 2024: 10.2%All hours (fully remote), May 2024: 10.3%All hours (fully remote), Jun 2024: 10.8%All hours (fully remote), Jul 2024: 11.4%All hours (fully remote), Aug 2024: 11.1%All hours (fully remote), Sep 2024: 11.1%All hours (fully remote), Oct 2024: 11.1%All hours (fully remote), Nov 2024: 10.9%All hours (fully remote), Dec 2024: 10.7%All hours (fully remote), Jan 2025: 11.1%All hours (fully remote), Feb 2025: 10.8%All hours (fully remote), Mar 2025: 10.4%All hours (fully remote), Apr 2025: 10.2%All hours (fully remote), May 2025: 9.9%All hours (fully remote), Jun 2025: 10.1%All hours (fully remote), Jul 2025: 10.8%All hours (fully remote), Aug 2025: 10.7%All hours (fully remote), Sep 2025: 10.6%All hours (fully remote), Nov 2025: 10.7%All hours (fully remote), Dec 2025: 10.4%All hours (fully remote), Jan 2026: 10.7%All hours (fully remote), Feb 2026: 10.4%All hours (fully remote), Mar 2026: 10.5%All hours (fully remote), Apr 2026: 10.4%All hours (fully remote), May 2026: 10.4%All hours (fully remote), Jun 2026: 10.7%All hours (fully remote), Jul 2026: 11.0%All hours (fully remote), Aug 2026: 10.6%All hours (fully remote), Sep 2026: 10.7%All telework 21.9%Hybrid 11.2%Fully remote 10.7%Oct 2025 not collectedpeak 23.8%

    Share of people at work who teleworked, monthly, not seasonally adjusted.

    Telework climbed from 17.9% in Oct 2022 to a peak of 23.8% in Oct 2024. Since then it has drifted down: the January to September average was 22.6% in 2024, 22.4% in 2025, and 22.1% in 2026. In Sep 2026 the rate was 21.9%, or 34.7 million people.

    The two kinds of telework grew differently. Between January to September 2023 and the same months of 2024, hybrid telework (some hours) rose from 9.1% to 11.7%, while fully remote work (all hours) went only from 10.3% to 10.9%. Hybrid drove the climb. The decline since then is small and shared: hybrid is at 11.5% and fully remote at 10.6% in 2026. Fully remote work has stayed between 10.3% and 10.9% of workers in every January to September period since 2023. People who telework do about 67% of their hours from home, and telework accounted for 15.3% of all hours worked in January to September 2026.

    The federal return to office, in the data

    On January 20, 2025, a presidential memorandum directed executive branch agencies to end remote work arrangements and require employees to work in person full time. The CPS reference week for January 2025 fell before that date, so it serves as the baseline: 32.8% of federal workers teleworked that month. By Sep 2025 the rate was 14.9%.

    Federal government Private wage and salary State government

    0%10%20%30%40%Jan 2023Jan 2024Jan 2025Jan 2026Jan 20, 2025: federal return-to-office memoFederal government, Oct 2022: 24.7%Federal government, Nov 2022: 27.3%Federal government, Dec 2022: 28.6%Federal government, Jan 2023: 29.5%Federal government, Feb 2023: 30.6%Federal government, Mar 2023: 30.0%Federal government, Apr 2023: 29.5%Federal government, May 2023: 28.6%Federal government, Jun 2023: 29.0%Federal government, Jul 2023: 28.5%Federal government, Aug 2023: 28.6%Federal government, Sep 2023: 29.8%Federal government, Oct 2023: 30.4%Federal government, Nov 2023: 30.1%Federal government, Dec 2023: 33.5%Federal government, Jan 2024: 33.5%Federal government, Feb 2024: 34.1%Federal government, Mar 2024: 35.9%Federal government, Apr 2024: 31.3%Federal government, May 2024: 35.2%Federal government, Jun 2024: 35.1%Federal government, Jul 2024: 34.2%Federal government, Aug 2024: 32.9%Federal government, Sep 2024: 33.0%Federal government, Oct 2024: 33.2%Federal government, Nov 2024: 35.4%Federal government, Dec 2024: 33.7%Federal government, Jan 2025: 32.8%Federal government, Feb 2025: 26.5%Federal government, Mar 2025: 19.7%Federal government, Apr 2025: 18.2%Federal government, May 2025: 15.8%Federal government, Jun 2025: 17.3%Federal government, Jul 2025: 15.3%Federal government, Aug 2025: 16.5%Federal government, Sep 2025: 14.9%Federal government, Nov 2025: 18.1%Federal government, Dec 2025: 18.1%Federal government, Jan 2026: 17.4%Federal government, Feb 2026: 17.7%Federal government, Mar 2026: 18.1%Federal government, Apr 2026: 16.2%Federal government, May 2026: 18.0%Federal government, Jun 2026: 18.2%Federal government, Jul 2026: 16.4%Federal government, Aug 2026: 16.1%Federal government, Sep 2026: 18.4%Private wage and salary, Oct 2022: 17.7%Private wage and salary, Nov 2022: 18.3%Private wage and salary, Dec 2022: 18.8%Private wage and salary, Jan 2023: 19.0%Private wage and salary, Feb 2023: 19.5%Private wage and salary, Mar 2023: 18.8%Private wage and salary, Apr 2023: 18.0%Private wage and salary, May 2023: 18.5%Private wage and salary, Jun 2023: 18.2%Private wage and salary, Jul 2023: 19.0%Private wage and salary, Aug 2023: 18.9%Private wage and salary, Sep 2023: 19.2%Private wage and salary, Oct 2023: 19.1%Private wage and salary, Nov 2023: 19.8%Private wage and salary, Dec 2023: 21.0%Private wage and salary, Jan 2024: 21.9%Private wage and salary, Feb 2024: 21.4%Private wage and salary, Mar 2024: 21.8%Private wage and salary, Apr 2024: 20.4%Private wage and salary, May 2024: 20.6%Private wage and salary, Jun 2024: 20.9%Private wage and salary, Jul 2024: 21.5%Private wage and salary, Aug 2024: 21.5%Private wage and salary, Sep 2024: 22.8%Private wage and salary, Oct 2024: 22.6%Private wage and salary, Nov 2024: 22.2%Private wage and salary, Dec 2024: 22.1%Private wage and salary, Jan 2025: 22.6%Private wage and salary, Feb 2025: 22.7%Private wage and salary, Mar 2025: 21.9%Private wage and salary, Apr 2025: 20.8%Private wage and salary, May 2025: 20.9%Private wage and salary, Jun 2025: 20.7%Private wage and salary, Jul 2025: 21.0%Private wage and salary, Aug 2025: 21.6%Private wage and salary, Sep 2025: 21.7%Private wage and salary, Nov 2025: 22.2%Private wage and salary, Dec 2025: 21.7%Private wage and salary, Jan 2026: 22.4%Private wage and salary, Feb 2026: 21.9%Private wage and salary, Mar 2026: 21.6%Private wage and salary, Apr 2026: 20.8%Private wage and salary, May 2026: 20.8%Private wage and salary, Jun 2026: 20.5%Private wage and salary, Jul 2026: 20.9%Private wage and salary, Aug 2026: 20.6%Private wage and salary, Sep 2026: 21.0%State government, Oct 2022: 17.9%State government, Nov 2022: 17.5%State government, Dec 2022: 18.6%State government, Jan 2023: 21.1%State government, Feb 2023: 20.9%State government, Mar 2023: 22.9%State government, Apr 2023: 20.4%State government, May 2023: 20.5%State government, Jun 2023: 21.2%State government, Jul 2023: 23.0%State government, Aug 2023: 20.7%State government, Sep 2023: 19.3%State government, Oct 2023: 19.9%State government, Nov 2023: 20.3%State government, Dec 2023: 22.6%State government, Jan 2024: 25.1%State government, Feb 2024: 24.4%State government, Mar 2024: 23.9%State government, Apr 2024: 24.4%State government, May 2024: 24.0%State government, Jun 2024: 25.5%State government, Jul 2024: 27.0%State government, Aug 2024: 24.1%State government, Sep 2024: 23.6%State government, Oct 2024: 24.4%State government, Nov 2024: 23.4%State government, Dec 2024: 23.6%State government, Jan 2025: 23.4%State government, Feb 2025: 23.9%State government, Mar 2025: 24.4%State government, Apr 2025: 21.9%State government, May 2025: 21.5%State government, Jun 2025: 24.0%State government, Jul 2025: 26.3%State government, Aug 2025: 22.4%State government, Sep 2025: 24.0%State government, Nov 2025: 23.6%State government, Dec 2025: 24.0%State government, Jan 2026: 25.2%State government, Feb 2026: 24.8%State government, Mar 2026: 25.4%State government, Apr 2026: 23.9%State government, May 2026: 22.9%State government, Jun 2026: 24.6%State government, Jul 2026: 27.5%State government, Aug 2026: 25.5%State government, Sep 2026: 23.6%State 23.6%Private 21.0%Federal 18.4%

    Monthly telework rate by class of worker. Private wage and salary excludes the incorporated self-employed.

    Federal employees are only 2.6% of people at work, but their drop was large enough to move the national number. We split the change in the national rate between January to September 2024 and January to September 2026 (-0.49 points) by class of worker. The fall in the federal telework rate alone accounts for -0.41 points, about 84% of the national decline. Private wage and salary workers, three quarters of the workforce, moved from 21.4% to 21.2%, and the self-employed teleworked more. State government telework (24.8%) is back to its 2024 level.

    The timing has two phases. From 2024 to 2025, the private rate was flat (21.4% to 21.5%) and the federal change explains the whole national dip. From 2025 to 2026, private-sector telework eased to 21.2% and contributed -0.28 points of the -0.23-point change. That second phase is small, but it is the first year-over-year decline for private-sector workers in this series on a same-months basis.

    Class of worker Share of people at work, 2024 Telework 2024 Telework 2025 Telework 2026 Rate effect, pts Share effect, pts
    Private wage and salary 76.8% 21.4% 21.5% 21.2% -0.19 +0.07
    Federal government 2.6% 33.9% 19.8% 17.4% -0.41 -0.04
    State government 4.6% 24.6% 23.5% 24.8% +0.01 +0.03
    Local government 5.9% 10.9% 10.0% 10.1% -0.05 +0.00
    Self-employed, incorporated 4.2% 39.0% 40.9% 41.1% +0.09 -0.01
    Self-employed, unincorporated 6.0% 32.0% 32.8% 33.8% +0.10 -0.08
    All workers 100% 22.6% 22.4% 22.1% -0.49 total

    Rates are telework counts divided by people at work, summed over January to September of each year. Rate effect is the change in each group’s telework rate weighted by its average share of people at work; share effect is the shift in each group’s share of employment. Together they sum to the national change from 2024 to 2026. The six groups exclude unpaid family workers, so the all-workers rates here can differ from the headline rate by a few hundredths of a point.

    Remote work by industry

    Industry rates are what an MSP sees across a client roster. Professional and technical services and finance and insurance have the highest telework rates, both above 55%, while construction, retail, transportation, and food service sit near or below 10%.

    Industry 2024 2025 2026 Change, pts 2026 some hours 2026 all hours
    Professional and technical services 59.1% 58.3% 57.6% -1.4 24.9% 32.7%
    Finance and insurance 59.4% 58.7% 57.6% -1.8 27.3% 30.3%
    Information 53.1% 48.1% 49.7% -3.4 22.0% 27.6%
    Real estate and rental and leasing 39.6% 39.1% 39.4% -0.2 23.5% 15.9%
    Utilities 26.0% 25.8% 25.2% -0.8 16.4% 8.9%
    Wholesale trade 24.7% 26.2% 24.6% -0.0 13.8% 10.9%
    Public administration 28.6% 22.2% 22.3% -6.3 14.7% 7.6%
    Durable goods manufacturing 20.4% 19.5% 20.2% -0.1 12.3% 7.9%
    Other services, except private households 17.5% 18.4% 19.1% +1.7 11.0% 8.1%
    Arts, entertainment, and recreation 20.6% 21.0% 18.5% -2.1 9.8% 8.8%
    Nondurable goods manufacturing 17.6% 19.6% 18.4% +0.8 10.8% 7.6%
    Health care and social assistance 17.4% 17.5% 18.0% +0.6 9.1% 8.8%
    Educational services 18.6% 18.6% 18.0% -0.7 11.8% 6.2%
    Management, administrative, and waste services 20.3% 18.7% 17.8% -2.5 8.0% 9.8%
    Agriculture and related industries 12.2% 13.8% 15.3% +3.1 4.8% 10.6%
    Mining, quarrying, and oil and gas extraction 16.3% 14.7% 14.2% -2.1 9.3% 4.9%
    Retail trade 11.5% 11.0% 10.6% -0.9 5.5% 5.1%
    Construction 9.4% 10.1% 10.3% +0.9 6.6% 3.6%
    Transportation and warehousing 7.8% 7.9% 7.7% -0.1 4.3% 3.4%
    Accommodation and food services 4.0% 4.2% 3.7% -0.4 2.3% 1.4%

    Average of monthly rates, January to September. Small industries such as agriculture and mining have larger sampling error, so treat year-to-year moves there with caution.

    Remote work by state

    AL10.4%Alabama: 10.4% teleworked in 2025 (4.6% some hours, 5.7% all hours)AK17.4%Alaska: 17.4% teleworked in 2025 (10.2% some hours, 7.2% all hours)AZ25.6%Arizona: 25.6% teleworked in 2025 (12.5% some hours, 13.1% all hours)AR12.1%Arkansas: 12.1% teleworked in 2025 (6.1% some hours, 5.9% all hours)CA24.3%California: 24.3% teleworked in 2025 (13.8% some hours, 10.5% all hours)CO29.5%Colorado: 29.5% teleworked in 2025 (14.5% some hours, 15.0% all hours)CT24.0%Connecticut: 24.0% teleworked in 2025 (13.7% some hours, 10.4% all hours)DE23.6%Delaware: 23.6% teleworked in 2025 (12.8% some hours, 10.9% all hours)DC49.5%District of Columbia: 49.5% teleworked in 2025 (31.2% some hours, 18.3% all hours)FL18.5%Florida: 18.5% teleworked in 2025 (7.4% some hours, 11.1% all hours)GA21.5%Georgia: 21.5% teleworked in 2025 (10.9% some hours, 10.6% all hours)HI15.8%Hawaii: 15.8% teleworked in 2025 (9.5% some hours, 6.3% all hours)ID18.7%Idaho: 18.7% teleworked in 2025 (8.5% some hours, 10.2% all hours)IL26.6%Illinois: 26.6% teleworked in 2025 (15.5% some hours, 11.1% all hours)IN18.0%Indiana: 18.0% teleworked in 2025 (10.2% some hours, 7.8% all hours)IA16.4%Iowa: 16.4% teleworked in 2025 (9.0% some hours, 7.3% all hours)KS19.3%Kansas: 19.3% teleworked in 2025 (11.4% some hours, 7.9% all hours)KY16.2%Kentucky: 16.2% teleworked in 2025 (8.0% some hours, 8.2% all hours)LA13.0%Louisiana: 13.0% teleworked in 2025 (6.1% some hours, 6.9% all hours)ME24.3%Maine: 24.3% teleworked in 2025 (12.6% some hours, 11.8% all hours)MD28.3%Maryland: 28.3% teleworked in 2025 (16.0% some hours, 12.3% all hours)MA31.6%Massachusetts: 31.6% teleworked in 2025 (19.7% some hours, 11.9% all hours)MI21.8%Michigan: 21.8% teleworked in 2025 (12.7% some hours, 9.0% all hours)MN25.2%Minnesota: 25.2% teleworked in 2025 (14.6% some hours, 10.6% all hours)MS8.4%Mississippi: 8.4% teleworked in 2025 (3.5% some hours, 4.8% all hours)MO20.2%Missouri: 20.2% teleworked in 2025 (11.5% some hours, 8.7% all hours)MT20.3%Montana: 20.3% teleworked in 2025 (9.5% some hours, 10.7% all hours)NE18.0%Nebraska: 18.0% teleworked in 2025 (10.1% some hours, 8.0% all hours)NV17.4%Nevada: 17.4% teleworked in 2025 (7.2% some hours, 10.3% all hours)NH25.4%New Hampshire: 25.4% teleworked in 2025 (13.2% some hours, 12.2% all hours)NJ27.5%New Jersey: 27.5% teleworked in 2025 (16.5% some hours, 11.1% all hours)NM17.0%New Mexico: 17.0% teleworked in 2025 (8.6% some hours, 8.5% all hours)NY21.5%New York: 21.5% teleworked in 2025 (12.8% some hours, 8.7% all hours)NC22.8%North Carolina: 22.8% teleworked in 2025 (11.3% some hours, 11.5% all hours)ND13.2%North Dakota: 13.2% teleworked in 2025 (7.1% some hours, 6.1% all hours)OH21.2%Ohio: 21.2% teleworked in 2025 (11.3% some hours, 10.0% all hours)OK14.5%Oklahoma: 14.5% teleworked in 2025 (7.9% some hours, 6.6% all hours)OR29.3%Oregon: 29.3% teleworked in 2025 (14.5% some hours, 14.9% all hours)PA24.4%Pennsylvania: 24.4% teleworked in 2025 (12.4% some hours, 12.0% all hours)RI23.5%Rhode Island: 23.5% teleworked in 2025 (14.0% some hours, 9.5% all hours)SC20.5%South Carolina: 20.5% teleworked in 2025 (9.3% some hours, 11.2% all hours)SD14.9%South Dakota: 14.9% teleworked in 2025 (7.7% some hours, 7.2% all hours)TN19.7%Tennessee: 19.7% teleworked in 2025 (9.0% some hours, 10.7% all hours)TX22.0%Texas: 22.0% teleworked in 2025 (11.0% some hours, 11.0% all hours)UT25.1%Utah: 25.1% teleworked in 2025 (13.2% some hours, 11.9% all hours)VT23.9%Vermont: 23.9% teleworked in 2025 (13.7% some hours, 10.2% all hours)VA28.1%Virginia: 28.1% teleworked in 2025 (14.2% some hours, 13.9% all hours)WA27.6%Washington: 27.6% teleworked in 2025 (14.1% some hours, 13.5% all hours)WV12.4%West Virginia: 12.4% teleworked in 2025 (5.7% some hours, 6.7% all hours)WI23.4%Wisconsin: 23.4% teleworked in 2025 (13.0% some hours, 10.4% all hours)WY14.0%Wyoming: 14.0% teleworked in 2025 (6.7% some hours, 7.3% all hours)

    Share of people at work who teleworked, 2025 annual average (11 months, excluding October). Source: BLS, state telework tables from the CPS.

    BLS publishes state telework figures once a year. In 2025, the District of Columbia led at 49.5%, down from 56.8% in 2024, a drop in line with the timing of the federal return to office. Among states, Massachusetts (31.6%), Colorado (29.5%), and Oregon (29.3%) were highest. 12 states had a rate of 25% or more, and 9 were under 15%, with Mississippi lowest at 8.4%. If you are pricing remote IT support by region, pair this with our IT salaries by state data.

    Rank State 2023 2024 2025 Change since 2023, pts 2025 some hours 2025 all hours People at work, 2025 (thousands)
    1 District of Columbia 56.5% 56.8% 49.5% -7.0 31.2% 18.3% 383
    2 Massachusetts 29.4% 31.4% 31.6% +2.2 19.7% 11.9% 3,614
    3 Colorado 31.7% 32.4% 29.5% -2.2 14.5% 15.0% 2,981
    4 Oregon 26.2% 29.3% 29.3% +3.1 14.5% 14.9% 2,001
    5 Maryland 27.6% 30.4% 28.3% +0.7 16.0% 12.3% 2,942
    6 Virginia 27.3% 28.6% 28.1% +0.8 14.2% 13.9% 4,069
    7 Washington 28.5% 30.8% 27.6% -0.9 14.1% 13.5% 3,683
    8 New Jersey 24.3% 27.1% 27.5% +3.2 16.5% 11.1% 4,463
    9 Illinois 20.9% 26.3% 26.6% +5.7 15.5% 11.1% 6,023
    10 Arizona 23.9% 27.5% 25.6% +1.7 12.5% 13.1% 3,541
    11 New Hampshire 22.4% 26.0% 25.4% +3.0 13.2% 12.2% 717
    12 Minnesota 25.2% 25.9% 25.2% +0.0 14.6% 10.6% 2,886
    13 Utah 21.8% 26.8% 25.1% +3.3 13.2% 11.9% 1,722
    14 Pennsylvania 21.1% 23.8% 24.4% +3.3 12.4% 12.0% 6,044
    15 California 22.6% 25.5% 24.3% +1.7 13.8% 10.5% 18,137
    16 Maine 21.7% 23.5% 24.3% +2.6 12.6% 11.8% 663
    17 Connecticut 25.1% 25.2% 24.0% -1.1 13.7% 10.4% 1,755
    18 Vermont 22.7% 26.3% 23.9% +1.2 13.7% 10.2% 322
    19 Delaware 20.6% 22.4% 23.6% +3.0 12.8% 10.9% 472
    20 Rhode Island 19.2% 23.4% 23.5% +4.3 14.0% 9.5% 532
    21 Wisconsin 16.5% 21.9% 23.4% +6.9 13.0% 10.4% 2,911
    22 North Carolina 18.5% 22.0% 22.8% +4.3 11.3% 11.5% 4,977
    23 Texas 18.4% 22.5% 22.0% +3.6 11.0% 11.0% 14,707
    24 Michigan 20.5% 21.2% 21.8% +1.3 12.7% 9.0% 4,583
    25 Georgia 17.8% 22.3% 21.5% +3.7 10.9% 10.6% 5,062
    26 New York 19.3% 21.2% 21.5% +2.2 12.8% 8.7% 9,206
    27 Ohio 18.7% 21.3% 21.2% +2.5 11.3% 10.0% 5,425
    28 South Carolina 14.1% 18.2% 20.5% +6.4 9.3% 11.2% 2,475
    29 Montana 16.0% 20.6% 20.3% +4.3 9.5% 10.7% 536
    30 Missouri 16.9% 21.8% 20.2% +3.3 11.5% 8.7% 2,956
    31 Tennessee 15.3% 19.5% 19.7% +4.4 9.0% 10.7% 3,291
    32 Kansas 16.4% 20.3% 19.3% +2.9 11.4% 7.9% 1,467
    33 Idaho 15.1% 19.7% 18.7% +3.6 8.5% 10.2% 942
    34 Florida 15.3% 19.0% 18.5% +3.2 7.4% 11.1% 10,482
    35 Indiana 14.8% 18.2% 18.0% +3.2 10.2% 7.8% 3,277
    36 Nebraska 17.2% 18.2% 18.0% +0.8 10.1% 8.0% 1,037
    37 Alaska 13.9% 16.8% 17.4% +3.5 10.2% 7.2% 329
    38 Nevada 13.1% 16.1% 17.4% +4.3 7.2% 10.3% 1,561
    39 New Mexico 13.0% 17.4% 17.0% +4.0 8.6% 8.5% 907
    40 Iowa 12.2% 15.7% 16.4% +4.2 9.0% 7.3% 1,606
    41 Kentucky 13.2% 15.6% 16.2% +3.0 8.0% 8.2% 1,945
    42 Hawaii 12.8% 15.8% 15.8% +3.0 9.5% 6.3% 638
    43 South Dakota 9.4% 14.6% 14.9% +5.5 7.7% 7.2% 459
    44 Oklahoma 11.0% 14.7% 14.5% +3.5 7.9% 6.6% 1,879
    45 Wyoming 10.2% 13.5% 14.0% +3.8 6.7% 7.3% 266
    46 North Dakota 11.3% 14.3% 13.2% +1.9 7.1% 6.1% 409
    47 Louisiana 9.5% 12.8% 13.0% +3.5 6.1% 6.9% 1,923
    48 West Virginia 9.4% 12.3% 12.4% +3.0 5.7% 6.7% 729
    49 Arkansas 9.0% 11.6% 12.1% +3.1 6.1% 5.9% 1,333
    50 Alabama 7.7% 10.7% 10.4% +2.7 4.6% 5.7% 2,270
    51 Mississippi 4.7% 7.3% 8.4% +3.7 3.5% 4.8% 1,201
    United States 19.7% 22.8% 22.4% +2.7 11.9% 10.5% 157,736

    Remote work compared with before the pandemic

    The CPS telework questions only start in October 2022, so for a pre-pandemic baseline we use the American Time Use Survey, which asks where people did their work on the diary day. Its measure is broader (any work done at home on a day worked, including a few evening hours), so its levels run higher than the CPS rate. The trend is what counts: the share of employed people doing some work at home on days they worked rose from 18.6% in 2003 to 23.7% in 2019, jumped to 38.1% in 2021, and was 34.5% in 2025. That is 10.8 points above 2019, with no sign of a return to the old level. Among workers with a bachelor’s degree or higher, it was 51.4% in 2025 against 37.2% in 2019.

    ATUS year 2003 2010 2015 2019 2021 2022 2023 2024 2025
    Worked at home on days worked 18.6% 23.6% 24.1% 23.7% 38.1% 33.8% 34.6% 32.5% 34.5%

    Share of employed people who did some or all of their work at home on days they worked, annual averages. The BLS series has no 2020 value.

    What this means for MSPs

    Plan for a stable remote base, not a return to the office. 34.7 million people teleworked in Sep 2026. The fully remote share has stayed between 10% and 11% since 2023, so roughly 1 in 10 client users will rarely, if ever, sit on a client’s office network. Patching, backup, and device compliance for those users have to work over the internet, through cloud management, without depending on a VPN connection that a laptop may never open.

    Hybrid is where the growth came from, and it is harder to secure. The 11.5% who telework some hours carry the same device between home and office networks. That argues for identity and device-health checks at sign-in rather than trust based on network location, and for tracking which client devices have not checked in from any network recently. Remote access gateways remain a target: in our coding of CISA ransomware advisories, exploits of public-facing applications appeared in 73% of them, which is why VPN and remote desktop appliances belong at the top of any patch priority list.

    Read your client mix against the industry table. A roster of accounting, insurance, legal, and professional services firms is dealing with telework rates above 50%, where remote help desk sessions, home network issues, and collaboration tooling dominate tickets. A roster of contractors, manufacturers, and retailers has rates near 10% to 20%, where on-site support and shared devices matter more. The same per-seat price can hide very different support loads.

    Government clients changed fastest. If you support federal agencies or contractors, the fall from 33.9% to 17.4% means more people back on office networks, more strain on office Wi-Fi and conference rooms, and less on remote access capacity. State government telework did not follow; it is at 24.8%.

    Frequently asked questions

    What percentage of Americans work remotely in 2026?

    In an average month from January to September 2026, 22.1% of people at work teleworked or worked at home for pay for at least part of the survey week, according to the BLS Current Population Survey. In Sep 2026 that was 21.9%, or 34.7 million people.

    Is remote work going away in 2026?

    No. The telework rate for January to September 2026 (22.1%) is only 0.5 points below the same months of 2024 (22.6%), and most of that drop came from federal employees. In the American Time Use Survey, 34.5% of employed people did some work at home on days they worked in 2025, against 23.7% in 2019.

    What percentage of jobs are 100% remote?

    BLS does not classify jobs as remote, but it does count people who teleworked all of their hours in the survey week: 10.6% of people at work in January to September 2026, a little under half of everyone who teleworked. Another 11.5% teleworked some of their hours.

    How rare is it to have a fully remote job?

    About 1 in 9 workers teleworked every hour they worked in an average month of 2026. It is far more common in some fields: 35.2% of people in computer and mathematical occupations teleworked all hours, against under 1% in food preparation and serving.

    Which jobs have the most remote workers?

    Computer and mathematical (62.0%), business and financial operations (54.3%), and legal (52.8%) had the highest telework rates in January to September 2026. Food preparation and serving related had the lowest, at 1.1%.

    Which state has the most remote workers?

    In 2025, the District of Columbia had the highest telework rate (49.5%). Among the 50 states, Massachusetts led at 31.6%, followed by Colorado (29.5%) and Oregon (29.3%). Mississippi was lowest at 8.4%.

    Download the data. bls-telework-statistics-2022-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Sources. U.S. Bureau of Labor Statistics: Current Population Survey (CPS) telework series from the LN time-series database flat files, using the series IDs BLS lists in its monthly telework series workbook (tables 1 and 2); state telework tables for 2023, 2024, and 2025 annual averages; and the American Time Use Survey (ATUS) work-at-home series (TU database). All retrieved October 2026. The CPS data run from Oct 2022 to Sep 2026, the latest month published at retrieval.

    Definitions. A person teleworked if they teleworked or worked at home for pay at any time during the survey reference week, generally the week containing the 12th of the month. The rate is the share of people at work that week (employed people absent all week are excluded). Some hours means they teleworked part of their work hours; all hours means every hour. We call some hours “hybrid” and all hours “fully remote” for readability; BLS does not ask about formal remote or hybrid arrangements.

    Comparisons. The data are not seasonally adjusted, so years are compared on the same months (January to September), using the average of the monthly rates. Class-of-worker rates and the decomposition divide summed telework counts by summed people at work for those months. The decomposition splits the national change into within-group rate changes weighted by average group share, plus shifts in group shares; the two parts sum to the total. BLS introduces updated population controls each January, which can shift counts, so we compare rates rather than levels across years.

    Missing data. Oct 2025 CPS data were not collected because of the federal government shutdown, according to BLS. That month is blank in the charts, and BLS’s 2025 state averages cover 11 months. As a check, the 11-month average of the national monthly rates for 2025 is 22.4%, matching the 22.4% BLS published in the state table.

    Limitations. CPS estimates for small occupation and industry groups are based on fewer survey responses and can swing month to month. The ATUS measure counts any work at home on a diary day and is not comparable in level with the CPS rate. ATUS also lost diaries from September 30 to November 11, 2025 during the shutdown; BLS reweighted the remaining fourth-quarter diaries and says the effect on 2025 estimates cannot be quantified. Federal policy dates come from the White House memorandum; we do not attribute the federal decline to any single agency action beyond what the timing shows.

    Not advice. This is an analysis of public labor statistics, not workforce, legal, or security advice for any organization.

    Cite as:The Uptime Report. "Remote Work Statistics 2026: Telework Is Holding at 22%, and the Federal Return to Office Explains Most of the Dip." October 2026. https://theuptimereport.com/remote-work-statistics-2026/

    References

    1. BLS, Telework or work at home for pay (CPS). Accessed October 2026.
    2. BLS, Time series codes for monthly telework data (XLSX). Accessed October 2026.
    3. BLS, Labor Force Statistics (LN) time-series database files. Accessed October 2026.
    4. BLS, Table A-41: People at work by telework status and selected characteristics. Accessed October 2026.
    5. BLS, Table A-42: People at work by telework status, occupation, industry, and class of worker. Accessed October 2026.
    6. BLS, Additional state data from the CPS: state telework tables, 2023 to 2025. Accessed October 2026.
    7. BLS, American Time Use Survey (TU) time-series database files. Accessed October 2026.
    8. BLS, American Time Use Survey: 2025 Results. Accessed October 2026.
    9. The White House, Return to In-Person Work (presidential memorandum, January 20, 2025). Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • IT Spending by Industry: Business IT Investment Reached $1.19 Trillion in 2025, and Finance Grew It Fastest

    Uptime Report Research · Government Accounts Data

    IT Spending by Industry: Business IT Investment Reached $1.19 Trillion in 2025, and Finance Grew It Fastest

    IT spending by industry, measured as investment in computers, software, and communications equipment, totaled $1.19 trillion across U.S. private industries in 2025, or 2.53% of their gross output, up from 1.88% in 2015. Information firms invest the most relative to output (14.3%), followed by finance and insurance (5.5%), which also grew its IT investment fastest.

    $1.19Tprivate IT investment in 2025, up 19% on 2024
    2.53%of gross output went to IT in 2025, vs 1.88% in 2015
    14.3%information sector, the most IT-intensive
    +179%finance and insurance IT investment, 2015 to 2025, the fastest sector
    63%software share of IT investment, down from a 69% peak in 2023

    Most published figures on IT spending by industry come from paid analyst surveys. This report uses the U.S. government’s own national accounts instead. We downloaded the Bureau of Economic Analysis (BEA) detailed estimates of private nonresidential investment for 74 industries and more than 90 asset types, kept the IT assets (computers and peripherals, three kinds of software, and communications equipment), and divided each industry’s total by its gross output from BEA’s GDP by Industry accounts. Both files were published by BEA on September 30, 2026 and run through 2025.

    IT intensity by industry, 2015 vs 2025

    14 of 19 sectors put a larger share of their output into IT in 2025 than in 2015. Information moved from 10.2% to 14.3%, and finance and insurance from 3.4% to 5.5%. The ratio fell in 5 sectors (mining, construction, educational services, health care and social assistance, and other services), where IT investment grew more slowly than output.

    share rose share fell

    0.1%0.25%0.5%1%2.5%5%10%20152025Agriculture: IT investment 0.06% of gross output in 2015, 0.08% in 2025 ($0.5B in 2025)Agriculture 0.06%0.08% AgricultureMining: IT investment 0.43% of gross output in 2015, 0.24% in 2025 ($1.7B in 2025)Mining 0.43%0.24% MiningUtilities: IT investment 2.17% of gross output in 2015, 3.74% in 2025 ($25.6B in 2025)Utilities 2.17%3.74% UtilitiesConstruction: IT investment 0.29% of gross output in 2015, 0.25% in 2025 ($6.5B in 2025)Construction 0.29%0.25% ConstructionManufacturing: IT investment 0.77% of gross output in 2015, 0.79% in 2025 ($57.3B in 2025)Manufacturing 0.77%0.79% ManufacturingWholesale trade: IT investment 1.44% of gross output in 2015, 1.71% in 2025 ($53.2B in 2025)Wholesale trade 1.44%1.71% Wholesale tradeRetail trade: IT investment 1.78% of gross output in 2015, 2.52% in 2025 ($74.1B in 2025)Retail trade 1.78%2.52% Retail tradeTransportation and warehousing: IT investment 1.14% of gross output in 2015, 1.19% in 2025 ($23.1B in 2025)Transportation and warehousing 1.14%1.19% Transportation and warehousingInformation: IT investment 10.18% of gross output in 2015, 14.28% in 2025 ($411.8B in 2025)Information 10.18%14.28% InformationFinance and insurance: IT investment 3.36% of gross output in 2015, 5.52% in 2025 ($241.8B in 2025)Finance and insurance 3.36%5.52% Finance and insuranceReal estate and leasing: IT investment 1.12% of gross output in 2015, 1.34% in 2025 ($35.2B in 2025)Real estate and leasing 1.12%1.34% Real estate and leasingProfessional and technical services: IT investment 2.48% of gross output in 2015, 2.76% in 2025 ($100.8B in 2025)Professional and technical services 2.48%2.76% Professional and technical servicesManagement of companies: IT investment 4.36% of gross output in 2015, 4.45% in 2025 ($39.0B in 2025)Management of companies 4.36%4.45% Management of companiesAdministrative and waste services: IT investment 2.94% of gross output in 2015, 3.32% in 2025 ($51.7B in 2025)Administrative and waste services 2.94%3.32% Administrative and waste servicesEducational services: IT investment 2.67% of gross output in 2015, 2.05% in 2025 ($10.3B in 2025)Educational services 2.67%2.05% Educational servicesHealth care and social assistance: IT investment 0.78% of gross output in 2015, 0.73% in 2025 ($28.2B in 2025)Health care and social assistance 0.78%0.73% Health care and social assistanceArts and recreation: IT investment 1.28% of gross output in 2015, 1.29% in 2025 ($7.7B in 2025)Arts and recreation 1.28%1.29% Arts and recreationAccommodation and food services: IT investment 0.43% of gross output in 2015, 0.46% in 2025 ($8.4B in 2025)Accommodation and food services 0.43%0.46% Accommodation and food servicesOther services: IT investment 1.41% of gross output in 2015, 1.38% in 2025 ($15.2B in 2025)Other services 1.41%1.38% Other services

    IT investment (computers and peripherals, software, communications equipment) as a percent of each sector’s gross output, current dollars, log scale. Real estate excludes housing. Source: BEA Fixed Assets detailed estimates and GDP by Industry; Uptime Report analysis.

    Who spends the most on IT, in dollars

    In dollar terms the list is led by information ($411.8B), finance and insurance ($241.8B), and professional and technical services ($100.8B). Information and finance together account for 55% of all private IT investment, while producing 15% of private gross output. Manufacturing is the largest sector by output but spends 0.79% of it on IT; IT is only 7% of the sector’s nonresidential investment, against 53% for research and development and 27% for non-IT equipment.

    Sector IT investment 2025 % of output 2015 % of output 2025 Change in $ 2015 to 2025 Per FTE employee 2025 Software share IT share of all capex
    Information $411.8B 10.18% 14.28% +155% $152,914 49% 55%
    Finance and insurance $241.8B 3.36% 5.52% +179% $36,541 72% 60%
    Management of companies $39.0B 4.36% 4.45% +65% $15,844 77% 72%
    Utilities $25.6B 2.17% 3.74% +139% $43,027 73% 8%
    Administrative and waste services $51.7B 2.94% 3.32% +95% $6,170 82% 53%
    Professional and technical services $100.8B 2.48% 2.76% +104% $9,746 72% 34%
    Retail trade $74.1B 1.78% 2.52% +147% $5,424 58% 32%
    Educational services $10.3B 2.67% 2.05% +14% $2,808 67% 18%
    Wholesale trade $53.2B 1.44% 1.71% +94% $9,050 69% 35%
    Other services $15.2B 1.41% 1.38% +66% $2,478 69% 23%
    Real estate and leasing $35.2B 1.12% 1.34% +111% $15,012 52% 16%
    Arts and recreation $7.7B 1.28% 1.29% +93% $3,564 52% 11%
    Transportation and warehousing $23.1B 1.14% 1.19% +78% $3,591 71% 14%
    Manufacturing $57.3B 0.77% 0.79% +32% $4,659 72% 7%
    Health care and social assistance $28.2B 0.78% 0.73% +66% $1,329 74% 12%
    Accommodation and food services $8.4B 0.43% 0.46% +99% $743 69% 15%
    Construction $6.5B 0.29% 0.25% +62% $797 74% 7%
    Mining $1.7B 0.43% 0.24% -18% $3,005 75% 1%
    Agriculture $0.5B 0.06% 0.08% +95% $435 81% 1%
    All private industries $1,192.2B 1.88% 2.53% +121% $9,452 63% 28%

    Sorted by IT investment as a percent of gross output in 2025. Per FTE uses BEA full-time equivalent employees by industry (NIPA Table 6.5D). “IT share of all capex” is IT investment divided by all private nonresidential fixed investment (equipment, structures, and intellectual property) in the sector.

    The 25 most IT-intensive industries

    At a finer level the leaders are the industries that sell digital services. Data processing, hosting, and other information services invested 23.5% of its gross output in IT in 2025, up from 17.9% in 2015, and its share of all private IT investment rose from 10% to 20%. Banks and credit intermediation (7.2%) and securities and investments (6.7%) are the most IT-intensive industries outside the information sector.

    Information Finance and insurance Other sectors 2015 level

    0%5%10%15%20%Data processing, hosting, and other information services (Information): 23.51% of gross output in 2025, 17.94% in 2015; $235.9B IT investmentData processing, hosting, and other information services23.5%Broadcasting and telecommunications (Information): 12.34% of gross output in 2025, 11.12% in 2015; $116.6B IT investmentBroadcasting and telecommunications12.3%Publishing, including software (Information): 7.86% of gross output in 2025, 4.84% in 2015; $56.9B IT investmentPublishing, including software7.9%Banks and credit intermediation (Finance and insurance): 7.22% of gross output in 2025, 4.02% in 2015; $106.4B IT investmentBanks and credit intermediation7.2%Securities and investments (Finance and insurance): 6.65% of gross output in 2025, 3.22% in 2015; $68.9B IT investmentSecurities and investments6.7%General merchandise stores (Retail trade): 5.90% of gross output in 2025, 3.33% in 2015; $18.6B IT investmentGeneral merchandise stores5.9%Computer systems design (Professional and technical services): 5.61% of gross output in 2025, 3.45% in 2015; $43.9B IT investmentComputer systems design5.6%Water transportation (Transportation and warehousing): 4.75% of gross output in 2025, 3.92% in 2015; $3.7B IT investmentWater transportation4.8%Management of companies (Management of companies): 4.45% of gross output in 2025, 4.36% in 2015; $39.0B IT investmentManagement of companies4.4%Insurance carriers and related (Finance and insurance): 3.84% of gross output in 2025, 3.34% in 2015; $61.9B IT investmentInsurance carriers and related3.8%Utilities (Utilities): 3.74% of gross output in 2025, 2.17% in 2015; $25.6B IT investmentUtilities3.7%Administrative and support services (Administrative and waste services): 3.74% of gross output in 2025, 3.24% in 2015; $51.2B IT investmentAdministrative and support services3.7%Computer and electronic products (Manufacturing): 2.98% of gross output in 2025, 3.53% in 2015; $13.3B IT investmentComputer and electronic products3.0%Other retail (Retail trade): 2.69% of gross output in 2025, 2.03% in 2015; $45.7B IT investmentOther retail2.7%Other transportation and support (Transportation and warehousing): 2.31% of gross output in 2025, 1.61% in 2015; $8.5B IT investmentOther transportation and support2.3%Other professional and technical services (Professional and technical services): 2.28% of gross output in 2025, 2.52% in 2015; $53.2B IT investmentOther professional and technical services2.3%Rental and leasing (Real estate and leasing): 2.15% of gross output in 2025, 2.22% in 2015; $14.1B IT investmentRental and leasing2.2%Miscellaneous manufacturing (incl. medical) (Manufacturing): 2.09% of gross output in 2025, 1.49% in 2015; $3.8B IT investmentMiscellaneous manufacturing (incl. medical)2.1%Educational services (Educational services): 2.05% of gross output in 2025, 2.67% in 2015; $10.3B IT investmentEducational services2.1%Funds, trusts, and other financial vehicles (Finance and insurance): 1.78% of gross output in 2025, 0.35% in 2015; $4.7B IT investmentFunds, trusts, and other financial vehicles1.8%Amusement, gambling, and recreation (Arts and recreation): 1.72% of gross output in 2025, 1.45% in 2015; $4.6B IT investmentAmusement, gambling, and recreation1.7%Wholesale trade (Wholesale trade): 1.71% of gross output in 2025, 1.44% in 2015; $53.2B IT investmentWholesale trade1.7%Food and beverage stores (Retail trade): 1.64% of gross output in 2025, 1.05% in 2015; $5.9B IT investmentFood and beverage stores1.6%Rail transportation (Transportation and warehousing): 1.57% of gross output in 2025, 1.95% in 2015; $1.5B IT investmentRail transportation1.6%Printing (Manufacturing): 1.54% of gross output in 2025, 1.29% in 2015; $1.3B IT investmentPrinting1.5%

    IT investment as a percent of gross output, 2025, for the 25 highest of 65 detailed industries. Red ticks mark the 2015 ratio.

    The ownership rule matters here. BEA records assets in the industry that owns them, and assets under operating leases sit with the lessor rather than the user. Servers that a cloud provider owns and sells computing time on are therefore counted in the provider’s industry, not the customer’s. When firms move workloads to the cloud, their own IT investment can fall while the hosting industry’s rises, even if they use more computing. The growth in the data processing industry’s share of IT investment fits that pattern, though the BEA data cannot show how much of it comes from cloud migration.

    Fastest-growing IT investment

    From 2015 to 2025, private IT investment rose 121% in current dollars, from $538.7B to $1,192.2B. The fastest sectors were finance and insurance (+179%), information (+155%), retail trade (+147%), and utilities (+139%). Among detailed industries with at least $20 billion of IT investment in 2025, the fastest growth was in data processing, hosting, and other information services (+353%), securities and investments (+294%), publishing, including software (+257%). Mining was the only sector where IT investment fell in dollars, down 18%.

    Excluding the information sector, IT investment went from 1.39% of gross output in 2015 to 1.77% in 2025. The rest of the economy is spending more on IT relative to its output, but more slowly than the digital industries. This is investment by IT buyers. For the revenue of the firms that sell IT services, see our report on IT services industry growth, which tracks Census data on computer services revenue.

    Hardware vs software: the 2025 break

    Computers and peripherals Software Communications equipment  Labels: software share of the year’s total

    $0B$250B$500B$750B$1,000B$1,250B2005: Computers $81.6B2005: Software $178.6B2005: Communications $86.5B52%20052006: Computers $89.7B2006: Software $189.5B2006: Communications $96.0B2007: Computers $92.4B2007: Software $206.4B2007: Communications $106.2B2008: Computers $90.6B2008: Software $223.8B2008: Communications $100.1B2009: Computers $85.6B2009: Software $226.0B2009: Communications $85.8B2010: Computers $95.6B2010: Software $226.4B2010: Communications $99.9B54%20102011: Computers $91.4B2011: Software $249.8B2011: Communications $103.6B2012: Computers $98.7B2012: Software $272.1B2012: Communications $104.8B2013: Computers $97.5B2013: Software $285.6B2013: Communications $113.8B2014: Computers $97.4B2014: Software $303.6B2014: Communications $118.7B2015: Computers $96.8B2015: Software $316.1B2015: Communications $125.8B59%20152016: Computers $95.0B2016: Software $347.8B2016: Communications $129.4B2017: Computers $101.1B2017: Software $382.7B2017: Communications $138.8B2018: Computers $115.1B2018: Software $422.8B2018: Communications $133.9B2019: Computers $113.6B2019: Software $447.4B2019: Communications $128.7B2020: Computers $121.1B2020: Software $478.2B2020: Communications $121.6B66%20202021: Computers $141.5B2021: Software $533.1B2021: Communications $132.0B2022: Computers $154.6B2022: Software $601.0B2022: Communications $147.4B2023: Computers $142.6B2023: Software $638.0B2023: Communications $145.2B2024: Computers $173.8B2024: Software $686.0B2024: Communications $143.3B2025: Computers $270.9B2025: Software $751.3B2025: Communications $169.9B63%2025

    U.S. private nonresidential IT investment by type, current dollars, summed across 74 BEA industries.

    Software has been the bulk of business IT investment for two decades. Its share rose from 52% in 2005 to 59% in 2015 and a peak of 68.9% in 2023. Between 2015 and 2024, software investment grew 117% while computers and peripherals grew 80% and communications equipment 14%.

    2025 broke the pattern. Investment in computers and peripherals jumped 56% in a single year, the largest percentage rise since 1963, from $173.8B to $270.9B, against 10% growth for software, so the software share fell to 63.0%. BEA’s detail spreads that $97.1B hardware increase widely: the largest gains were in data processing, hosting, and other information services ($24.9B), banks and credit intermediation ($17.0B), and computer systems design ($7.4B). Treat that industry split with care: BEA says its detailed estimates are more likely than the published totals to rest on judgmental trends or on trends in the higher-level aggregate.

    Inside software, prepackaged software grew fastest: from $126.9B in 2015 to $372.4B in 2025 (+193%), against +114% for custom software and +70% for software firms build for their own use. Prepackaged software is now 50% of software investment, up from 40% in 2015.

    What each industry buys

    Computers and peripheralsPrepackaged softwareCustom softwareOwn-account softwareCommunications equipment

    All private industriesAll private industries: Computers and peripherals 23% ($270.9B)23%All private industries: Prepackaged software 31% ($372.4B)31%All private industries: Custom software 23% ($279.1B)23%All private industries: Own-account software 8% ($99.9B)8%All private industries: Communications equipment 14% ($169.9B)14%Administrative and waste servicesAdministrative and waste services: Computers and peripherals 15% ($8.0B)15%Administrative and waste services: Prepackaged software 35% ($18.1B)35%Administrative and waste services: Custom software 26% ($13.5B)26%Administrative and waste services: Own-account software 21% ($11.1B)21%Administrative and waste services: Communications equipment 2% ($1.1B)AgricultureAgriculture: Computers and peripherals 14% ($0.1B)14%Agriculture: Prepackaged software 55% ($0.3B)55%Agriculture: Custom software 26% ($0.1B)26%Agriculture: Own-account software 0% ($0.0B)Agriculture: Communications equipment 5% ($0.0B)Management of companiesManagement of companies: Computers and peripherals 16% ($6.4B)16%Management of companies: Prepackaged software 30% ($11.8B)30%Management of companies: Custom software 22% ($8.7B)22%Management of companies: Own-account software 25% ($9.6B)25%Management of companies: Communications equipment 6% ($2.5B)6%MiningMining: Computers and peripherals 18% ($0.3B)18%Mining: Prepackaged software 41% ($0.7B)41%Mining: Custom software 31% ($0.5B)31%Mining: Own-account software 3% ($0.1B)Mining: Communications equipment 7% ($0.1B)7%ConstructionConstruction: Computers and peripherals 20% ($1.3B)20%Construction: Prepackaged software 38% ($2.5B)38%Construction: Custom software 28% ($1.8B)28%Construction: Own-account software 8% ($0.5B)8%Construction: Communications equipment 6% ($0.4B)Health care and social assistanceHealth care and social assistance: Computers and peripherals 21% ($5.9B)21%Health care and social assistance: Prepackaged software 40% ($11.3B)40%Health care and social assistance: Custom software 30% ($8.4B)30%Health care and social assistance: Own-account software 4% ($1.1B)Health care and social assistance: Communications equipment 5% ($1.5B)UtilitiesUtilities: Computers and peripherals 15% ($3.9B)15%Utilities: Prepackaged software 41% ($10.5B)41%Utilities: Custom software 30% ($7.8B)30%Utilities: Own-account software 2% ($0.5B)Utilities: Communications equipment 12% ($3.0B)12%Finance and insuranceFinance and insurance: Computers and peripherals 24% ($58.7B)24%Finance and insurance: Prepackaged software 41% ($99.7B)41%Finance and insurance: Custom software 26% ($62.4B)26%Finance and insurance: Own-account software 5% ($13.1B)Finance and insurance: Communications equipment 3% ($7.8B)ManufacturingManufacturing: Computers and peripherals 19% ($10.7B)19%Manufacturing: Prepackaged software 39% ($22.3B)39%Manufacturing: Custom software 29% ($16.6B)29%Manufacturing: Own-account software 4% ($2.5B)Manufacturing: Communications equipment 9% ($5.1B)9%Professional and technical servicesProfessional and technical services: Computers and peripherals 24% ($23.7B)24%Professional and technical services: Prepackaged software 28% ($27.9B)28%Professional and technical services: Custom software 35% ($35.2B)35%Professional and technical services: Own-account software 9% ($9.2B)9%Professional and technical services: Communications equipment 5% ($4.8B)Transportation and warehousingTransportation and warehousing: Computers and peripherals 20% ($4.6B)20%Transportation and warehousing: Prepackaged software 37% ($8.6B)37%Transportation and warehousing: Custom software 28% ($6.4B)28%Transportation and warehousing: Own-account software 6% ($1.4B)Transportation and warehousing: Communications equipment 9% ($2.0B)9%Other servicesOther services: Computers and peripherals 19% ($2.9B)19%Other services: Prepackaged software 35% ($5.4B)35%Other services: Custom software 26% ($4.0B)26%Other services: Own-account software 8% ($1.2B)8%Other services: Communications equipment 11% ($1.7B)11%Wholesale tradeWholesale trade: Computers and peripherals 27% ($14.2B)27%Wholesale trade: Prepackaged software 33% ($17.6B)33%Wholesale trade: Custom software 25% ($13.1B)25%Wholesale trade: Own-account software 11% ($5.9B)11%Wholesale trade: Communications equipment 4% ($2.3B)Accommodation and food servicesAccommodation and food services: Computers and peripherals 25% ($2.1B)25%Accommodation and food services: Prepackaged software 39% ($3.3B)39%Accommodation and food services: Custom software 29% ($2.5B)29%Accommodation and food services: Own-account software 0% ($0.0B)Accommodation and food services: Communications equipment 6% ($0.5B)6%Educational servicesEducational services: Computers and peripherals 21% ($2.1B)21%Educational services: Prepackaged software 24% ($2.5B)24%Educational services: Custom software 18% ($1.9B)18%Educational services: Own-account software 24% ($2.5B)24%Educational services: Communications equipment 12% ($1.3B)12%Retail tradeRetail trade: Computers and peripherals 21% ($15.9B)21%Retail trade: Prepackaged software 40% ($29.6B)40%Retail trade: Custom software 14% ($10.2B)14%Retail trade: Own-account software 5% ($3.4B)Retail trade: Communications equipment 20% ($15.0B)20%Real estate and leasingReal estate and leasing: Computers and peripherals 41% ($14.4B)41%Real estate and leasing: Prepackaged software 35% ($12.3B)35%Real estate and leasing: Custom software 14% ($4.8B)14%Real estate and leasing: Own-account software 4% ($1.3B)Real estate and leasing: Communications equipment 7% ($2.4B)7%Arts and recreationArts and recreation: Computers and peripherals 19% ($1.5B)19%Arts and recreation: Prepackaged software 29% ($2.2B)29%Arts and recreation: Custom software 21% ($1.7B)21%Arts and recreation: Own-account software 2% ($0.2B)Arts and recreation: Communications equipment 28% ($2.2B)28%InformationInformation: Computers and peripherals 23% ($94.2B)23%Information: Prepackaged software 21% ($85.7B)21%Information: Custom software 19% ($79.5B)19%Information: Own-account software 9% ($36.4B)9%Information: Communications equipment 28% ($116.1B)28%

    Share of each sector’s 2025 IT investment by asset type. Sorted by total software share.

    15 of 19 sectors spend between 65% and 85% of their IT investment on software. Information is the main exception: communications equipment is 28% of the sector’s IT investment, and broadcasting and telecommunications firms account for 76% of that. Real estate and leasing has the highest computer share (41%). It includes rental and leasing firms, which under BEA’s ownership rule hold the equipment they lease to other industries; computers are 47% of their IT investment. Software’s share rose between 2015 and 2025 in 14 of 19 sectors.

    What this measure is

    Capital investment: purchases of computers, storage, servers, and communications gear, plus software licenses, custom software development, and in-house software that BEA records as long-lived assets. Gross output is BEA’s measure of an industry’s production, principally sales or receipts, so the ratio works as an IT capital budget as a share of revenue.

    What it leaves out

    Operating IT spending: IT staff salaries (except those building own-account software), managed services and outsourcing fees, cloud and SaaS subscriptions, telecom service bills, and maintenance contracts. Avasant’s benchmark, the top search result, defines IT spending as a percent of revenue as IT operating spending including depreciation, from a company survey. The two ratios are not interchangeable.

    Every industry, 2015 and 2025

    Industry Sector IT investment 2025 IT investment 2015 Change % of output 2015 % of output 2025 Software share 2025 IT share of all capex 2025
    Data processing, hosting, and other information services Information $235.9B $52.1B +353% 17.94% 23.51% 61% 71%
    Broadcasting and telecommunications Information $116.6B $91.7B +27% 11.12% 12.34% 19% 55%
    Publishing, including software Information $56.9B $15.9B +257% 4.84% 7.86% 62% 37%
    Banks and credit intermediation Finance and insurance $106.4B $36.5B +192% 4.02% 7.22% 66% 49%
    Securities and investments Finance and insurance $68.9B $17.5B +294% 3.22% 6.65% 74% 80%
    General merchandise stores Retail trade $18.6B $7.6B +144% 3.33% 5.90% 57% 41%
    Computer systems design Professional and technical services $43.9B $13.8B +218% 3.45% 5.61% 63% 54%
    Water transportation Transportation and warehousing $3.7B $2.0B +83% 3.92% 4.75% 96% 45%
    Management of companies Management of companies $39.0B $23.6B +65% 4.36% 4.45% 77% 72%
    Insurance carriers and related Finance and insurance $61.9B $32.2B +92% 3.34% 3.84% 81% 70%
    Utilities Utilities $25.6B $10.7B +139% 2.17% 3.74% 73% 8%
    Administrative and support services Administrative and waste services $51.2B $26.2B +95% 3.24% 3.74% 83% 62%
    Computer and electronic products Manufacturing $13.3B $12.3B +9% 3.53% 2.98% 54% 8%
    Other retail Retail trade $45.7B $18.6B +145% 2.03% 2.69% 57% 34%
    Other transportation and support Transportation and warehousing $8.5B $3.6B +139% 1.61% 2.31% 59% 27%
    Other professional and technical services Professional and technical services $53.2B $31.8B +67% 2.52% 2.28% 80% 25%
    Rental and leasing Real estate and leasing $14.1B $7.5B +89% 2.22% 2.15% 43% 15%
    Miscellaneous manufacturing (incl. medical) Manufacturing $3.8B $2.5B +54% 1.49% 2.09% 85% 14%
    Educational services Educational services $10.3B $9.1B +14% 2.67% 2.05% 67% 18%
    Funds, trusts, and other financial vehicles Finance and insurance $4.7B $0.6B +710% 0.35% 1.78% 86% 37%
    Amusement, gambling, and recreation Arts and recreation $4.6B $2.0B +129% 1.45% 1.72% 52% 14%
    Wholesale trade Wholesale trade $53.2B $27.3B +94% 1.44% 1.71% 69% 35%
    Food and beverage stores Retail trade $5.9B $2.4B +144% 1.05% 1.64% 70% 22%
    Rail transportation Transportation and warehousing $1.5B $1.6B -10% 1.95% 1.57% 83% 8%
    Printing Manufacturing $1.3B $1.1B +27% 1.29% 1.54% 70% 25%
    Other services Other services $15.2B $9.2B +66% 1.41% 1.38% 69% 23%
    Hospitals Health care and social assistance $16.7B $9.9B +68% 1.26% 1.23% 78% 12%
    Apparel and leather Manufacturing $0.3B $0.3B +10% 1.49% 1.22% 57% 21%
    Textile mills Manufacturing $0.6B $0.3B +122% 0.48% 1.15% 71% 11%
    Motion picture and sound recording Information $2.4B $1.8B +30% 1.27% 1.12% 52% 4%
    Warehousing and storage Transportation and warehousing $2.2B $0.8B +183% 0.71% 1.10% 78% 18%
    Chemical products Manufacturing $11.1B $8.0B +38% 1.03% 1.07% 78% 5%
    Real estate (nonresidential) Real estate and leasing $21.1B $9.2B +129% 0.80% 1.07% 58% 17%
    Performing arts and spectator sports Arts and recreation $3.2B $2.0B +58% 1.15% 0.95% 52% 9%
    Air transportation Transportation and warehousing $3.1B $1.9B +61% 0.86% 0.88% 71% 10%
    Machinery Manufacturing $3.9B $2.4B +62% 0.63% 0.85% 82% 9%
    Other transportation equipment Manufacturing $3.6B $2.9B +25% 0.89% 0.81% 77% 10%
    Pipeline transportation Transportation and warehousing $0.6B $1.2B -46% 2.62% 0.79% 59% 4%
    Furniture Manufacturing $0.6B $0.5B +23% 0.70% 0.76% 82% 16%
    Mining support activities Mining $0.8B $0.8B +1% 0.60% 0.74% 78% 4%
    Paper products Manufacturing $1.5B $1.0B +47% 0.54% 0.69% 79% 8%
    Legal services Professional and technical services $3.7B $3.7B -2% 1.14% 0.68% 63% 63%
    Motor vehicle and parts dealers Retail trade $3.9B $1.3B +199% 0.43% 0.68% 61% 17%
    Electrical equipment Manufacturing $1.2B $0.9B +37% 0.69% 0.59% 84% 8%
    Truck transportation Transportation and warehousing $3.0B $1.5B +101% 0.45% 0.54% 68% 8%
    Forestry and fishing Agriculture $0.4B $0.2B +81% 0.37% 0.51% 78% 5%
    Social assistance Health care and social assistance $1.9B $1.1B +72% 0.56% 0.50% 66% 21%
    Food, beverage, and tobacco Manufacturing $6.2B $3.5B +78% 0.36% 0.49% 73% 10%
    Accommodation Accommodation and food services $1.9B $1.4B +33% 0.56% 0.49% 79% 11%
    Ambulatory health care Health care and social assistance $8.1B $5.1B +59% 0.54% 0.47% 69% 10%
    Plastics and rubber Manufacturing $1.3B $1.2B +11% 0.52% 0.46% 77% 7%
    Food services and drinking places Accommodation and food services $6.5B $2.8B +132% 0.38% 0.45% 66% 16%
    Nursing and residential care Health care and social assistance $1.5B $0.9B +71% 0.37% 0.40% 61% 10%
    Wood products Manufacturing $0.6B $0.3B +116% 0.29% 0.39% 78% 7%
    Motor vehicles and parts Manufacturing $3.0B $2.6B +15% 0.41% 0.38% 73% 4%
    Primary metals Manufacturing $1.0B $0.6B +76% 0.25% 0.36% 74% 5%
    Petroleum and coal products Manufacturing $1.9B $1.8B +3% 0.36% 0.32% 85% 6%
    Fabricated metal products Manufacturing $1.5B $1.0B +42% 0.29% 0.32% 80% 5%
    Nonmetallic mineral products Manufacturing $0.5B $0.4B +30% 0.34% 0.29% 69% 3%
    Waste management Administrative and waste services $0.5B $0.4B +40% 0.40% 0.29% 76% 3%
    Construction Construction $6.5B $4.0B +62% 0.29% 0.25% 74% 7%
    Mining, except oil and gas Mining $0.4B $0.3B +20% 0.29% 0.24% 61% 1%
    Transit and ground passenger Transportation and warehousing $0.4B $0.4B +3% 0.55% 0.19% 77% 6%
    Oil and gas extraction Mining $0.5B $1.0B -46% 0.40% 0.12% 81% 0%
    Farms Agriculture $0.1B $0.1B +140% 0.02% 0.03% 89% 0%

    65 industries at the most detailed level where BEA publishes both fixed investment and gross output. Utilities, banks, insurance, wholesale trade, food and beverage manufacturing, and miscellaneous manufacturing combine two to four BEA fixed-asset industries to match the gross output line.

    What this means for MSPs

    For MSPs and IT service firms, the national accounts point to a few practical conclusions.

    • Benchmark clients against their own industry, not a single average. A 2.5% IT capital ratio is typical for the private economy, but a bank at 7.2% and a construction firm at 0.25% are both normal for their sectors. Use the sector table to frame budget conversations, and say clearly that it covers capital spending only.
    • Software is the budget, hardware is the spike. About 63 cents of every IT capital dollar goes to software, and prepackaged licenses are the fastest-growing part. License management, SaaS administration, and software security are where client money already goes. Hardware still moves in bursts: the 2025 jump in computer investment was the largest since 1963, so device and server lifecycle offers need room to scale up quickly.
    • A low capital ratio is not a low IT budget. Health care (0.73% of output), construction (0.25%), and accommodation and food services (0.46%) invest little capital in IT per dollar of output, and their ratios fell or barely moved over ten years. IT bought as a monthly service, which is how managed services are sold, never appears in these figures, so the capital data cannot show how much these sectors spend that way.
    • Finance is the growth market in the data. Finance and insurance IT investment grew 179% in ten years, faster than any other sector, and is 60% of that sector’s nonresidential capital spending. Banks, securities firms, and insurers are where IT capital spending has expanded most in this data.

    Government agencies are outside these figures, which cover private industries only. For public-sector IT budgets, see our analysis of federal IT spending in 2026, built from contract obligations.

    Frequently asked questions

    Which industry spends the most on IT?

    The information sector, which includes telecom carriers, software publishers, and data processing and hosting firms. It invested $411.8B in IT in 2025, equal to 14.3% of its gross output. Within it, data processing, hosting, and other information services reached 23.5%. Finance and insurance is second at $241.8B, or 5.5% of output.

    What percentage of revenue do companies spend on IT?

    Measured as capital investment in IT, U.S. private industries put 2.53% of gross output (BEA’s sales-based measure of production) into computers, software, and communications equipment in 2025. The ratio ranges from 0.08% in agriculture to 14.3% in information. Operating IT budgets, which add staff, services, and cloud subscriptions, are higher.

    What is the average IT spend per employee?

    In 2025, U.S. private industries invested about $9,452 in IT per full-time equivalent employee. That ranges from $152,914 in information and $36,541 in finance and insurance to $743 in accommodation and food services. These are capital figures and exclude IT staff pay and service contracts.

    Which industries are increasing IT spending the fastest?

    From 2015 to 2025, IT investment grew 179% in finance and insurance, 155% in information, and 147% in retail trade, against 121% for all private industries. Mining was the only sector where IT investment fell in dollars, down 18%.

    Is software or hardware a bigger share of IT spending?

    Software. It was 63% of private IT investment in 2025, up from 59% in 2015. The share peaked at 68.9% in 2023 and slipped in 2025 because spending on computers and peripherals jumped 56% in one year, to $270.9B.

    Download the data. it-investment-by-industry-bea-1997-2025.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Sources. (1) BEA, Fixed Assets detailed estimates, “Investment in Private Nonresidential Fixed Assets” by industry and type of asset, current-cost file detailnonres_inv1.xlsx (updated September 30, 2026), annual 1901 to 2025. (2) BEA, GDP by Industry, Gross Output by Industry (Table TGO105, millions of current dollars; published September 30, 2026), annual 1997 to 2025. (3) BEA NIPA Table 6.5D, full-time equivalent employees by industry. All retrieved October 13, 2026.

    Definitions. IT investment is the sum of computers and peripheral equipment (BEA asset codes EP1A to EP1H: mainframes, PCs, direct access storage, printers, terminals, tape drives, storage devices, and system integrators), software (ENS1 prepackaged, ENS2 custom, ENS3 own-account), and communications equipment (EP20). It excludes other information processing equipment such as medical and nonmedical instruments, photocopiers, and office equipment, and it excludes research and development. IT intensity is IT investment divided by the matching gross output line, both in current dollars. Ten-year growth compares 2015 and 2025 in current dollars, not adjusted for prices; computer prices generally fall over time, so real hardware growth is likely higher than the nominal figures shown.

    Industry matching. Each of BEA’s 74 fixed-asset industries was mapped to its gross output line, giving 65 detailed industries and 19 sectors. Real estate uses the “other real estate” gross output line, which excludes housing, because the investment data cover nonresidential assets only. Sector totals for real estate and leasing combine the other real estate and rental and leasing lines.

    Checks. Summed across all industries, our 2025 software total is $751.3B against $751.3B for software in NIPA private fixed investment (series B985RC), and communications equipment is $169.9B against $170.0B (C275RC). Computers and peripherals sum to $270.9B, 3.3% below the NIPA aggregate of $280.2B (B935RC), a gap of similar size in earlier years (4.5% in 2015).

    Limitations. BEA warns that its detailed industry-by-asset estimates are less reliable than the published aggregates and are more likely to rest on judgmental trends or on trends in the higher-level aggregate. Assets are classified by owner, so leased equipment appears with the lessor and cloud capacity appears with the provider. Private industries include nonprofit institutions in industries such as hospitals and education; government is excluded. The ratio to gross output is a proxy for IT capital spending as a share of revenue, not a measure of total IT budgets.

    Not advice. This is an analysis of public economic data, not a budgeting recommendation for any organization.

    Cite as:The Uptime Report. "IT Spending by Industry: Business IT Investment Reached $1.19 Trillion in 2025, and Finance Grew It Fastest." October 2026. https://theuptimereport.com/it-spending-by-industry/

    References

    1. BEA, Detailed Data for Fixed Assets and Consumer Durable Goods (nonresidential detailed estimates, investment). Accessed October 2026.
    2. BEA, Investment in Private Nonresidential Fixed Assets by industry and type of asset, current cost (XLSX). Accessed October 2026.
    3. BEA, Gross Output by Industry and GrossOutput.xlsx. Accessed October 2026.
    4. BEA Glossary, Gross output (GO). Accessed October 2026.
    5. BEA, NIPA annual data flat file (series B935RC, B985RC, C275RC, and Table 6.5D full-time equivalent employees). Accessed October 2026.
    6. BEA, Fixed Assets and Consumer Durable Goods in the United States, methodology (ownership basis and leased assets). Accessed October 2026.
    7. Avasant, IT Spending as a Percentage of Revenue by Industry, Company Size, and Region (definition of the operating-budget ratio). Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Windows Server End of Life: 1,939 Flaws in 2012 and 2012 R2 Were Fixed Only for ESU Buyers. 2016 Is Next

    Uptime Report Research · Lifecycle Data

    Windows Server End of Life: 1,939 Flaws in 2012 and 2012 R2 Were Fixed Only for ESU Buyers. 2016 Is Next

    Windows Server end of life hits two milestones on October 13, 2026: Windows Server 2012 and 2012 R2 get their final Extended Security Update, and Windows Server 2022 leaves mainstream support. Since 2012 extended support ended in October 2023, Microsoft has listed 1,939 vulnerabilities in 2012 or 2012 R2, patched only for ESU buyers. Windows Server 2016 ends Jan 12, 2027.

    1,939CVEs in Windows Server 2012 or 2012 R2, Nov 2023 to Sep 2026, fixed only through ESU (40 exploited)
    704CVEs listed for 2008 or 2008 R2 after even Azure-only ESUs ended (Feb 2024 to Jan 2026)
    1,283CVEs affecting Windows Server 2016, Jan to Sep 2026, vs 492 in the same months of 2025
    91days from Oct 13, 2026 until Windows Server 2016 extended support ends (Jan 12, 2027)

    Every Windows Server end of life date on one timeline

    Each bar runs from general availability to the last date Microsoft ships security updates for that version under any program. Dates come from Microsoft’s Lifecycle pages, converted from the UTC timestamps in the page source to Pacific time, which is how Microsoft defines them.

    MainstreamExtendedPaid ESUESU, Azure onlyPremium Assurance only

    2008201020122014201620182020202220242026202820302032203420362008Windows Server 2008: Mainstream, May 6, 2008 to Jan 13, 2015Windows Server 2008: Extended, Jan 13, 2015 to Jan 14, 2020Windows Server 2008: Paid ESU, Jan 14, 2020 to Jan 10, 2023Windows Server 2008: ESU, Azure only, Jan 10, 2023 to Jan 9, 2024Windows Server 2008: Premium Assurance only, Jan 9, 2024 to Jan 13, 2026Premium Assurance to Jan 20262008 R2Windows Server 2008 R2: Mainstream, Oct 22, 2009 to Jan 13, 2015Windows Server 2008 R2: Extended, Jan 13, 2015 to Jan 14, 2020Windows Server 2008 R2: Paid ESU, Jan 14, 2020 to Jan 10, 2023Windows Server 2008 R2: ESU, Azure only, Jan 10, 2023 to Jan 9, 2024Windows Server 2008 R2: Premium Assurance only, Jan 9, 2024 to Jan 13, 2026Premium Assurance to Jan 20262012Windows Server 2012: Mainstream, Oct 30, 2012 to Oct 9, 2018Windows Server 2012: Extended, Oct 9, 2018 to Oct 10, 2023Windows Server 2012: Paid ESU, Oct 10, 2023 to Oct 13, 2026ESU to Oct 20262012 R2Windows Server 2012 R2: Mainstream, Nov 25, 2013 to Oct 9, 2018Windows Server 2012 R2: Extended, Oct 9, 2018 to Oct 10, 2023Windows Server 2012 R2: Paid ESU, Oct 10, 2023 to Oct 13, 2026ESU to Oct 20262016Windows Server 2016: Mainstream, Oct 15, 2016 to Jan 11, 2022Windows Server 2016: Extended, Jan 11, 2022 to Jan 12, 2027Windows Server 2016: Paid ESU, Jan 12, 2027 to Jan 12, 2030 (Microsoft: up to three years, through 2030)ESU up to Jan 20302019Windows Server 2019: Mainstream, Nov 13, 2018 to Jan 9, 2024Windows Server 2019: Extended, Jan 9, 2024 to Jan 9, 2029Extended to Jan 20292022Windows Server 2022: Mainstream, Aug 18, 2021 to Oct 13, 2026Windows Server 2022: Extended, Oct 13, 2026 to Oct 14, 2031Extended to Oct 20312025Windows Server 2025: Mainstream, Nov 1, 2024 to Nov 13, 2029Windows Server 2025: Extended, Nov 13, 2029 to Nov 14, 2034Extended to Nov 2034Oct 13, 2026

    The Windows Server 2016 ESU bar is dashed: Microsoft says ESUs will cover “up to three years, through 2030”; it is drawn to January 12, 2030, the date endoflife.date lists. The 2008 and 2008 R2 Premium Assurance phase comes from Microsoft’s support notes for the final monthly rollups.

    Windows Server lifecycle table

    Version Released Mainstream support ends Extended support ends Extended Security Updates Status on Oct 13, 2026
    Windows Server 2008 May 6, 2008 Jan 13, 2015 Jan 14, 2020 Paid ESU to Jan 10, 2023; Azure only to Jan 9, 2024; Premium Assurance to Jan 13, 2026 Out of support. Last update (Premium Assurance) Jan 13, 2026
    Windows Server 2008 R2 Oct 22, 2009 Jan 13, 2015 Jan 14, 2020 Paid ESU to Jan 10, 2023; Azure only to Jan 9, 2024; Premium Assurance to Jan 13, 2026 Out of support. Last update (Premium Assurance) Jan 13, 2026
    Windows Server 2012 Oct 30, 2012 Oct 9, 2018 Oct 10, 2023 3 years, to Oct 13, 2026 Final ESU update Oct 13, 2026
    Windows Server 2012 R2 Nov 25, 2013 Oct 9, 2018 Oct 10, 2023 3 years, to Oct 13, 2026 Final ESU update Oct 13, 2026
    Windows Server 2016 Oct 15, 2016 Jan 11, 2022 Jan 12, 2027 Up to 3 years (Microsoft: “through 2030”), via Azure Arc or licensing; billing from Jan 13, 2027 Extended support, 91 days left
    Windows Server 2019 Nov 13, 2018 Jan 9, 2024 Jan 9, 2029 None announced Extended support
    Windows Server 2022 Aug 18, 2021 Oct 13, 2026 Oct 14, 2031 None announced Mainstream ends Oct 13, 2026; extended to Oct 14, 2031
    Windows Server 2025 Nov 1, 2024 Nov 13, 2029 Nov 14, 2034 None announced Mainstream support

    Long-Term Servicing Channel versions only. Every mainstream and extended date matches the endoflife.date API. The endoflife.date entries omit the Azure-only fourth ESU year and Premium Assurance for 2008 and 2008 R2, which this table includes.

    Does an out-of-support Windows Server keep getting vulnerabilities?

    Yes. To test it, we downloaded every monthly Microsoft security release from January 2021 to Sep 2026 through the MSRC CVRF API and counted, for each Windows Server version, the CVEs Microsoft lists as affecting it. The counts do not fall away when support ends. They stay in the hundreds per year until Microsoft stops listing the version at all.

    MainstreamExtendedPaid ESUESU, Azure onlyPremium Assurance onlyNo updatesBefore release

    202120222023202420252026*2008Windows Server 2008, 2021: 252 CVEs listed, 41 Critical, 8 exploited. Support phase for most of the year: Paid ESU252Windows Server 2008, 2022: 292 CVEs listed, 36 Critical, 7 exploited. Support phase for most of the year: Paid ESU292Windows Server 2008, 2023: 312 CVEs listed, 48 Critical, 11 exploited. Support phase for most of the year: ESU, Azure only312Windows Server 2008, 2024: 283 CVEs listed, 12 Critical, 9 exploited. Support phase for most of the year: Premium Assurance only283Windows Server 2008, 2025: 357 CVEs listed, 20 Critical, 14 exploited. Support phase for most of the year: Premium Assurance only357Windows Server 2008, 2026: 26 CVEs listed, 0 Critical, 0 exploited. Support phase for most of the year: No updates262008 R2Windows Server 2008 R2, 2021: 277 CVEs listed, 47 Critical, 9 exploited. Support phase for most of the year: Paid ESU277Windows Server 2008 R2, 2022: 345 CVEs listed, 45 Critical, 10 exploited. Support phase for most of the year: Paid ESU345Windows Server 2008 R2, 2023: 345 CVEs listed, 49 Critical, 11 exploited. Support phase for most of the year: ESU, Azure only345Windows Server 2008 R2, 2024: 301 CVEs listed, 15 Critical, 8 exploited. Support phase for most of the year: Premium Assurance only301Windows Server 2008 R2, 2025: 391 CVEs listed, 27 Critical, 14 exploited. Support phase for most of the year: Premium Assurance only391Windows Server 2008 R2, 2026: 28 CVEs listed, 0 Critical, 0 exploited. Support phase for most of the year: No updates282012Windows Server 2012, 2021: 316 CVEs listed, 48 Critical, 9 exploited. Support phase for most of the year: Extended316Windows Server 2012, 2022: 409 CVEs listed, 47 Critical, 11 exploited. Support phase for most of the year: Extended409Windows Server 2012, 2023: 422 CVEs listed, 55 Critical, 11 exploited. Support phase for most of the year: Extended422Windows Server 2012, 2024: 386 CVEs listed, 21 Critical, 9 exploited. Support phase for most of the year: Paid ESU386Windows Server 2012, 2025: 455 CVEs listed, 34 Critical, 16 exploited. Support phase for most of the year: Paid ESU455Windows Server 2012, 2026: 945 CVEs listed, 94 Critical, 9 exploited. Support phase for most of the year: Paid ESU9452012 R2Windows Server 2012 R2, 2021: 333 CVEs listed, 48 Critical, 10 exploited. Support phase for most of the year: Extended333Windows Server 2012 R2, 2022: 433 CVEs listed, 52 Critical, 11 exploited. Support phase for most of the year: Extended433Windows Server 2012 R2, 2023: 431 CVEs listed, 55 Critical, 12 exploited. Support phase for most of the year: Extended431Windows Server 2012 R2, 2024: 421 CVEs listed, 21 Critical, 13 exploited. Support phase for most of the year: Paid ESU421Windows Server 2012 R2, 2025: 481 CVEs listed, 34 Critical, 16 exploited. Support phase for most of the year: Paid ESU481Windows Server 2012 R2, 2026: 999 CVEs listed, 95 Critical, 9 exploited. Support phase for most of the year: Paid ESU9992016Windows Server 2016, 2021: 393 CVEs listed, 56 Critical, 10 exploited. Support phase for most of the year: Mainstream393Windows Server 2016, 2022: 518 CVEs listed, 56 Critical, 14 exploited. Support phase for most of the year: Extended518Windows Server 2016, 2023: 486 CVEs listed, 60 Critical, 15 exploited. Support phase for most of the year: Extended486Windows Server 2016, 2024: 502 CVEs listed, 31 Critical, 18 exploited. Support phase for most of the year: Extended502Windows Server 2016, 2025: 610 CVEs listed, 41 Critical, 17 exploited. Support phase for most of the year: Extended610Windows Server 2016, 2026: 1283 CVEs listed, 114 Critical, 10 exploited. Support phase for most of the year: Extended1,2832019Windows Server 2019, 2021: 473 CVEs listed, 61 Critical, 14 exploited. Support phase for most of the year: Mainstream473Windows Server 2019, 2022: 582 CVEs listed, 62 Critical, 15 exploited. Support phase for most of the year: Mainstream582Windows Server 2019, 2023: 534 CVEs listed, 63 Critical, 16 exploited. Support phase for most of the year: Mainstream534Windows Server 2019, 2024: 596 CVEs listed, 33 Critical, 20 exploited. Support phase for most of the year: Extended596Windows Server 2019, 2025: 694 CVEs listed, 45 Critical, 19 exploited. Support phase for most of the year: Extended694Windows Server 2019, 2026: 1492 CVEs listed, 128 Critical, 10 exploited. Support phase for most of the year: Extended1,4922022Windows Server 2022, 2021: 130 CVEs listed, 10 Critical, 3 exploited. Support phase for most of the year: Before release130Windows Server 2022, 2022: 595 CVEs listed, 62 Critical, 15 exploited. Support phase for most of the year: Mainstream595Windows Server 2022, 2023: 552 CVEs listed, 65 Critical, 16 exploited. Support phase for most of the year: Mainstream552Windows Server 2022, 2024: 595 CVEs listed, 36 Critical, 21 exploited. Support phase for most of the year: Mainstream595Windows Server 2022, 2025: 723 CVEs listed, 49 Critical, 19 exploited. Support phase for most of the year: Mainstream723Windows Server 2022, 2026: 1583 CVEs listed, 138 Critical, 10 exploited. Support phase for most of the year: Mainstream1,5832025Windows Server 2025, 2021: 0 CVEs listed, 0 Critical, 0 exploited. Support phase for most of the year: Before release0Windows Server 2025, 2022: 2 CVEs listed, 0 Critical, 1 exploited. Support phase for most of the year: Before release2Windows Server 2025, 2023: 2 CVEs listed, 0 Critical, 1 exploited. Support phase for most of the year: Before release2Windows Server 2025, 2024: 92 CVEs listed, 19 Critical, 3 exploited. Support phase for most of the year: Before release92Windows Server 2025, 2025: 787 CVEs listed, 52 Critical, 22 exploited. Support phase for most of the year: Mainstream787Windows Server 2025, 2026: 1734 CVEs listed, 146 Critical, 10 exploited. Support phase for most of the year: Mainstream1,734

    Unique CVEs listed per version and year. Color shows the support phase for most of that year. *2026 is January to Sep. Counts in grey cells before a version’s release come from older CVEs whose product lists Microsoft later updated.

    Windows Server 2008 and 2008 R2 are the clearest case. Paid ESUs ended in January 2023 and the Azure-only fourth year ended on Jan 9, 2024. Microsoft kept fixing them after that, but only for customers with Premium Assurance, a separate contract. From February 2024 to January 2026 it listed 704 new CVEs affecting 2008 or 2008 R2, 41 rated Critical and 23 marked exploited. A server without that contract got no fix for any of them.

    2550752021-01: 35 CVEs listed for Windows Server 2008 R2 (Paid ESU)20212021-02: 14 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-03: 23 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-04: 50 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-05: 10 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-06: 14 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-07: 41 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-08: 14 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-09: 23 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-10: 20 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-11: 15 CVEs listed for Windows Server 2008 R2 (Paid ESU)2021-12: 18 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-01: 35 CVEs listed for Windows Server 2008 R2 (Paid ESU)20222022-02: 10 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-03: 15 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-04: 51 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-05: 30 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-06: 20 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-07: 36 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-08: 30 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-09: 36 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-10: 44 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-11: 24 CVEs listed for Windows Server 2008 R2 (Paid ESU)2022-12: 14 CVEs listed for Windows Server 2008 R2 (Paid ESU)2023-01: 39 CVEs listed for Windows Server 2008 R2 (Paid ESU)20232023-02: 33 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-03: 20 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-04: 43 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-05: 14 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-06: 18 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-07: 55 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-08: 25 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-09: 12 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-10: 56 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-11: 15 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2023-12: 15 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)2024-01: 19 CVEs listed for Windows Server 2008 R2 (ESU, Azure only)20242024-02: 27 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-03: 21 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-04: 32 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-05: 22 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-06: 15 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-07: 35 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-08: 31 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-09: 19 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-10: 37 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-11: 20 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2024-12: 23 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-01: 78 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)20252025-02: 21 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-03: 21 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-04: 42 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-05: 28 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-06: 16 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-07: 53 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-08: 40 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-09: 30 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-10: 37 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-11: 14 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2025-12: 11 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)2026-01: 28 CVEs listed for Windows Server 2008 R2 (Premium Assurance only)20262026-02: Windows Server 2008 R2 no longer listed in Microsoft security updates2026-03: Windows Server 2008 R2 no longer listed in Microsoft security updates2026-04: Windows Server 2008 R2 no longer listed in Microsoft security updates2026-05: Windows Server 2008 R2 no longer listed in Microsoft security updates2026-06: Windows Server 2008 R2 no longer listed in Microsoft security updates2026-07: Windows Server 2008 R2 no longer listed in Microsoft security updates2026-08: Windows Server 2008 R2 no longer listed in Microsoft security updates2026-09: Windows Server 2008 R2 no longer listed in Microsoft security updatesWindows Server 2008 R2: CVEs listed per month1002003004002021-01: 42 CVEs listed for Windows Server 2012 R2 (Extended)20212021-02: 17 CVEs listed for Windows Server 2012 R2 (Extended)2021-03: 27 CVEs listed for Windows Server 2012 R2 (Extended)2021-04: 55 CVEs listed for Windows Server 2012 R2 (Extended)2021-05: 12 CVEs listed for Windows Server 2012 R2 (Extended)2021-06: 19 CVEs listed for Windows Server 2012 R2 (Extended)2021-07: 51 CVEs listed for Windows Server 2012 R2 (Extended)2021-08: 20 CVEs listed for Windows Server 2012 R2 (Extended)2021-09: 24 CVEs listed for Windows Server 2012 R2 (Extended)2021-10: 28 CVEs listed for Windows Server 2012 R2 (Extended)2021-11: 17 CVEs listed for Windows Server 2012 R2 (Extended)2021-12: 21 CVEs listed for Windows Server 2012 R2 (Extended)2022-01: 52 CVEs listed for Windows Server 2012 R2 (Extended)20222022-02: 13 CVEs listed for Windows Server 2012 R2 (Extended)2022-03: 22 CVEs listed for Windows Server 2012 R2 (Extended)2022-04: 65 CVEs listed for Windows Server 2012 R2 (Extended)2022-05: 46 CVEs listed for Windows Server 2012 R2 (Extended)2022-06: 24 CVEs listed for Windows Server 2012 R2 (Extended)2022-07: 38 CVEs listed for Windows Server 2012 R2 (Extended)2022-08: 40 CVEs listed for Windows Server 2012 R2 (Extended)2022-09: 38 CVEs listed for Windows Server 2012 R2 (Extended)2022-10: 50 CVEs listed for Windows Server 2012 R2 (Extended)2022-11: 26 CVEs listed for Windows Server 2012 R2 (Extended)2022-12: 19 CVEs listed for Windows Server 2012 R2 (Extended)2023-01: 48 CVEs listed for Windows Server 2012 R2 (Extended)20232023-02: 33 CVEs listed for Windows Server 2012 R2 (Extended)2023-03: 45 CVEs listed for Windows Server 2012 R2 (Extended)2023-04: 62 CVEs listed for Windows Server 2012 R2 (Extended)2023-05: 16 CVEs listed for Windows Server 2012 R2 (Extended)2023-06: 23 CVEs listed for Windows Server 2012 R2 (Extended)2023-07: 70 CVEs listed for Windows Server 2012 R2 (Extended)2023-08: 25 CVEs listed for Windows Server 2012 R2 (Extended)2023-09: 13 CVEs listed for Windows Server 2012 R2 (Extended)2023-10: 61 CVEs listed for Windows Server 2012 R2 (Extended)2023-11: 17 CVEs listed for Windows Server 2012 R2 (Paid ESU)2023-12: 18 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-01: 22 CVEs listed for Windows Server 2012 R2 (Paid ESU)20242024-02: 32 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-03: 28 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-04: 62 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-05: 24 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-06: 21 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-07: 67 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-08: 43 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-09: 22 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-10: 50 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-11: 22 CVEs listed for Windows Server 2012 R2 (Paid ESU)2024-12: 28 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-01: 95 CVEs listed for Windows Server 2012 R2 (Paid ESU)20252025-02: 23 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-03: 25 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-04: 55 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-05: 31 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-06: 24 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-07: 61 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-08: 50 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-09: 35 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-10: 51 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-11: 19 CVEs listed for Windows Server 2012 R2 (Paid ESU)2025-12: 12 CVEs listed for Windows Server 2012 R2 (Paid ESU)2026-01: 37 CVEs listed for Windows Server 2012 R2 (Paid ESU)20262026-02: 15 CVEs listed for Windows Server 2012 R2 (Paid ESU)2026-03: 32 CVEs listed for Windows Server 2012 R2 (Paid ESU)2026-04: 60 CVEs listed for Windows Server 2012 R2 (Paid ESU)2026-05: 42 CVEs listed for Windows Server 2012 R2 (Paid ESU)2026-06: 65 CVEs listed for Windows Server 2012 R2 (Paid ESU)2026-07: 186 CVEs listed for Windows Server 2012 R2 (Paid ESU)2026-08: 144 CVEs listed for Windows Server 2012 R2 (Paid ESU)2026-09: 418 CVEs listed for Windows Server 2012 R2 (Paid ESU)Windows Server 2012 R2: CVEs listed per month

    ExtendedPaid ESUESU, Azure onlyPremium Assurance onlyNo updates

    Then the 2008 R2 bars stop. Since Feb 2026, Microsoft has listed 962 CVEs for Windows Server 2012 R2 and none for 2008 R2. That does not mean 2008 R2 became safe. It means Microsoft no longer assesses it. In 2025, 81% of the CVEs listed for 2012 R2 were also listed for 2008 R2, so most of the newer flaws plausibly reach the older code too, with no public record either way.

    Windows Server 2012 and 2012 R2: the last ESU patch is October 13, 2026

    Microsoft’s Azure Arc documentation is explicit: the October 13, 2026 security update is the final update provided through ESUs, and Arc-enabled ESU licenses for 2012 deactivate at midnight UTC on October 14, 2026. During the three ESU years (November 2023 to Sep 2026 in our data), Microsoft listed 1,939 CVEs affecting 2012 or 2012 R2: 154 rated Critical and 40 marked as exploited in the wild. Any 2012 machine that was not enrolled has gone without those fixes since 2023.

    The flow has sped up, not slowed. Windows Server 2012 R2 picked up 999 CVEs from January to Sep 2026, against 481 in all of 2025. That matches the jump in total Microsoft fixes this year shown in our Patch Tuesday statistics for 2026, and the wider rise in published vulnerabilities tracked in our CVE statistics for 2026. Exploited CVEs affecting 2012 or 2012 R2 so far in 2026:

    • CVE-2026-20805 Desktop Window Manager Information Disclosure Vulnerability Jan 2026
    • CVE-2026-21510 Windows Shell Security Feature Bypass Vulnerability Feb 2026
    • CVE-2026-21513 MSHTML Framework Security Feature Bypass Vulnerability Feb 2026
    • CVE-2026-21525 Windows Remote Access Connection Manager Denial of Service Vulnerability Feb 2026
    • CVE-2026-21533 Windows Remote Desktop Services Elevation of Privilege Vulnerability Feb 2026
    • CVE-2026-32202 Windows Shell Spoofing Vulnerability Apr 2026
    • CVE-2026-56155 Active Directory Federation Services Elevation of Privilege Vulnerability Jul 2026
    • CVE-2026-68820 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Aug 2026
    • CVE-2026-85880 Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability Sep 2026

    Several sit in components common on MSP-managed servers: Remote Desktop Services, the Windows Shell, and Active Directory Federation Services. After October 13, the next flaws of this kind will not be fixed for 2012 at all.

    Windows Server 2016: 91 days left

    Windows Server 2016 is the next big cliff. Extended support ends on Jan 12, 2027. Microsoft listed 1,283 CVEs affecting it from January to Sep 2026, up from 492 in the same months of 2025; 114 were Critical and 10 were exploited. 78% of this year’s 2016 CVEs were also listed for 2012 R2, so the 2012 experience is a fair preview of what an unpaid 2016 server will face from February 2027.

    Microsoft will sell Windows Server 2016 ESUs for up to three years. Through Azure Arc they could be configured from August 3, 2026, and billing begins January 13, 2027. They cover Standard and Datacenter editions and provide Critical and Important security updates only.

    Windows Server 2022 leaves mainstream support

    October 13, 2026 is also the last day of mainstream support for Windows Server 2022. This change is far less urgent than the others: under Microsoft’s Fixed Lifecycle Policy, extended support still includes security updates, and it runs to Oct 14, 2031. What ends is non-security updates and design or feature change requests. Windows Server 2022 had 1,583 CVEs listed from January to Sep 2026, and those fixes reach every customer, not only ESU buyers.

    CVEs per Windows Server version per year

    Version 2021 2022 2023 2024 2025 2026*
    2008 252 41 / 8 292 36 / 7 312 48 / 11 283 12 / 9 357 20 / 14 26 0 / 0
    2008 R2 277 47 / 9 345 45 / 10 345 49 / 11 301 15 / 8 391 27 / 14 28 0 / 0
    2012 316 48 / 9 409 47 / 11 422 55 / 11 386 21 / 9 455 34 / 16 945 94 / 9
    2012 R2 333 48 / 10 433 52 / 11 431 55 / 12 421 21 / 13 481 34 / 16 999 95 / 9
    2016 393 56 / 10 518 56 / 14 486 60 / 15 502 31 / 18 610 41 / 17 1,283 114 / 10
    2019 473 61 / 14 582 62 / 15 534 63 / 16 596 33 / 20 694 45 / 19 1,492 128 / 10
    2022 130 10 / 3 595 62 / 15 552 65 / 16 595 36 / 21 723 49 / 19 1,583 138 / 10
    2025 0 0 / 0 2 0 / 1 2 0 / 1 92 19 / 3 787 52 / 22 1,734 146 / 10

    Each cell: unique CVEs listed as affecting the version, with Critical / exploited counts below. Critical is Microsoft’s severity for that version; exploited is Microsoft’s current “Exploited: Yes” flag. *2026 is January to Sep.

    What it costs to keep an old server patched

    Microsoft publishes the ESU price structure, not a simple per-server price. Here is what its own documents and price list say.

    Option Windows Server 2012 / 2012 R2 Windows Server 2016
    Azure VMs ESUs free, no charge above the VM cost Not stated in the pages we read. Microsoft’s price list carries a “Windows Server Azure ESU” meter for 2016 at the same per-core rate as Arc
    Azure Arc, Standard $0.00648 per core-hour (about $4.73 per core per month) $0.007132 per core-hour (about $5.21 per core per month)
    Azure Arc, Datacenter $0.03733 per core-hour (about $27.25 per core per month) $0.041067 per core-hour (about $29.98 per core per month)
    Arc minimums 8 cores per VM (vCore licensing) or 16 per physical server (pCore licensing) Not stated in the pages we read
    Volume licensing, on premises 100% of the full license price per year, for each of the three years Not stated in the pages we read
    Late enrollment Back-billed for every month missed since end of support Arc billing begins Jan 13, 2027; back-billing terms not stated in the pages we read
    Prerequisite Software Assurance, unless the server is licensed through SPLA or a Server Subscription

    Per-core-hour rates are Microsoft’s USD list prices from the Azure Retail Prices API (Global region, effective 2026-08-01 for 2016). Monthly figures use 730 hours. At list price, 16 Standard cores of 2016 ESU come to about $1,000 a year, and 16 Datacenter cores to about $5,756. Partner and agreement pricing may differ.

    Supported upgrade paths

    Microsoft’s in-place upgrade matrix (installation media) decides how many hops an old server needs. Windows Server 2025 changed the rule: nonclustered servers can now jump up to four versions, while earlier releases allowed two. Cluster rolling upgrades still move one version at a time.

    From Supported in-place targets
    Windows Server 2012 2012 R2, 2016
    Windows Server 2012 R2 2016, 2019, 2025
    Windows Server 2016 2019, 2022, 2025
    Windows Server 2019 2022, 2025
    Windows Server 2022 2025

    Windows Server 2012 R2 cannot upgrade in place to 2022, but it can go straight to 2025. Windows Server 2012 needs a hop through 2012 R2 or 2016. 2008 and 2008 R2 have no in-place path to a supported version in this matrix. Each upgrade requires a license for the target version.

    SQL Server end of support dates

    Many of these servers also run SQL Server, which has its own clock. From Microsoft’s Lifecycle pages:

    Version Mainstream ends Extended ends ESU ends Status on Oct 13, 2026
    SQL Server 2012 Jul 11, 2017 Jul 12, 2022 Jul 8, 2025 Out of support
    SQL Server 2014 Jul 9, 2019 Jul 9, 2024 Jul 12, 2027 ESU only
    SQL Server 2016 Jul 13, 2021 Jul 14, 2026 Jul 17, 2029 ESU only
    SQL Server 2017 Oct 11, 2022 Oct 12, 2027 None Extended
    SQL Server 2019 Feb 28, 2025 Jan 8, 2030 None Extended
    SQL Server 2022 Jan 11, 2028 Jan 11, 2033 None Mainstream
    SQL Server 2025 Jan 6, 2031 Jan 6, 2036 None Mainstream

    SQL Server 2016 left extended support on Jul 14, 2026, so it now gets security fixes only through ESUs (Year 3 ends Jul 17, 2029). SQL Server 2017 extended support ends Oct 12, 2027.

    What this means for MSPs

    2012 and 2012 R2, now. After October 13 there is no paid option left for these versions. Any remaining 2012 server should be isolated from the internet, kept off domain-admin logon paths, and scheduled for replacement or an in-place jump: 2012 R2 can go straight to 2025, while 2012 must pass through 2012 R2 or 2016 first.
    2016, before January 12. Inventory every 2016 instance with core counts and edition now. Arc ESU billing starts January 13, 2027. For 2012, Microsoft back-billed late sign-ups for every missed month, so confirm the 2016 terms before letting a decision slide past January. Price ESU against an upgrade to 2025 per client, not across the board.
    Report the gap honestly. “No CVEs listed” for an unsupported version means Microsoft stopped looking. Our data shows 2008 R2 listings fell to zero overnight in February 2026 while 2012 R2 kept collecting them. Client risk reports should flag unsupported versions as unassessed, not clean.
    2022 is not urgent. Mainstream support ending changes nothing about security patching through Oct 2031. Use the date to plan, and pair it with SQL Server: 2016 instances are already on ESU-only fixes.

    Frequently asked questions

    Is Windows Server end of life?

    Some versions are. Windows Server 2008 and 2008 R2 received their last update on Jan 13, 2026, and only for Premium Assurance customers. Windows Server 2012 and 2012 R2 get their final Extended Security Update on Oct 13, 2026. Windows Server 2016 leaves extended support on Jan 12, 2027. Windows Server 2019, 2022, and 2025 are supported.

    When does Windows Server 2016 reach end of life?

    Extended support for Windows Server 2016 ends on Jan 12, 2027, 91 days after October 13, 2026. Microsoft sells Extended Security Updates for up to three years after that. Microsoft listed 1,283 CVEs affecting Windows Server 2016 from January to Sep 2026.

    Will Windows Server versions still be supported in 2027?

    Windows Server 2019 (extended support to Jan 9, 2029), 2022 (to Oct 14, 2031), and 2025 (to Nov 14, 2034) are supported through 2027. Windows Server 2016 is supported only until Jan 12, 2027, then through paid ESUs.

    Can you go from Server 2019 to 2025?

    Yes. Microsoft supports an in-place upgrade from Windows Server 2019 to 2025. Starting with Windows Server 2025, nonclustered servers can upgrade up to four versions at once, so 2012 R2, 2016, 2019, and 2022 can all upgrade directly. Each upgrade needs a license for the new version.

    What happens when Windows Server reaches end of support?

    Vulnerabilities keep appearing, but fixes stop for anyone not paying. After Azure-only ESUs for Windows Server 2008 and 2008 R2 ended in January 2024, Microsoft still listed 704 new CVEs affecting them through January 2026, 23 of them exploited, with fixes only for Premium Assurance customers.

    When does Windows Server 2022 mainstream support end?

    Mainstream support for Windows Server 2022 ends on Oct 13, 2026. Security updates continue under extended support until Oct 14, 2031.

    Download the data. windows-server-cves-by-version-2021-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Lifecycle dates. Microsoft Lifecycle product pages for each Windows Server and SQL Server version, retrieved October 13, 2026. The pages store UTC timestamps (for example 1/13/2027 6:59:59 AM for Windows Server 2016) and display them in Pacific time; we converted the same way, giving January 12, 2027. ESU terms come from Microsoft’s Lifecycle FAQ on Extended Security Updates and Azure Arc documentation. Premium Assurance end dates for 2008 and 2008 R2 come from Microsoft’s support notes for KB5073697 and KB5073695. Every mainstream and extended end date was cross-checked against the endoflife.date API and matched.

    Vulnerability counts. MSRC CVRF API v3.0, one document per monthly release, January 2021 to Sep 2026. The October 2026 document available at retrieval was the pre-release “Early Security Updates” file and was excluded. For each CVE (advisories excluded) we took the products Microsoft marks as Known Affected and mapped them to Windows Server operating system products, including Server Core installations and excluding components listed separately (such as .NET Framework on Windows Server). Each CVE is counted once, in the first monthly document where it appears. Annual Channel releases (such as version 23H2) are excluded from charts and included in the CSV.

    Definitions. Critical is Microsoft’s highest severity rating for that version’s affected products. Exploited means Microsoft’s exploitability field currently reads “Exploited: Yes”; it does not say the exploitation targeted that specific version. Support phase is assigned by comparing each month’s Patch Tuesday date with the lifecycle dates.

    Prices. Azure Retail Prices API, product “Azure Arc Extended Security Updates”, USD list prices, retrieved October 13, 2026.

    Limitations. Microsoft lists only versions it still services, so counts for a version stop when its last servicing program ends; that is a limit of disclosure, not evidence of safety. Product lists and flags reflect Microsoft’s current data, which it revises. Counts before 2021 are not included. The 2026 figures cover nine months.

    Not advice. This is an analysis of public lifecycle and vulnerability data, not licensing or security advice for any environment. Confirm ESU eligibility and pricing with Microsoft or your licensing partner.

    Cite as:The Uptime Report. "Windows Server End of Life: 1,939 Flaws in 2012 and 2012 R2 Were Fixed Only for ESU Buyers. 2016 Is Next." October 2026. https://theuptimereport.com/windows-server-end-of-life/

    References

    1. Microsoft Lifecycle, Windows Server 2008. Accessed October 2026.
    2. Microsoft Lifecycle, Windows Server 2008 R2. Accessed October 2026.
    3. Microsoft Lifecycle, Windows Server 2012. Accessed October 2026.
    4. Microsoft Lifecycle, Windows Server 2012 R2. Accessed October 2026.
    5. Microsoft Lifecycle, Windows Server 2016. Accessed October 2026.
    6. Microsoft Lifecycle, Windows Server 2019. Accessed October 2026.
    7. Microsoft Lifecycle, Windows Server 2022. Accessed October 2026.
    8. Microsoft Lifecycle, Windows Server 2025. Accessed October 2026.
    9. Microsoft, Lifecycle FAQ: Extended Security Updates. Accessed October 2026.
    10. Microsoft, Extended Security Updates for Windows Server overview. Accessed October 2026.
    11. Microsoft, Prepare to deliver Extended Security Updates for Windows Server (Azure Arc). Accessed October 2026.
    12. Microsoft, Deliver Extended Security Updates for Windows Server (Azure Arc). Accessed October 2026.
    13. Microsoft Support, KB5073695 (Windows Server 2008 R2 Premium Assurance, January 13, 2026). Accessed October 2026.
    14. Microsoft Support, KB5073697 (Windows Server 2008 Premium Assurance, January 13, 2026). Accessed October 2026.
    15. Microsoft, Plan your Windows Server upgrade. Accessed October 2026.
    16. Microsoft, Fixed Lifecycle Policy. Accessed October 2026.
    17. Microsoft, Windows Server release information. Accessed October 2026.
    18. MSRC CVRF API v3.0. Accessed October 2026.
    19. Azure Retail Prices API and Azure Arc pricing. Accessed October 2026.
    20. Microsoft Lifecycle, SQL Server 2012. Accessed October 2026.
    21. Microsoft Lifecycle, SQL Server 2014. Accessed October 2026.
    22. Microsoft Lifecycle, SQL Server 2016. Accessed October 2026.
    23. Microsoft Lifecycle, SQL Server 2017. Accessed October 2026.
    24. Microsoft Lifecycle, SQL Server 2019. Accessed October 2026.
    25. Microsoft Lifecycle, SQL Server 2022. Accessed October 2026.
    26. Microsoft Lifecycle, SQL Server 2025. Accessed October 2026.
    27. endoflife.date API, Windows Server (cross-check). Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Zero-Day Statistics: Browser Exploits Are Fading as Attackers Move to the Network Edge

    Uptime Report Research · Vulnerability Data

    Zero-Day Statistics: Browser Exploits Are Fading as Attackers Move to the Network Edge

    These zero-day statistics come from a full analysis of Google Project Zero’s public “0day In the Wild” tracker: all 412 zero-days it has logged since July 2014. Microsoft accounts for 166, Google 80 and Apple 67. Browsers fell from 52% of tracked zero-days in 2020 to 21% in 2025, while Google’s own threat team says a record 48% of 2025 zero-days hit enterprise products.

    412in-the-wild zero-days in Project Zero’s tracker, 2014 to September 29, 2026
    166of them in Microsoft products (40%), the most of any vendor
    21%browser share of tracked zero-days in 2025, down from 52% in 2020
    9 daysmedian time from discovery to patch (133 zero-days with a discovery date)
    32%edge, security and networking share of new 2026 KEV entries, vs 21% a year earlier

    Every tracked zero-day, by vendor

    412 zero-days, one dot each, placed by patch date

    BrowsersMobile OS and chipsetsDesktop OSOffice, apps and pluginsEnterprise, edge and security products

    201520162017201820192020202120222023202420252026Microsoft166CVE-2014-2817: Microsoft Internet Explorer, patched 2014-08-12 (Browsers)CVE-2014-4113: Microsoft Windows, patched 2014-10-14 (Desktop OS)CVE-2014-4114: Microsoft Office, patched 2014-10-14 (Office, apps and plugins)CVE-2014-4148: Microsoft Windows, patched 2014-10-14 (Desktop OS)CVE-2014-4123: Microsoft Internet Explorer, patched 2014-10-14 (Browsers)CVE-2014-6352: Microsoft Office, patched 2014-11-11 (Office, apps and plugins)CVE-2014-4077: Microsoft Windows, patched 2014-11-11 (Desktop OS)CVE-2014-6324: Microsoft Windows, patched 2014-11-18 (Desktop OS)CVE-2015-0016: Microsoft Windows, patched 2015-01-13 (Desktop OS)CVE-2015-0071: Microsoft Internet Explorer, patched 2015-02-10 (Browsers)CVE-2015-1641: Microsoft Office, patched 2015-04-14 (Office, apps and plugins)CVE-2015-1701: Microsoft Windows Kernel, patched 2015-05-12 (Desktop OS)CVE-2015-2360: Microsoft Windows Kernel, patched 2015-06-09 (Desktop OS)CVE-2015-2387: Microsoft Windows Kernel, patched 2015-07-14 (Desktop OS)CVE-2015-2425: Microsoft Internet Explorer, patched 2015-07-14 (Browsers)CVE-2015-2424: Microsoft Office, patched 2015-07-14 (Office, apps and plugins)CVE-2015-2426: Microsoft Windows, patched 2015-07-20 (Desktop OS)CVE-2015-1642: Microsoft Office, patched 2015-08-11 (Office, apps and plugins)CVE-2015-1769: Microsoft Windows, patched 2015-08-11 (Desktop OS)CVE-2015-2502: Microsoft Internet Explorer, patched 2015-08-18 (Browsers)CVE-2015-2546: Microsoft Windows Kernel, patched 2015-09-08 (Desktop OS)CVE-2015-2545: Microsoft Office, patched 2015-09-08 (Office, apps and plugins)CVE-2015-6175: Microsoft Windows Kernel, patched 2015-12-08 (Desktop OS)CVE-2016-0034: Microsoft Silverlight, patched 2016-01-12 (Office, apps and plugins)CVE-2016-0162: Microsoft Internet Explorer, patched 2016-04-12 (Browsers)CVE-2016-0165: Microsoft Windows Kernel, patched 2016-04-12 (Desktop OS)CVE-2016-0167: Microsoft Windows Kernel, patched 2016-04-12 (Desktop OS)CVE-2016-0189: Microsoft Internet Explorer, patched 2016-05-10 (Browsers)CVE-2016-3351: Microsoft Internet Explorer, patched 2016-09-13 (Browsers)CVE-2016-3298: Microsoft Internet Explorer, patched 2016-10-11 (Browsers)CVE-2016-3393: Microsoft Windows, patched 2016-10-11 (Desktop OS)CVE-2016-7193: Microsoft Office, patched 2016-10-11 (Office, apps and plugins)CVE-2016-7256: Microsoft Windows, patched 2016-11-08 (Desktop OS)CVE-2016-7255: Microsoft Windows Kernel, patched 2016-11-08 (Desktop OS)CVE-2017-0149: Microsoft Internet Explorer, patched 2017-03-14 (Browsers)CVE-2017-0022: Microsoft XML Core Services, patched 2017-03-14 (Desktop OS)CVE-2017-0005: Microsoft Windows, patched 2017-03-14 (Desktop OS)CVE-2017-0143: Microsoft Windows, patched 2017-03-14 (Desktop OS)CVE-2017-0144: Microsoft Windows, patched 2017-03-14 (Desktop OS)CVE-2017-0145: Microsoft Windows, patched 2017-03-14 (Desktop OS)CVE-2017-0146: Microsoft Windows, patched 2017-03-14 (Desktop OS)CVE-2017-0147: Microsoft Windows, patched 2017-03-14 (Desktop OS)CVE-2017-0210: Microsoft Internet Explorer, patched 2017-04-11 (Browsers)CVE-2017-0199: Microsoft Office, patched 2017-04-11 (Office, apps and plugins)CVE-2017-0261: Microsoft Office, patched 2017-05-09 (Office, apps and plugins)CVE-2017-0262: Microsoft Office, patched 2017-05-09 (Office, apps and plugins)CVE-2017-0263: Microsoft Windows, patched 2017-05-09 (Desktop OS)CVE-2017-0222: Microsoft Internet Explorer, patched 2017-05-09 (Browsers)CVE-2017-8464: Microsoft Windows, patched 2017-06-13 (Desktop OS)CVE-2017-8543: Microsoft Windows, patched 2017-06-13 (Desktop OS)CVE-2017-8759: Microsoft Office, patched 2017-09-12 (Office, apps and plugins)CVE-2017-11826: Microsoft Office, patched 2017-10-10 (Office, apps and plugins)CVE-2018-0802: Microsoft Office, patched 2018-01-09 (Office, apps and plugins)CVE-2018-8120: Microsoft Windows, patched 2018-05-08 (Desktop OS)CVE-2018-8174: Microsoft VBScript, patched 2018-05-08 (Browsers)CVE-2018-8373: Microsoft VBScript, patched 2018-08-14 (Browsers)CVE-2018-8453: Microsoft Windows, patched 2018-10-09 (Desktop OS)CVE-2018-8589: Microsoft Windows, patched 2018-11-13 (Desktop OS)CVE-2018-8611: Microsoft Windows, patched 2018-12-11 (Desktop OS)CVE-2018-8653: Microsoft Internet Explorer, patched 2018-12-19 (Browsers)CVE-2019-0676: Microsoft Internet Explorer, patched 2019-02-12 (Browsers)CVE-2019-0808: Microsoft Windows, patched 2019-03-12 (Desktop OS)CVE-2019-0797: Microsoft Windows, patched 2019-03-12 (Desktop OS)CVE-2019-0703: Microsoft Windows, patched 2019-03-12 (Desktop OS)CVE-2019-0803: Microsoft Windows, patched 2019-04-09 (Desktop OS)CVE-2019-0859: Microsoft Windows, patched 2019-04-09 (Desktop OS)CVE-2019-0880: Microsoft Windows, patched 2019-07-09 (Desktop OS)CVE-2019-1132: Microsoft Windows, patched 2019-07-09 (Desktop OS)CVE-2019-1367: Microsoft Internet Explorer, patched 2019-09-23 (Browsers)CVE-2019-1429: Microsoft Internet Explorer, patched 2019-11-12 (Browsers)CVE-2019-1458: Microsoft Windows, patched 2019-12-10 (Desktop OS)CVE-2020-0674: Microsoft Internet Explorer, patched 2020-02-11 (Browsers)CVE-2020-0938: Microsoft Windows, patched 2020-04-14 (Desktop OS)CVE-2020-1020: Microsoft Windows, patched 2020-04-14 (Desktop OS)CVE-2020-1027: Microsoft Windows, patched 2020-04-14 (Desktop OS)CVE-2020-0986: Microsoft Windows, patched 2020-06-09 (Desktop OS)CVE-2020-1380: Microsoft Internet Explorer, patched 2020-08-11 (Browsers)CVE-2020-17087: Microsoft Windows, patched 2020-11-10 (Desktop OS)CVE-2021-1647: Microsoft Windows Defender, patched 2021-01-12 (Desktop OS)CVE-2021-1732: Microsoft Windows, patched 2021-02-09 (Desktop OS)CVE-2021-26855: Microsoft Exchange Server, patched 2021-03-02 (Enterprise, edge and security products)CVE-2021-26857: Microsoft Exchange Server, patched 2021-03-02 (Enterprise, edge and security products)CVE-2021-26858: Microsoft Exchange Server, patched 2021-03-02 (Enterprise, edge and security products)CVE-2021-27065: Microsoft Exchange Server, patched 2021-03-02 (Enterprise, edge and security products)CVE-2021-26411: Microsoft Internet Explorer, patched 2021-03-09 (Browsers)CVE-2021-28310: Microsoft Windows, patched 2021-04-13 (Desktop OS)CVE-2021-31955: Microsoft Windows, patched 2021-06-08 (Desktop OS)CVE-2021-31956: Microsoft Windows, patched 2021-06-08 (Desktop OS)CVE-2021-33742: Microsoft Internet Explorer, patched 2021-06-08 (Browsers)CVE-2021-31199: Microsoft Windows, patched 2021-06-08 (Desktop OS)CVE-2021-31201: Microsoft Windows, patched 2021-06-08 (Desktop OS)CVE-2021-33771: Microsoft Windows, patched 2021-07-13 (Desktop OS)CVE-2021-34448: Microsoft Internet Explorer, patched 2021-07-13 (Browsers)CVE-2021-31979: Microsoft Windows, patched 2021-07-13 (Desktop OS)CVE-2021-36948: Microsoft Windows, patched 2021-08-11 (Desktop OS)CVE-2021-40444: Microsoft Internet Explorer, patched 2021-09-14 (Browsers)CVE-2021-40449: Microsoft Windows, patched 2021-10-12 (Desktop OS)CVE-2021-42292: Microsoft Office, patched 2021-11-09 (Office, apps and plugins)CVE-2021-42321: Microsoft Exchange Server, patched 2021-11-09 (Enterprise, edge and security products)CVE-2022-21882: Microsoft Windows, patched 2022-01-11 (Desktop OS)CVE-2022-24521: Microsoft Windows, patched 2022-04-12 (Desktop OS)CVE-2022-26925: Microsoft Windows, patched 2022-05-10 (Desktop OS)CVE-2022-30190: Microsoft Windows, patched 2022-06-14 (Desktop OS)CVE-2022-22047: Microsoft Windows, patched 2022-07-12 (Desktop OS)CVE-2022-41033: Microsoft Windows, patched 2022-10-11 (Desktop OS)CVE-2022-41040: Microsoft Exchange Server, patched 2022-11-08 (Enterprise, edge and security products)CVE-2022-41082: Microsoft Exchange Server, patched 2022-11-08 (Enterprise, edge and security products)CVE-2022-41128: Microsoft Internet Explorer, patched 2022-11-08 (Browsers)CVE-2022-41073: Microsoft Windows, patched 2022-11-08 (Desktop OS)CVE-2022-41125: Microsoft Windows, patched 2022-11-08 (Desktop OS)CVE-2023-21674: Microsoft Windows, patched 2023-01-10 (Desktop OS)CVE-2023-21823: Microsoft Windows, patched 2023-02-14 (Desktop OS)CVE-2023-23376: Microsoft Windows, patched 2023-02-14 (Desktop OS)CVE-2023-23397: Microsoft Outlook, patched 2023-03-14 (Office, apps and plugins)CVE-2023-21768: Microsoft Windows, patched 2023-03-14 (Desktop OS)CVE-2023-28252: Microsoft Windows, patched 2023-04-11 (Desktop OS)CVE-2023-29336: Microsoft Windows, patched 2023-05-09 (Desktop OS)CVE-2023-32046: Microsoft Windows, patched 2023-07-11 (Desktop OS)CVE-2023-36874: Microsoft Windows, patched 2023-07-11 (Desktop OS)CVE-2023-36884: Microsoft Windows, patched 2023-08-08 (Desktop OS)CVE-2023-36802: Microsoft Windows, patched 2023-09-12 (Desktop OS)CVE-2023-36761: Microsoft Word, patched 2023-09-12 (Office, apps and plugins)CVE-2023-36036: Microsoft Windows, patched 2023-11-14 (Desktop OS)CVE-2023-36033: Microsoft Windows, patched 2023-11-14 (Desktop OS)CVE-2024-21338: Microsoft Windows, patched 2024-02-13 (Desktop OS)CVE-2024-30051: Microsoft Windows, patched 2024-05-14 (Desktop OS)CVE-2024-38080: Microsoft Windows, patched 2024-07-09 (Desktop OS)CVE-2024-38178: Microsoft Windows, patched 2024-08-13 (Desktop OS)CVE-2024-38106: Microsoft Windows, patched 2024-08-13 (Desktop OS)CVE-2024-38193: Microsoft Windows, patched 2024-08-13 (Desktop OS)CVE-2024-38107: Microsoft Windows, patched 2024-08-13 (Desktop OS)CVE-2024-38189: Microsoft Project, patched 2024-08-13 (Office, apps and plugins)CVE-2024-49039: Microsoft Windows, patched 2024-11-12 (Desktop OS)CVE-2024-49138: Microsoft Windows, patched 2024-12-10 (Desktop OS)CVE-2025-21391: Microsoft Windows, patched 2025-02-11 (Desktop OS)CVE-2025-21418: Microsoft Windows, patched 2025-02-11 (Desktop OS)CVE-2025-26633: Microsoft Windows, patched 2025-03-11 (Desktop OS)CVE-2025-24993: Microsoft Windows, patched 2025-03-11 (Desktop OS)CVE-2025-24985: Microsoft Windows, patched 2025-03-11 (Desktop OS)CVE-2025-24983: Microsoft Windows, patched 2025-03-11 (Desktop OS)CVE-2025-24984: Microsoft Windows, patched 2025-03-11 (Desktop OS)CVE-2025-24991: Microsoft Windows, patched 2025-03-11 (Desktop OS)CVE-2025-29824: Microsoft Windows, patched 2025-04-08 (Desktop OS)CVE-2025-32701: Microsoft Windows, patched 2025-05-13 (Desktop OS)CVE-2025-30397: Microsoft Windows, patched 2025-05-13 (Desktop OS)CVE-2025-30400: Microsoft Windows, patched 2025-05-13 (Desktop OS)CVE-2025-32709: Microsoft Windows, patched 2025-05-13 (Desktop OS)CVE-2025-32706: Microsoft Windows, patched 2025-05-13 (Desktop OS)CVE-2025-33053: Microsoft Windows, patched 2025-06-10 (Desktop OS)CVE-2025-53770: Microsoft SharePoint, patched 2025-07-19 (Enterprise, edge and security products)CVE-2025-59230: Microsoft Windows, patched 2025-10-14 (Desktop OS)CVE-2025-62215: Microsoft Windows, patched 2025-11-11 (Desktop OS)CVE-2025-62221: Microsoft Windows, patched 2025-12-09 (Desktop OS)CVE-2026-20805: Microsoft Windows, patched 2026-01-13 (Desktop OS)CVE-2026-21509: Microsoft Office, patched 2026-01-26 (Office, apps and plugins)CVE-2026-21510: Microsoft Office, patched 2026-02-10 (Office, apps and plugins)CVE-2026-21513: Microsoft Office, patched 2026-02-10 (Office, apps and plugins)CVE-2026-21514: Microsoft Office, patched 2026-02-10 (Office, apps and plugins)CVE-2026-21519: Microsoft Windows, patched 2026-02-10 (Desktop OS)CVE-2026-21533: Microsoft Windows, patched 2026-02-10 (Desktop OS)CVE-2026-32201: Microsoft SharePoint, patched 2026-04-12 (Enterprise, edge and security products)CVE-2026-42897: Microsoft Exchange, patched 2026-05-14 (Enterprise, edge and security products)CVE-2026-56155: Microsoft Windows, patched 2026-07-14 (Desktop OS)CVE-2026-56164: Microsoft SharePoint, patched 2026-07-14 (Enterprise, edge and security products)CVE-2026-68820: Microsoft Windows, patched 2026-08-11 (Desktop OS)CVE-2026-85880: Microsoft Windows, patched 2026-09-09 (Desktop OS)Google80CVE-2019-5786: Google Chrome, patched 2019-03-01 (Browsers)CVE-2019-2215: Google Android, patched 2019-10-06 (Mobile OS and chipsets)CVE-2019-13720: Google Chrome, patched 2019-10-31 (Browsers)CVE-2020-6418: Google Chrome, patched 2020-02-24 (Browsers)CVE-2020-6453: Google Chrome, patched 2020-03-31 (Browsers)CVE-2020-6572: Google Chrome, patched 2020-04-07 (Browsers)CVE-2020-15999: Google Chrome, patched 2020-10-20 (Browsers)CVE-2020-16009: Google Chrome, patched 2020-11-02 (Browsers)CVE-2020-16010: Google Chrome, patched 2020-11-02 (Browsers)CVE-2020-16013: Google Chrome, patched 2020-11-11 (Browsers)CVE-2020-16017: Google Chrome, patched 2020-11-11 (Browsers)CVE-2021-21148: Google Chrome, patched 2021-02-04 (Browsers)CVE-2021-21166: Google Chrome, patched 2021-03-02 (Browsers)CVE-2021-21193: Google Chrome, patched 2021-03-12 (Browsers)CVE-2021-21206: Google Chrome, patched 2021-04-13 (Browsers)CVE-2021-30551: Google Chrome, patched 2021-06-09 (Browsers)CVE-2021-30554: Google Chrome, patched 2021-06-17 (Browsers)CVE-2021-30563: Google Chrome, patched 2021-07-15 (Browsers)CVE-2021-30632: Google Chrome, patched 2021-09-13 (Browsers)CVE-2021-30633: Google Chrome, patched 2021-09-13 (Browsers)CVE-2021-37973: Google Chrome, patched 2021-09-24 (Browsers)CVE-2021-37975: Google Chrome, patched 2021-09-30 (Browsers)CVE-2021-37976: Google Chrome, patched 2021-09-30 (Browsers)CVE-2021-38000: Google Chrome, patched 2021-10-28 (Browsers)CVE-2021-38003: Google Chrome, patched 2021-10-28 (Browsers)CVE-2021-0920: Google Android, patched 2021-11-05 (Mobile OS and chipsets)CVE-2021-1048: Google Android, patched 2021-11-06 (Mobile OS and chipsets)CVE-2021-4102: Google Chrome, patched 2021-12-13 (Browsers)CVE-2022-0609: Google Chrome, patched 2022-02-15 (Browsers)CVE-2021-22600: Google Android, patched 2022-03-07 (Mobile OS and chipsets)CVE-2022-1096: Google Chrome, patched 2022-03-25 (Browsers)CVE-2022-1364: Google Chrome, patched 2022-04-14 (Browsers)CVE-2022-2294: Google Chrome, patched 2022-07-04 (Browsers)CVE-2022-2856: Google Chrome, patched 2022-08-16 (Browsers)CVE-2022-3075: Google Chrome, patched 2022-09-02 (Browsers)CVE-2022-3723: Google Chrome, patched 2022-10-27 (Browsers)CVE-2022-4135: Google Chrome, patched 2022-11-24 (Browsers)CVE-2022-4262: Google Chrome, patched 2022-12-02 (Browsers)CVE-2023-20963: Google Android, patched 2023-03-06 (Mobile OS and chipsets)CVE-2023-2033: Google Chrome, patched 2023-04-14 (Browsers)CVE-2023-2136: Google Chrome, patched 2023-04-18 (Browsers)CVE-2023-0266: Google Android, patched 2023-05-01 (Mobile OS and chipsets)CVE-2023-3079: Google Chrome, patched 2023-06-05 (Browsers)CVE-2023-35674: Google Android, patched 2023-09-05 (Mobile OS and chipsets)CVE-2023-4762: Google Chrome, patched 2023-09-05 (Browsers)CVE-2023-4863: Google Chrome, patched 2023-09-12 (Browsers)CVE-2023-5217: Google Chrome, patched 2023-09-27 (Browsers)CVE-2023-6345: Google Chrome, patched 2023-11-28 (Browsers)CVE-2023-7024: Google Chrome, patched 2023-12-20 (Browsers)CVE-2024-0519: Google Chrome, patched 2024-01-16 (Browsers)CVE-2024-29745: Google Android, patched 2024-04-02 (Mobile OS and chipsets)CVE-2024-29748: Google Android, patched 2024-04-02 (Mobile OS and chipsets)CVE-2024-4671: Google Chrome, patched 2024-05-09 (Browsers)CVE-2024-4761: Google Chrome, patched 2024-05-13 (Browsers)CVE-2024-4947: Google Chrome, patched 2024-05-15 (Browsers)CVE-2024-5274: Google Chrome, patched 2024-05-23 (Browsers)CVE-2024-32896: Google Android, patched 2024-06-11 (Mobile OS and chipsets)CVE-2024-36971: Google Android, patched 2024-08-05 (Mobile OS and chipsets)CVE-2024-7971: Google Chrome, patched 2024-08-21 (Browsers)CVE-2024-7965: Google Chrome, patched 2024-08-21 (Browsers)CVE-2024-43093: Google Android, patched 2024-11-04 (Mobile OS and chipsets)CVE-2024-53104: Google Android, patched 2025-02-01 (Mobile OS and chipsets)CVE-2024-50302: Google Android, patched 2025-03-01 (Mobile OS and chipsets)CVE-2025-2783: Google Chrome, patched 2025-03-25 (Browsers)CVE-2024-53197: Google Android, patched 2025-04-01 (Mobile OS and chipsets)CVE-2024-53150: Google Android, patched 2025-04-01 (Mobile OS and chipsets)CVE-2025-5419: Google Chrome, patched 2025-06-02 (Browsers)CVE-2025-6554: Google Chrome, patched 2025-06-30 (Browsers)CVE-2025-6558: Google Chrome, patched 2025-07-15 (Browsers)CVE-2025-38352: Google Android, patched 2025-09-01 (Mobile OS and chipsets)CVE-2025-48543: Google Android, patched 2025-09-01 (Mobile OS and chipsets)CVE-2025-10585: Google Chrome, patched 2025-09-17 (Browsers)CVE-2025-13223: Google Chrome, patched 2025-11-12 (Browsers)CVE-2026-2441: Google Chrome, patched 2026-02-13 (Browsers)CVE-2026-3909: Google Chrome, patched 2026-03-12 (Browsers)CVE-2026-3910: Google Chrome, patched 2026-03-12 (Browsers)CVE-2026-5281: Google Chrome, patched 2026-03-31 (Browsers)CVE-2026-11645: Google Chrome, patched 2026-06-08 (Browsers)CVE-2026-85046: Google Chrome, patched 2026-09-03 (Browsers)CVE-2026-87491: Google Chrome, patched 2026-09-08 (Browsers)Apple67CVE-2016-4655: Apple iOS, patched 2016-08-25 (Mobile OS and chipsets)CVE-2016-4656: Apple iOS, patched 2016-08-25 (Mobile OS and chipsets)CVE-2016-4657: Apple WebKit, patched 2016-08-25 (Browsers)CVE-2019-7286: Apple iOS, patched 2019-02-07 (Mobile OS and chipsets)CVE-2019-7287: Apple iOS, patched 2019-02-07 (Mobile OS and chipsets)CVE-2020-27930: Apple iOS, patched 2020-11-05 (Mobile OS and chipsets)CVE-2020-27950: Apple iOS, patched 2020-11-05 (Mobile OS and chipsets)CVE-2020-27932: Apple iOS, patched 2020-11-05 (Mobile OS and chipsets)CVE-2021-1782: Apple iOS, patched 2021-01-26 (Mobile OS and chipsets)CVE-2021-1870: Apple WebKit, patched 2021-01-26 (Browsers)CVE-2021-1871: Apple WebKit, patched 2021-01-26 (Browsers)CVE-2021-1879: Apple WebKit, patched 2021-03-26 (Browsers)CVE-2021-30661: Apple WebKit, patched 2021-04-26 (Browsers)CVE-2021-30665: Apple WebKit, patched 2021-05-03 (Browsers)CVE-2021-30663: Apple WebKit, patched 2021-05-03 (Browsers)CVE-2021-30807: Apple iOS, patched 2021-07-26 (Mobile OS and chipsets)CVE-2021-30860: Apple iOS, patched 2021-09-13 (Mobile OS and chipsets)CVE-2021-30858: Apple WebKit, patched 2021-09-13 (Browsers)CVE-2021-31010: Apple iOS, patched 2021-09-13 (Mobile OS and chipsets)CVE-2021-30869: Apple macOS, patched 2021-09-23 (Desktop OS)CVE-2021-30883: Apple iOS, patched 2021-10-11 (Mobile OS and chipsets)CVE-2021-30983: Apple iOS, patched 2021-12-13 (Mobile OS and chipsets)CVE-2022-22587: Apple iOS/macOS, patched 2022-01-26 (Mobile OS and chipsets)CVE-2022-22620: Apple WebKit, patched 2022-02-10 (Browsers)CVE-2022-22674: Apple macOS, patched 2022-03-31 (Desktop OS)CVE-2022-22675: Apple iOS/macOS, patched 2022-03-31 (Mobile OS and chipsets)CVE-2022-32894: Apple iOS/macOS, patched 2022-08-17 (Mobile OS and chipsets)CVE-2022-32893: Apple WebKit, patched 2022-08-17 (Browsers)CVE-2022-32917: Apple iOS/macOS, patched 2022-09-12 (Mobile OS and chipsets)CVE-2022-42827: Apple iOS, patched 2022-10-24 (Mobile OS and chipsets)CVE-2022-42856: Apple WebKit, patched 2022-11-30 (Browsers)CVE-2023-23529: Apple WebKit, patched 2023-02-13 (Browsers)CVE-2023-28206: Apple iOS, patched 2023-04-07 (Mobile OS and chipsets)CVE-2023-28205: Apple WebKit, patched 2023-04-07 (Browsers)CVE-2023-28204: Apple WebKit, patched 2023-05-01 (Browsers)CVE-2023-32373: Apple WebKit, patched 2023-05-01 (Browsers)CVE-2023-32409: Apple WebKit, patched 2023-05-18 (Browsers)CVE-2023-32434: Apple iOS, patched 2023-06-21 (Mobile OS and chipsets)CVE-2023-32435: Apple WebKit, patched 2023-06-21 (Browsers)CVE-2023-32439: Apple WebKit, patched 2023-06-21 (Browsers)CVE-2023-37450: Apple WebKit, patched 2023-07-10 (Browsers)CVE-2023-38606: Apple iOS, patched 2023-07-24 (Mobile OS and chipsets)CVE-2023-41990: Apple iOS, patched 2023-07-24 (Mobile OS and chipsets)CVE-2023-41064: Apple iOS, patched 2023-09-07 (Mobile OS and chipsets)CVE-2023-41061: Apple iOS, patched 2023-09-07 (Mobile OS and chipsets)CVE-2023-41992: Apple iOS, patched 2023-09-21 (Mobile OS and chipsets)CVE-2023-41991: Apple iOS, patched 2023-09-21 (Mobile OS and chipsets)CVE-2023-41993: Apple WebKit, patched 2023-09-21 (Browsers)CVE-2023-42824: Apple iOS, patched 2023-10-04 (Mobile OS and chipsets)CVE-2023-42916: Apple WebKit, patched 2023-11-30 (Browsers)CVE-2023-42917: Apple WebKit, patched 2023-11-30 (Browsers)CVE-2024-23222: Apple WebKit, patched 2024-01-22 (Browsers)CVE-2024-23225: Apple iOS, patched 2024-03-05 (Mobile OS and chipsets)CVE-2024-23296: Apple iOS, patched 2024-03-06 (Mobile OS and chipsets)CVE-2024-44308: Apple WebKit, patched 2024-11-19 (Browsers)CVE-2024-44309: Apple WebKit, patched 2024-11-19 (Browsers)CVE-2025-24085: Apple iOS, patched 2025-01-27 (Mobile OS and chipsets)CVE-2025-24200: Apple iOS, patched 2025-02-10 (Mobile OS and chipsets)CVE-2025-24201: Apple WebKit, patched 2025-03-11 (Browsers)CVE-2025-31200: Apple iOS, patched 2025-04-16 (Mobile OS and chipsets)CVE-2025-31201: Apple iOS, patched 2025-04-16 (Mobile OS and chipsets)CVE-2025-43200: Apple Message, patched 2025-06-11 (Mobile OS and chipsets)CVE-2025-43300: Apple iOS, patched 2025-08-20 (Mobile OS and chipsets)CVE-2025-43529: Apple WebKit, patched 2025-12-12 (Browsers)CVE-2025-14174: Apple WebKit, patched 2025-12-12 (Browsers)CVE-2026-20700: Apple iOS, patched 2026-02-11 (Mobile OS and chipsets)CVE-2026-86950: Apple iOS, patched 2026-09-29 (Mobile OS and chipsets)Adobe29CVE-2014-0546: Adobe Reader, patched 2014-08-12 (Office, apps and plugins)CVE-2014-8439: Adobe Flash, patched 2014-10-14 (Office, apps and plugins)CVE-2014-9163: Adobe Flash, patched 2014-12-09 (Office, apps and plugins)CVE-2015-0310: Adobe Flash, patched 2015-01-22 (Office, apps and plugins)CVE-2015-0311: Adobe Flash, patched 2015-01-27 (Office, apps and plugins)CVE-2015-0313: Adobe Flash, patched 2015-02-05 (Office, apps and plugins)CVE-2015-3043: Adobe Flash, patched 2015-04-14 (Office, apps and plugins)CVE-2015-3113: Adobe Flash, patched 2015-06-23 (Office, apps and plugins)CVE-2015-5119: Adobe Flash, patched 2015-07-08 (Office, apps and plugins)CVE-2015-5122: Adobe Flash, patched 2015-07-14 (Office, apps and plugins)CVE-2015-5123: Adobe Flash, patched 2015-07-14 (Office, apps and plugins)CVE-2015-7645: Adobe Flash, patched 2015-10-16 (Office, apps and plugins)CVE-2015-8651: Adobe Flash, patched 2015-12-28 (Office, apps and plugins)CVE-2016-0984: Adobe Flash, patched 2016-02-09 (Office, apps and plugins)CVE-2016-1010: Adobe Flash, patched 2016-03-10 (Office, apps and plugins)CVE-2016-1019: Adobe Flash, patched 2016-04-07 (Office, apps and plugins)CVE-2016-4117: Adobe Flash, patched 2016-05-12 (Office, apps and plugins)CVE-2016-4171: Adobe Flash, patched 2016-06-15 (Office, apps and plugins)CVE-2016-7855: Adobe Flash, patched 2016-10-26 (Office, apps and plugins)CVE-2016-7892: Adobe Flash, patched 2016-12-13 (Office, apps and plugins)CVE-2017-11292: Adobe Flash, patched 2017-10-16 (Office, apps and plugins)CVE-2018-4878: Adobe Flash, patched 2018-02-06 (Office, apps and plugins)CVE-2018-4990: Adobe Reader, patched 2018-05-14 (Office, apps and plugins)CVE-2018-5002: Adobe Flash, patched 2018-06-07 (Office, apps and plugins)CVE-2018-15982: Adobe Flash, patched 2018-12-05 (Office, apps and plugins)CVE-2021-21017: Adobe Reader, patched 2021-02-09 (Office, apps and plugins)CVE-2021-28550: Adobe Reader, patched 2021-05-11 (Office, apps and plugins)CVE-2023-26369: Adobe Reader, patched 2023-09-12 (Office, apps and plugins)CVE-2026-34621: Adobe Acrobat Reader, patched 2026-04-12 (Office, apps and plugins)Samsung13CVE-2021-25337: Samsung Android, patched 2021-03-01 (Mobile OS and chipsets)CVE-2021-25369: Samsung Android, patched 2021-03-01 (Mobile OS and chipsets)CVE-2021-25370: Samsung Android, patched 2021-03-01 (Mobile OS and chipsets)CVE-2021-25371: Samsung Android, patched 2021-03-01 (Mobile OS and chipsets)CVE-2021-25372: Samsung Android, patched 2021-03-01 (Mobile OS and chipsets)CVE-2021-25394: Samsung Android, patched 2021-05-01 (Mobile OS and chipsets)CVE-2021-25395: Samsung Android, patched 2021-05-01 (Mobile OS and chipsets)CVE-2021-25487: Samsung Android, patched 2021-10-01 (Mobile OS and chipsets)CVE-2021-25489: Samsung Android, patched 2021-10-01 (Mobile OS and chipsets)CVE-2022-22265: Samsung Android, patched 2022-01-01 (Mobile OS and chipsets)CVE-2023-21492: Samsung Android, patched 2023-05-01 (Mobile OS and chipsets)CVE-2024-44068: Samsung Exynos DSP, patched 2024-10-07 (Mobile OS and chipsets)CVE-2025-21043: Samsung Samsung Mobile, patched 2025-09-12 (Mobile OS and chipsets)Qualcomm11CVE-2020-11261: Qualcomm Android, patched 2021-01-04 (Mobile OS and chipsets)CVE-2021-1905: Qualcomm Android, patched 2021-05-03 (Mobile OS and chipsets)CVE-2021-1906: Qualcomm Android, patched 2021-05-03 (Mobile OS and chipsets)CVE-2023-33106: Qualcomm Android, patched 2023-12-04 (Mobile OS and chipsets)CVE-2023-33107: Qualcomm Android, patched 2023-12-04 (Mobile OS and chipsets)CVE-2023-33063: Qualcomm Android, patched 2023-12-04 (Mobile OS and chipsets)CVE-2024-43047: Qualcomm DSP Service, patched 2024-10-07 (Mobile OS and chipsets)CVE-2025-21479: Qualcomm GPU, patched 2025-06-02 (Mobile OS and chipsets)CVE-2025-21480: Qualcomm GPU, patched 2025-06-02 (Mobile OS and chipsets)CVE-2025-27038: Qualcomm GPU, patched 2025-06-02 (Mobile OS and chipsets)CVE-2026-21385: Qualcomm GPU, patched 2026-03-02 (Mobile OS and chipsets)Mozilla10CVE-2015-4495: Mozilla Firefox, patched 2015-08-06 (Browsers)CVE-2016-9079: Mozilla Firefox, patched 2016-11-30 (Browsers)CVE-2019-11707: Mozilla Firefox, patched 2019-06-18 (Browsers)CVE-2019-11708: Mozilla Firefox, patched 2019-06-20 (Browsers)CVE-2019-17026: Mozilla Firefox, patched 2020-01-08 (Browsers)CVE-2020-6819: Mozilla Firefox, patched 2020-04-03 (Browsers)CVE-2020-6820: Mozilla Firefox, patched 2020-04-03 (Browsers)CVE-2022-26485: Mozilla Firefox, patched 2022-03-05 (Browsers)CVE-2022-26486: Mozilla Firefox, patched 2022-03-05 (Browsers)CVE-2024-9680: Mozilla Firefox, patched 2024-10-09 (Browsers)ARM6CVE-2021-28663: ARM Android, patched 2021-05-03 (Mobile OS and chipsets)CVE-2021-28664: ARM Android, patched 2021-05-03 (Mobile OS and chipsets)CVE-2021-39793: ARM Android, patched 2022-03-07 (Mobile OS and chipsets)CVE-2023-26083: ARM Android, patched 2023-03-31 (Mobile OS and chipsets)CVE-2023-4211: ARM Android, patched 2023-10-02 (Mobile OS and chipsets)CVE-2024-4610: ARM Android, patched 2024-06-07 (Mobile OS and chipsets)All other vendors30CVE-2015-2590: Oracle Java, patched 2015-07-14 (Office, apps and plugins)CVE-2015-4902: Oracle Java, patched 2015-10-20 (Office, apps and plugins)CVE-2016-6366: Cisco ASA, patched 2016-08-17 (Enterprise, edge and security products)CVE-2016-6367: Cisco ASA, patched 2016-08-17 (Enterprise, edge and security products)CVE-2016-5195: Linux Kernel, patched 2016-10-18 (Desktop OS)CVE-2017-3881: Cisco IOS, patched 2017-03-17 (Enterprise, edge and security products)CVE-2017-1274: IBM Domino, patched 2017-03-20 (Enterprise, edge and security products)CVE-2017-8291: Ghostscript Ghostscript, patched 2017-04-27 (Office, apps and plugins)CVE-2019-3568: Meta WhatsApp, patched 2019-05-13 (Office, apps and plugins)CVE-2019-18187: Trend Micro OfficeScan, patched 2019-10-28 (Enterprise, edge and security products)CVE-2020-8467: Trend Micro Apex One/OfficeScan, patched 2020-03-16 (Enterprise, edge and security products)CVE-2020-8468: Trend Micro Apex One/OfficeScan, patched 2020-03-16 (Enterprise, edge and security products)CVE-2020-12271: Sophos XG Firewall, patched 2020-04-25 (Enterprise, edge and security products)CVE-2020-4006: VMware VMware Workspace ONE Access, patched 2020-12-03 (Enterprise, edge and security products)CVE-2021-41773: Apache HTTP Server, patched 2021-10-04 (Enterprise, edge and security products)CVE-2022-24682: Synacor Zimbra Collaboration Suite, patched 2022-02-05 (Enterprise, edge and security products)CVE-2022-1040: Sophos Firewall, patched 2022-03-25 (Enterprise, edge and security products)CVE-2022-26871: Trend Micro Apex Central, patched 2022-03-31 (Enterprise, edge and security products)CVE-2022-26134: Atlassian Confluence Server & Data Center, patched 2022-06-03 (Enterprise, edge and security products)CVE-2022-3236: Sophos Firewall, patched 2022-09-23 (Enterprise, edge and security products)CVE-2022-42475: Fortinet FortiOS, patched 2022-12-12 (Enterprise, edge and security products)CVE-2022-27518: Citrix ADC/Gateway, patched 2022-12-13 (Enterprise, edge and security products)CVE-2023-2868: Barracuda Email Security Gateway, patched 2023-05-30 (Enterprise, edge and security products)CVE-2023-37580: Synacor Zimbra, patched 2023-07-26 (Enterprise, edge and security products)CVE-2023-38831: WinRAR WinRAR, patched 2023-08-02 (Office, apps and plugins)CVE-2023-22515: Atlassian Confluence, patched 2023-10-04 (Enterprise, edge and security products)CVE-2024-7262: Kingsoft WPS Office, patched 2024-03-15 (Office, apps and plugins)CVE-2025-22225: VMware VMware ESXi, patched 2025-03-04 (Enterprise, edge and security products)CVE-2025-27363: FreeType FreeType, patched 2025-03-11 (Office, apps and plugins)CVE-2025-55177: Meta WhatsApp, patched 2025-08-20 (Office, apps and plugins)

    Source: Google Project Zero, “0day In the Wild” spreadsheet, all year tabs, retrieved October 2026. Categories assigned by The Uptime Report from the tracker’s Product field. Hover a dot for the CVE.

    The strip chart makes the concentration plain. Microsoft, Google and Apple account for 313 of the 412 entries, or 76%. Windows alone has 106 (counting the tracker’s separate “Windows Kernel” rows), and Chrome has 62. The early years are dominated by Adobe Flash and Internet Explorer, with 23 Flash and 23 Internet Explorer zero-days. The last Flash entry is in 2018 and the last Internet Explorer entry in 2022. From 2021 onward, Android chipset and device makers (Samsung, Qualcomm and Arm) appear as rows of their own, with 14 entries in 2021 alone.

    Vendor Zero-days Share 2014 to 2019 2020 to 2023 2024 to 2026* Most-hit product Median days to patch
    Microsoft 166 40.3% 71 53 42 Windows (98) 24 (n=25)
    Google 80 19.4% 3 46 31 Chrome (62) 4 (n=53)
    Apple 67 16.3% 5 46 16 iOS (32) 9.5 (n=10)
    Adobe 29 7.0% 25 3 1 Flash (23) 6 (n=14)
    Samsung 13 3.2% 0 11 2 Android (11) 81 (n=10)
    Qualcomm 11 2.7% 0 6 5 Android (6) 167 (n=4)
    Mozilla 10 2.4% 4 5 1 Firefox (10) 1 (n=5)
    ARM 6 1.5% 0 5 1 Android (6) n<4
    All other vendors (18) 30 7.3% 10 16 4 Java (2) 7 (n=11)

    *2026 through September 29, 2026. Years are the tracker’s year tabs. Median days to patch uses only entries with a recorded discovery date; see the time to patch section.

    Zero-days per year, by product category

    Project Zero tracker entries per year, with Google’s fuller annual count outlined

    BrowsersMobile OS and chipsetsDesktop OSOffice, apps and pluginsEnterprise, edge and security products

    0204060801002014: 2 Browsers2014: 4 Desktop OS2014: 5 Office, apps and plugins1120142015: 4 Browsers2015: 8 Desktop OS2015: 16 Office, apps and plugins2820152016: 6 Browsers2016: 2 Mobile OS and chipsets2016: 6 Desktop OS2016: 9 Office, apps and plugins2016: 2 Enterprise, edge and security products2520162017: 3 Browsers2017: 10 Desktop OS2017: 7 Office, apps and plugins2017: 2 Enterprise, edge and security products2220172018: 3 Browsers2018: 4 Desktop OS2018: 5 Office, apps and plugins1220182019: 7 Browsers2019: 3 Mobile OS and chipsets2019: 8 Desktop OS2019: 1 Office, apps and plugins2019: 1 Enterprise, edge and security products2020192020: 13 Browsers2020: 3 Mobile OS and chipsets2020: 5 Desktop OS2020: 4 Enterprise, edge and security products2520202021: GTIG counted 106 zero-daysGTIG 1062021: 26 Browsers2021: 22 Mobile OS and chipsets2021: 12 Desktop OS2021: 3 Office, apps and plugins2021: 6 Enterprise, edge and security products6920212022: GTIG counted 63 zero-daysGTIG 632022: 15 Browsers2022: 8 Mobile OS and chipsets2022: 9 Desktop OS2022: 9 Enterprise, edge and security products4120222023: GTIG counted 100 zero-daysGTIG 1002023: 19 Browsers2023: 18 Mobile OS and chipsets2023: 12 Desktop OS2023: 4 Office, apps and plugins2023: 3 Enterprise, edge and security products5620232024: GTIG counted 78 zero-daysGTIG 782024: 11 Browsers2024: 14 Mobile OS and chipsets2024: 9 Desktop OS2024: 2 Office, apps and plugins3620242025: GTIG counted 90 zero-daysGTIG 902025: 9 Browsers2025: 12 Mobile OS and chipsets2025: 18 Desktop OS2025: 2 Office, apps and plugins2025: 2 Enterprise, edge and security products4320252026: 7 Browsers2026: 3 Mobile OS and chipsets2026: 6 Desktop OS2026: 5 Office, apps and plugins2026: 3 Enterprise, edge and security products242026*

    Filled bars: Project Zero tracker entries per year tab. Dashed outlines: zero-days counted by Google Threat Intelligence Group (GTIG) in its annual reviews, latest revised figure. *2026 through September 29, 2026.

    The tracker peaked at 69 zero-days in 2021, then logged 41, 56, 36 and 43 in the four years after. For 2026, it lists 24 patched from January 1 to September 29, 2026, compared with 37 in the same window of 2025. Because the sheet is maintained by hand, treat the 2026 figure as a floor.

    The dashed outlines show the most important caveat in any set of zero-day statistics. Google Threat Intelligence Group (GTIG), whose annual review grew out of a joint report by Google’s Threat Analysis Group and Mandiant, counts more. Its latest figures are 106 for 2021, 63 for 2022, 100 for 2023, 78 for 2024 and 90 for 2025. The public tracker held 65% of Google’s count in 2021 but only 46% in 2024 and 48% in 2025. The tracker’s own notes explain why: it generally covers products Project Zero researches. It logged 15 enterprise, edge or security product zero-days in 2021 and 2022, then 5 of 103 entries since 2024 (3 SharePoint, 1 VMware ESXi, 1 Exchange), and no firewall, VPN or other edge appliance at all. The segment Google says is growing fastest is the one the public sheet no longer tracks.

    Year Tracker total Browsers Mobile OS and chipsets Desktop OS Office, apps and plugins Enterprise, edge and security products Browser share GTIG count Tracker as % of GTIG
    2014 11 2 0 4 5 0 18%
    2015 28 4 0 8 16 0 14%
    2016 25 6 2 6 9 2 24%
    2017 22 3 0 10 7 2 14%
    2018 12 3 0 4 5 0 25%
    2019 20 7 3 8 1 1 35%
    2020 25 13 3 5 0 4 52%
    2021 69 26 22 12 3 6 38% 106 65%
    2022 41 15 8 9 0 9 37% 63 65%
    2023 56 19 18 12 4 3 34% 100 56%
    2024 36 11 14 9 2 0 31% 78 46%
    2025 43 9 12 18 2 2 21% 90 48%
    2026* 24 7 3 6 5 3 29%

    *2026 is partial. GTIG counts: 106 (2021) and 63 (2022) from the 2023 and 2024 reviews; 100 (2023) and 78 (2024) as revised in the 2025 review (first reported as 97 and 75); 90 (2025).

    Three tests: browsers, enterprise products and the network edge

    We tested the three claims that come up most often about zero-day trends against three independent sources.

    Test 1: yesBrowser share is falling14: 18%18%1415: 14%16: 24%1617: 14%18: 25%1819: 35%20: 52%2021: 38%22: 37%2223: 34%24: 31%2425: 21%21%

    Browser share of zero-days in Project Zero’s tracker, by year (2014 to 2025). Peak 52% in 2020, 21% in 2025.

    Test 2: yesEnterprise share is rising2023: 37%37%20232024: 46%46%20242025: 48%48%2025

    Enterprise products as a share of all zero-days, as reported by Google Threat Intelligence Group (2024 as revised in the 2025 review).

    Test 3: yes, sharply in 2026Edge devices lead new KEV entries2022: 23%23%20222023: 18%18%20232024: 21%21%20242025: 21%21%20252026: 32%32%2026

    Edge, security and networking products as a share of same-year CVEs added to CISA KEV, January 1 to October 8 each year.

    Browsers. In the tracker, browsers made up 40% of zero-days from 2019 to 2021 and 25% in 2024 and 2025. Google Threat Intelligence Group reports the same direction with its fuller data: 17 browser zero-days in 2023, 11 in 2024, and “less than 10%” of the 2025 total. The two sources classify some flaws differently (a Chrome sandbox escape that abuses Windows can be counted as browser or operating system), so the levels differ, but both show a decline.

    Enterprise products. Google reported 36 enterprise zero-days in 2023 (37%), 36 in 2024 (46%, revised up from 33 and 44% in its first report), and 43 in 2025 (48%), both record highs. Security and networking products were 18, 20 and 21 of those. Google identified 14 of the 2025 zero-days as affecting edge devices and says that figure likely undercounts, because most edge devices cannot run endpoint detection tools.

    The network edge in 2026. Google’s 2026 review is not out yet, so we used CISA’s Known Exploited Vulnerabilities (KEV) catalog for current-year signal. KEV is not a zero-day list: it includes flaws first exploited after a patch existed. To focus on newly disclosed flaws, we counted only KEV additions whose CVE ID year matches the year added. From January 1 to October 8, 2026, 169 such CVEs were added, against 110 in the same window of 2025. Edge, security and networking products were 54 of them (32%), up from 23 (21%). Enterprise products of all kinds made up 81%, and end-user platforms (browsers, operating systems and office apps) just 19%, down from 37%. Our full analysis of the CISA KEV catalog covers the catalog’s ransomware flags and vendor mix in more depth.

    Year (Jan 1 to October 8) Same-year CVEs added Browsers Mobile and desktop OS Office, apps and plugins Edge, security and networking Other enterprise software
    2022 73 7 (10%) 20 (27%) 1 (1%) 17 (23%) 28 (38%)
    2023 83 5 (6%) 35 (42%) 6 (7%) 15 (18%) 22 (27%)
    2024 77 7 (9%) 29 (38%) 3 (4%) 16 (21%) 22 (29%)
    2025 110 5 (5%) 32 (29%) 4 (4%) 23 (21%) 46 (42%)
    2026* 169 7 (4%) 22 (13%) 3 (2%) 54 (32%) 83 (49%)

    CISA KEV catalog version 2026-10-08. Same-year CVE: the year in the CVE ID equals the year the entry was added. Categories assigned by The Uptime Report from KEV vendor and product names. *2026 is year to date, matched to the same calendar window in every row.

    How fast zero-days get patched

    The tracker records a discovery date for 133 of 412 entries, all from 2015 to 2024 (no 2025 or 2026 entry has one), so we could measure the time from the vendor learning of an exploited flaw to a fix for about a third of the dataset. The median was 9 days, and 48% were fixed within a week. 13 took longer than 90 days.

    Days from discovery to patch, one dot per zero-day (log scale)

    BrowsersMobile OS and chipsetsDesktop OSOffice, apps and pluginsEnterprise, edge and security products

    1371430901803651,000 daysMozillaCVE-2015-4495 (Firefox): 1 days from discovery to patchCVE-2016-9079 (Firefox): 1 days from discovery to patchCVE-2019-17026 (Firefox): 1 days from discovery to patchCVE-2020-6820 (Firefox): 2 days from discovery to patchCVE-2020-6819 (Firefox): 26 days from discovery to patchMozilla median: 1 daysmedian 1 day (n=5)GoogleCVE-2020-15999 (Chrome): 1 days from discovery to patchCVE-2022-1364 (Chrome): 1 days from discovery to patchCVE-2023-7024 (Chrome): 1 days from discovery to patchCVE-2019-5786 (Chrome): 2 days from discovery to patchCVE-2019-13720 (Chrome): 2 days from discovery to patchCVE-2020-16010 (Chrome): 2 days from discovery to patchCVE-2020-16013 (Chrome): 2 days from discovery to patchCVE-2021-30554 (Chrome): 2 days from discovery to patchCVE-2021-38003 (Chrome): 2 days from discovery to patchCVE-2022-1096 (Chrome): 2 days from discovery to patchCVE-2022-3723 (Chrome): 2 days from discovery to patchCVE-2022-4135 (Chrome): 2 days from discovery to patchCVE-2023-5217 (Chrome): 2 days from discovery to patchCVE-2024-4671 (Chrome): 2 days from discovery to patchCVE-2024-4947 (Chrome): 2 days from discovery to patchCVE-2021-21193 (Chrome): 3 days from discovery to patchCVE-2021-30563 (Chrome): 3 days from discovery to patchCVE-2021-37973 (Chrome): 3 days from discovery to patchCVE-2022-2294 (Chrome): 3 days from discovery to patchCVE-2022-3075 (Chrome): 3 days from discovery to patchCVE-2022-4262 (Chrome): 3 days from discovery to patchCVE-2023-2033 (Chrome): 3 days from discovery to patchCVE-2024-5274 (Chrome): 3 days from discovery to patchCVE-2020-16009 (Chrome): 4 days from discovery to patchCVE-2020-16017 (Chrome): 4 days from discovery to patchCVE-2021-4102 (Chrome): 4 days from discovery to patchCVE-2023-3079 (Chrome): 4 days from discovery to patchCVE-2023-6345 (Chrome): 4 days from discovery to patchCVE-2024-4761 (Chrome): 4 days from discovery to patchCVE-2020-6453 (Chrome): 5 days from discovery to patchCVE-2021-30632 (Chrome): 5 days from discovery to patchCVE-2021-30633 (Chrome): 5 days from discovery to patchCVE-2022-0609 (Chrome): 5 days from discovery to patchCVE-2024-0519 (Chrome): 5 days from discovery to patchCVE-2020-6418 (Chrome): 6 days from discovery to patchCVE-2020-6572 (Chrome): 6 days from discovery to patchCVE-2021-21206 (Chrome): 6 days from discovery to patchCVE-2021-30551 (Chrome): 6 days from discovery to patchCVE-2021-37975 (Chrome): 6 days from discovery to patchCVE-2023-2136 (Chrome): 6 days from discovery to patchCVE-2023-4863 (Chrome): 6 days from discovery to patchCVE-2021-37976 (Chrome): 9 days from discovery to patchCVE-2019-2215 (Android): 10 days from discovery to patchCVE-2021-21148 (Chrome): 11 days from discovery to patchCVE-2021-21166 (Chrome): 19 days from discovery to patchCVE-2023-4762 (Chrome): 20 days from discovery to patchCVE-2022-2856 (Chrome): 28 days from discovery to patchCVE-2021-38000 (Chrome): 43 days from discovery to patchCVE-2024-53104 (Android): 86 days from discovery to patchCVE-2023-0266 (Android): 109 days from discovery to patchCVE-2024-50302 (Android): 123 days from discovery to patchCVE-2024-53150 (Android): 127 days from discovery to patchCVE-2024-53197 (Android): 132 days from discovery to patchGoogle median: 4 daysmedian 4 days (n=53)AdobeCVE-2015-3043 (Flash): 1 days from discovery to patchCVE-2015-5119 (Flash): 3 days from discovery to patchCVE-2015-7645 (Flash): 3 days from discovery to patchCVE-2016-4117 (Flash): 4 days from discovery to patchCVE-2016-1019 (Flash): 5 days from discovery to patchCVE-2016-7855 (Flash): 5 days from discovery to patchCVE-2015-0310 (Flash): 6 days from discovery to patchCVE-2017-11292 (Flash): 6 days from discovery to patchCVE-2018-15982 (Flash): 6 days from discovery to patchCVE-2015-0311 (Flash): 7 days from discovery to patchCVE-2015-5122 (Flash): 9 days from discovery to patchCVE-2015-5123 (Flash): 9 days from discovery to patchCVE-2015-0313 (Flash): 22 days from discovery to patchCVE-2016-0984 (Flash): 29 days from discovery to patchAdobe median: 6 daysmedian 6 days (n=14)AppleCVE-2021-30860 (iOS): 6 days from discovery to patchCVE-2020-27950 (iOS): 7 days from discovery to patchCVE-2023-41992 (iOS): 9 days from discovery to patchCVE-2023-41991 (iOS): 9 days from discovery to patchCVE-2023-41993 (WebKit): 9 days from discovery to patchCVE-2016-4655 (iOS): 10 days from discovery to patchCVE-2016-4656 (iOS): 10 days from discovery to patchCVE-2016-4657 (WebKit): 10 days from discovery to patchCVE-2020-27930 (iOS): 10 days from discovery to patchCVE-2020-27932 (iOS): 10 days from discovery to patchApple median: 9.5 daysmedian 9.5 days (n=10)MicrosoftCVE-2021-33742 (Internet Explorer): 5 days from discovery to patchCVE-2015-2387 (Windows Kernel): 9 days from discovery to patchCVE-2015-2425 (Internet Explorer): 9 days from discovery to patchCVE-2023-36874 (Windows): 11 days from discovery to patchCVE-2017-11826 (Office): 12 days from discovery to patchCVE-2015-2424 (Office): 14 days from discovery to patchCVE-2015-2426 (Windows): 15 days from discovery to patchCVE-2016-7255 (Windows Kernel): 18 days from discovery to patchCVE-2019-0797 (Windows): 18 days from discovery to patchCVE-2020-17087 (Windows): 19 days from discovery to patchCVE-2020-1027 (Windows): 22 days from discovery to patchCVE-2019-0859 (Windows): 23 days from discovery to patchCVE-2015-1701 (Windows Kernel): 24 days from discovery to patchCVE-2018-8589 (Windows): 27 days from discovery to patchCVE-2018-8373 (VBScript): 34 days from discovery to patchCVE-2023-36884 (Windows): 34 days from discovery to patchCVE-2016-0167 (Windows Kernel): 35 days from discovery to patchCVE-2018-8611 (Windows): 43 days from discovery to patchCVE-2016-0034 (Silverlight): 48 days from discovery to patchCVE-2018-8453 (Windows): 53 days from discovery to patchCVE-2021-31955 (Windows): 55 days from discovery to patchCVE-2021-31956 (Windows): 55 days from discovery to patchCVE-2021-1732 (Windows): 61 days from discovery to patchCVE-2015-1642 (Office): 165 days from discovery to patchCVE-2016-3298 (Internet Explorer): 182 days from discovery to patchMicrosoft median: 24 daysmedian 24 days (n=25)SamsungCVE-2021-25487 (Android): 67 days from discovery to patchCVE-2021-25371 (Android): 69 days from discovery to patchCVE-2021-25372 (Android): 69 days from discovery to patchCVE-2021-25489 (Android): 77 days from discovery to patchCVE-2021-25369 (Android): 81 days from discovery to patchCVE-2021-25370 (Android): 81 days from discovery to patchCVE-2021-25337 (Android): 118 days from discovery to patchCVE-2021-25394 (Android): 121 days from discovery to patchCVE-2021-25395 (Android): 121 days from discovery to patchCVE-2023-21492 (Android): 834 days from discovery to patchSamsung median: 81 daysmedian 81 days (n=10)QualcommCVE-2024-43047 (DSP Service): 70 days from discovery to patchCVE-2021-1905 (Android): 167 days from discovery to patchCVE-2021-1906 (Android): 167 days from discovery to patchCVE-2020-11261 (Android): 168 days from discovery to patchQualcomm median: 167 daysmedian 167 days (n=4)

    Vendors with at least four zero-days that have both a discovery date and a patch date in the tracker. Red tick: vendor median.

    Speed depends on who ships the fix. Google’s median was 4 days across 53 entries, 47 of them Chrome. Microsoft’s was 24 days across 25 entries. Microsoft’s zero-day fixes follow its monthly cycle: 151 of its 166 tracked zero-days (91%) were patched on a Patch Tuesday (the second Tuesday of the month). Our Patch Tuesday statistics track how many exploited Microsoft CVEs each release carries. The slowest group was Android chipset and device makers: Samsung, Qualcomm and Arm had a combined median of 81 days across 15 zero-days.

    A second clock starts once a patch ships. 408 of the 412 tracked zero-days (99%) are in CISA’s KEV catalog. For the 204 patched since KEV launched in November 2021, the median gap from patch to KEV listing was 1 day, 86% were listed within a week, and 7 were listed before a patch was available. Each KEV entry carries a remediation due date for US federal agencies, which makes the catalog a ready-made patch priority list.

    The 2026 zero-days so far

    The 24 entries in the tracker’s 2026 tab, by patch date:

    • CVE-2026-20805 Microsoft Windows 2026-01-13
    • CVE-2026-21509 Microsoft Office 2026-01-26
    • CVE-2026-21510 Microsoft Office 2026-02-10
    • CVE-2026-21513 Microsoft Office 2026-02-10
    • CVE-2026-21514 Microsoft Office 2026-02-10
    • CVE-2026-21519 Microsoft Windows 2026-02-10
    • CVE-2026-21533 Microsoft Windows 2026-02-10
    • CVE-2026-20700 Apple iOS 2026-02-11
    • CVE-2026-2441 Google Chrome 2026-02-13
    • CVE-2026-21385 Qualcomm GPU 2026-03-02
    • CVE-2026-3909 Google Chrome 2026-03-12
    • CVE-2026-3910 Google Chrome 2026-03-12
    • CVE-2026-5281 Google Chrome 2026-03-31
    • CVE-2026-34621 Adobe Acrobat Reader 2026-04-12
    • CVE-2026-32201 Microsoft SharePoint 2026-04-12
    • CVE-2026-42897 Microsoft Exchange 2026-05-14
    • CVE-2026-11645 Google Chrome 2026-06-08
    • CVE-2026-56155 Microsoft Windows 2026-07-14
    • CVE-2026-56164 Microsoft SharePoint 2026-07-14
    • CVE-2026-68820 Microsoft Windows 2026-08-11
    • CVE-2026-85046 Google Chrome 2026-09-03
    • CVE-2026-87491 Google Chrome 2026-09-08
    • CVE-2026-85880 Microsoft Windows 2026-09-09
    • CVE-2026-86950 Apple iOS 2026-09-29

    What this means for MSPs

    Put internet-facing appliances on a days-not-weeks clock. Firewalls, VPN gateways, load balancers and email gateways supplied 32% of the 2026-numbered CVEs added to KEV this year, and Google says edge devices are hard to monitor once compromised. Keep a current inventory of every client appliance with a management interface or VPN portal, and track vendor advisories for those products directly rather than waiting for the monthly patch cycle.

    Watch your own tools. Remote monitoring and remote support products appear in KEV too: 6 same-year entries for ConnectWise ScreenConnect, N-able N-central, SimpleHelp and BeyondTrust products were added from January 1 to October 8, 2026, after 3 in all of 2025. An exploited flaw in an RMM platform reaches every client it manages.

    Keep the browser and OS basics. Browser zero-days are fewer, but Chrome still had 7 tracked entries in 2026, and Google fixed its tracked zero-days in a median of 4 days. Automatic browser updates with an enforced restart close that window. For Windows, the monthly cycle means an exploited flaw can stay open for weeks; exploited Patch Tuesday CVEs belong in the first deployment ring.

    Treat Android patch level as a compliance setting. Chipset-level fixes took a median of 81 days to ship. Mobile device management policies that block devices more than one or two security patch levels behind are the practical control.

    Not advice. This is an analysis of public vulnerability data, not a patching recommendation for any specific environment.

    Frequently asked questions

    How common are zero-day attacks?

    Google Threat Intelligence Group counted 90 zero-days exploited in the wild in 2025, roughly one every four days, and between 63 and 106 a year since 2021. Project Zero’s public tracker, which covers a narrower set of products, lists 43 for 2025 and 412 since July 2014.

    Which vendor has the most zero-days?

    Microsoft, with 166 of the 412 zero-days in Project Zero’s tracker (40%), followed by Google with 80 and Apple with 67. Together the three account for 76%. Windows alone accounts for 106, and Chrome for 62.

    How many zero-days have there been in 2026?

    Project Zero’s tracker lists 24 zero-days patched from January 1 to September 29, 2026, against 37 in the same window of 2025. The tracker is updated by hand and can lag. In CISA’s catalog, 169 vulnerabilities with 2026 CVE IDs were added as known exploited by October 8, 2026, compared with 110 in the same period of 2025.

    How long does it take to patch a zero-day?

    For the 133 tracked zero-days with a recorded discovery date (2015 to 2024), the median time from discovery to patch was 9 days, and 48% were fixed within a week. Google’s median was 4 days and Microsoft’s 24. Android chipset and device makers (Samsung, Qualcomm, Arm) took a median of 81 days.

    Are browser zero-days declining?

    Yes. Browsers were 52% of Project Zero’s tracked zero-days in 2020 and 21% in 2025. Google Threat Intelligence Group counted 17 browser zero-days in 2023, 11 in 2024, and less than 10% of its 90 in 2025.

    Are attackers targeting enterprise and edge devices more?

    Yes. Google Threat Intelligence Group put enterprise products at 37% of zero-days in 2023, 46% in 2024 and a record 48% (43) in 2025. In CISA’s catalog, edge, security and networking products made up 32% of 2026-numbered CVEs added through October 8, up from 21% in the same window of 2025.

    Download the data. zero-days-in-the-wild-2014-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    Primary dataset. Google Project Zero, “0day In the Wild” tracking spreadsheet (public Google Sheet). We exported every year tab (2014 to 2026) as CSV in October 2026 and kept every row with a CVE ID: 412 zero-days, the latest patched September 29, 2026. Year is the tracker’s own year tab (four Android flaws in the 2024 tab were patched in early 2025). One row with no CVE ID was dropped. Vendor names were normalized (for example “TrendMicro” to “Trend Micro”). The tracker defines a zero-day as a vulnerability detected in real attacks while not known to the public or the vendor, and excludes end-of-life software and flaws exploited only after public disclosure.

    Categories. Assigned by The Uptime Report from the tracker’s Product field: Browsers (Chrome, WebKit, Internet Explorer, Firefox, VBScript), Mobile OS and chipsets (Android, iOS, Qualcomm, Samsung and Arm components), Desktop OS (Windows, macOS, Linux kernel), Office, apps and plugins (Office, Reader, Flash, Java, WinRAR and similar), and Enterprise, edge and security products (Exchange, SharePoint, firewalls, VPNs, VMware and similar).

    Time to patch. Date Patched minus Date Discovered, for the 133 rows where the tracker records both. The tracker only sets a discovery date when the reporter specifies one, so this is a subset: Google entries make up 53 of the 133.

    Cross-checks. Annual totals and category counts for 2021 to 2025 are quoted from Google Threat Intelligence Group’s annual zero-day reviews, which use a broader collection and are revised over time (2023 was first reported as 97, later 98 and 100; 2024 as 75, later 78). CISA KEV catalog version 2026-10-08 (1,739 entries) was matched to the tracker by CVE ID. KEV “known exploited” is not the same as zero-day; the same-year CVE filter is a proxy for newly disclosed flaws and will miss zero-days that carry an earlier-year CVE ID.

    Limitations. Only detected and disclosed zero-days can be counted. The tracker’s scope narrowed away from enterprise products after 2023, so its category shares understate enterprise exposure. Recent months are incomplete in both the tracker and KEV.

    Cite as:The Uptime Report. "Zero-Day Statistics: Browser Exploits Are Fading as Attackers Move to the Network Edge." October 2026. https://theuptimereport.com/zero-day-statistics/

    References

    1. Google Project Zero, “0day In the Wild” tracking spreadsheet. Accessed October 2026.
    2. Google Project Zero, 0day “In the Wild” introduction. Accessed October 2026.
    3. Google Threat Intelligence Group, “Look What You Made Us Patch: 2025 Zero-Days in Review”. Accessed October 2026.
    4. Google Threat Intelligence Group, “Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysis”. Accessed October 2026.
    5. Google TAG and Mandiant, “Trends on Zero-Days Exploited In-the-Wild in 2023”. Accessed October 2026.
    6. CISA, Known Exploited Vulnerabilities Catalog (JSON feed). Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending

  • Phishing Statistics 2026: Attacks Up 33% Since 2021, FBI Phishing Complaints Down 44%

    Uptime Report Research · Evidence Board

    Phishing Statistics 2026: Attacks Up 33% Since 2021, FBI Phishing Complaints Down 44%

    Phishing statistics from three primary sources point in different directions. The Anti-Phishing Working Group logged 3,799,693 unique phishing sites in 2025, up 33% on 2021, while phishing and spoofing complaints to the FBI fell 44% to 191,561. Business email compromise losses reached $3.05B, and 24.3% of large healthcare breaches reported in 2025 listed email as a location.

    Attacks seen3.80Munique phishing sites, APWG, 2025 (+33% vs 2021)
    Complaints filed191,561phishing/spoofing complaints to FBI IC3, 2025 (-44% vs 2021)
    Money lost$3.05Bbusiness email compromise losses reported to IC3, 2025
    Breaches caused24.3%of 2025 HHS healthcare breaches listed email (195 of 802)

    Many of the pages that rank for phishing statistics are built on vendor surveys. We went to four public measurements that are published on a regular schedule: phishing sites reported to the Anti-Phishing Working Group (APWG), complaints filed with the FBI’s Internet Crime Complaint Center (IC3), dollar losses in those complaints, and healthcare breaches reported to the US Department of Health and Human Services (HHS). We pulled every APWG quarterly report from 2019 to 2026, six IC3 annual reports, and the full HHS breach file, and extracted or computed each number below. They measure different things, so each gets its own panel before we put them side by side.

    Attacks seen

    Source: APWG trends reports

    Unique phishing sites per month, July 2020 to June 2026

    0k200k400k600k202120222023202420252026Mar 2023: 619,060Jun 2026: 425,808Jul 2020: 171,040 unique phishing sitesAug 2020: 201,591 unique phishing sitesSep 2020: 199,133 unique phishing sitesOct 2020: 225,304 unique phishing sitesNov 2020: 212,878 unique phishing sitesDec 2020: 199,120 unique phishing sitesJan 2021: 245,771 unique phishing sitesFeb 2021: 158,898 unique phishing sitesMar 2021: 207,208 unique phishing sitesApr 2021: 204,050 unique phishing sitesMay 2021: 190,762 unique phishing sitesJun 2021: 222,127 unique phishing sitesJul 2021: 260,642 unique phishing sitesAug 2021: 255,385 unique phishing sitesSep 2021: 214,345 unique phishing sitesOct 2021: 267,530 unique phishing sitesNov 2021: 304,308 unique phishing sitesDec 2021: 316,747 unique phishing sitesJan 2022: 331,698 unique phishing sitesFeb 2022: 309,979 unique phishing sitesMar 2022: 384,291 unique phishing sitesApr 2022: 362,852 unique phishing sitesMay 2022: 353,242 unique phishing sitesJun 2022: 381,717 unique phishing sitesJul 2022: 425,112 unique phishing sitesAug 2022: 430,141 unique phishing sitesSep 2022: 415,630 unique phishing sitesOct 2022: 440,508 unique phishing sitesNov 2022: 450,390 unique phishing sitesDec 2022: 459,139 unique phishing sitesJan 2023: 495,690 unique phishing sitesFeb 2023: 509,394 unique phishing sitesMar 2023: 619,060 unique phishing sitesApr 2023: 597,789 unique phishing sitesMay 2023: 381,572 unique phishing sitesJun 2023: 306,847 unique phishing sitesJul 2023: 327,294 unique phishing sitesAug 2023: 331,962 unique phishing sitesSep 2023: 340,700 unique phishing sitesOct 2023: 356,538 unique phishing sitesNov 2023: 350,776 unique phishing sitesDec 2023: 370,187 unique phishing sitesJan 2024: 358,107 unique phishing sitesFeb 2024: 314,974 unique phishing sitesMar 2024: 290,913 unique phishing sitesApr 2024: 318,651 unique phishing sitesMay 2024: 292,428 unique phishing sitesJun 2024: 266,457 unique phishing sitesJul 2024: 289,324 unique phishing sitesAug 2024: 301,507 unique phishing sitesSep 2024: 342,092 unique phishing sitesOct 2024: 345,881 unique phishing sitesNov 2024: 313,288 unique phishing sitesDec 2024: 329,954 unique phishing sitesJan 2025: 337,998 unique phishing sitesFeb 2025: 318,513 unique phishing sitesMar 2025: 347,413 unique phishing sitesApr 2025: 335,139 unique phishing sitesMay 2025: 349,511 unique phishing sitesJun 2025: 365,381 unique phishing sitesJul 2025: 351,590 unique phishing sitesAug 2025: 289,848 unique phishing sitesSep 2025: 251,056 unique phishing sitesOct 2025: 269,558 unique phishing sitesNov 2025: 287,995 unique phishing sitesDec 2025: 295,691 unique phishing sitesJan 2026: 320,264 unique phishing sitesFeb 2026: 329,625 unique phishing sitesMar 2026: 321,292 unique phishing sitesApr 2026: 325,934 unique phishing sitesMay 2026: 317,940 unique phishing sitesJun 2026: 425,808 unique phishing sites

    APWG counts unique base URLs of phishing sites reported by its members and the public. The series starts in July 2020, when APWG changed its counting method; earlier months are not comparable.

    3,799,693

    unique phishing sites in 2025, according to APWG’s quarterly Phishing Activity Trends Reports. That is 33% more than the 2,847,773 of 2021, the first full year under the current method.

    The count peaked in 2023 at 4,987,809, with the single highest month in March 2023 (619,060). It then fell 25% in 2024 and moved +1.0% in 2025. January to June 2026 totals 2,040,863, against 2,053,955 a year earlier (-0.6%), but June 2026 alone reached 425,808, the most in any month since April 2023.

    Complaints filed

    Source: FBI IC3 annual reports

    Phishing/spoofing complaints to IC3 by year, with share of all IC3 complaints

    0k100k200k300k400k2020: 269,560 phishing/spoofing complaints, 34% of 791,790 IC3 complaints270k202034% of all2021: 342,494 phishing/spoofing complaints, 40% of 847,376 IC3 complaints342k202140% of all2022: 321,136 phishing/spoofing complaints, 40% of 800,944 IC3 complaints321k202240% of all2023: 298,878 phishing/spoofing complaints, 34% of 880,418 IC3 complaints299k202334% of all2024: 193,407 phishing/spoofing complaints, 23% of 859,532 IC3 complaints193k202423% of all2025: 191,561 phishing/spoofing complaints, 19% of 1,008,597 IC3 complaints192k202519% of all

    IC3’s current Phishing/Spoofing category. 2021 and 2022 are IC3’s own restated figures from its 2023 report; 2020 is our sum of the then separate Phishing and Spoofing rows.

    191,561

    phishing and spoofing complaints filed with the FBI’s IC3 in 2025, down from 342,494 in 2021 (-44%) and from 298,878 in 2023.

    The drop is specific to phishing. Total IC3 complaints rose to 1,008,597 in 2025, the first year above one million, so phishing’s share of everything people reported fell from 40% in 2021 to 19%. Phishing/spoofing is still the single most reported crime type in the 2025 report. IC3’s annual reports, which we also used to track ransomware reported to the FBI over five years, do not explain the fall in phishing complaints.

    Money lost

    Source: FBI IC3 annual reports

    Business email compromise Phishing/spoofing (reported losses)

    $0B$1B$2B$3B2020: BEC losses $1.87B across 19,369 complaints2020: phishing/spoofing losses $270.8M across 269,560 complaints$1.87B$270.8M20202021: BEC losses $2.40B across 19,954 complaints2021: phishing/spoofing losses $126.4M across 342,494 complaints$2.40B$126.4M20212022: BEC losses $2.74B across 21,832 complaints2022: phishing/spoofing losses $160.0M across 321,136 complaints$2.74B$160M20222023: BEC losses $2.95B across 21,489 complaints2023: phishing/spoofing losses $18.7M across 298,878 complaints$2.95B$18.7M20232024: BEC losses $2.77B across 21,442 complaints2024: phishing/spoofing losses $70.0M across 193,407 complaints$2.77B$70M20242025: BEC losses $3.05B across 24,768 complaints2025: phishing/spoofing losses $215.8M across 191,561 complaints$3.05B$215.8M2025

    Losses as published by IC3 for each crime type, on one shared dollar axis.

    $3.05B

    lost to business email compromise (BEC) in 2025, across 24,768 complaints. Both the count and the loss are the highest in the six IC3 reports from 2020 to 2025.

    Complaints filed as phishing or spoofing carry far less money: $215.8M in 2025, though that is up from $70.0M in 2024 and $18.7M in 2023. Per complaint, BEC averaged about $123,005 in 2025 and phishing/spoofing about $1,127. BEC complaints rose 16% in 2025 while phishing complaints held flat.

    Breaches caused

    Source: HHS OCR breach portal

    Hacking/IT incident Other breach types (mostly unauthorized access or disclosure). Label: share of all breaches that year.

    01002003002015: 40 of 270 breaches listed email (14.8%); 14 hacking/IT incidents; 674,043 individuals2015: 40 of 270 breaches listed email (14.8%); 14 hacking/IT incidents; 674,043 individuals15%’152016: 51 of 328 breaches listed email (15.5%); 18 hacking/IT incidents; 1,064,621 individuals2016: 51 of 328 breaches listed email (15.5%); 18 hacking/IT incidents; 1,064,621 individuals16%’162017: 90 of 357 breaches listed email (25.2%); 49 hacking/IT incidents; 874,971 individuals2017: 90 of 357 breaches listed email (25.2%); 49 hacking/IT incidents; 874,971 individuals25%’172018: 123 of 368 breaches listed email (33.4%); 91 hacking/IT incidents; 3,863,485 individuals2018: 123 of 368 breaches listed email (33.4%); 91 hacking/IT incidents; 3,863,485 individuals33%’182019: 215 of 511 breaches listed email (42.1%); 181 hacking/IT incidents; 5,622,952 individuals2019: 215 of 511 breaches listed email (42.1%); 181 hacking/IT incidents; 5,622,952 individuals42%’192020: 245 of 663 breaches listed email (37.0%); 203 hacking/IT incidents; 13,184,483 individuals2020: 245 of 663 breaches listed email (37.0%); 203 hacking/IT incidents; 13,184,483 individuals37%’202021: 205 of 715 breaches listed email (28.7%); 162 hacking/IT incidents; 7,720,126 individuals2021: 205 of 715 breaches listed email (28.7%); 162 hacking/IT incidents; 7,720,126 individuals29%’212022: 173 of 718 breaches listed email (24.1%); 151 hacking/IT incidents; 5,813,541 individuals2022: 173 of 718 breaches listed email (24.1%); 151 hacking/IT incidents; 5,813,541 individuals24%’222023: 137 of 745 breaches listed email (18.4%); 105 hacking/IT incidents; 2,923,961 individuals2023: 137 of 745 breaches listed email (18.4%); 105 hacking/IT incidents; 2,923,961 individuals18%’232024: 173 of 741 breaches listed email (23.3%); 147 hacking/IT incidents; 3,794,586 individuals2024: 173 of 741 breaches listed email (23.3%); 147 hacking/IT incidents; 3,794,586 individuals23%’242025: 195 of 802 breaches listed email (24.3%); 158 hacking/IT incidents; 3,377,324 individuals2025: 195 of 802 breaches listed email (24.3%); 158 hacking/IT incidents; 3,377,324 individuals24%’252026 (Jan to Sep 21): 116 of 566 breaches listed email (20.5%); 99 hacking/IT incidents; 1,002,990 individuals2026 (Jan to Sep 21): 116 of 566 breaches listed email (20.5%); 99 hacking/IT incidents; 1,002,990 individuals20%’26*

    Breaches of 500 or more records whose “Location of Breached Information” includes Email, by submission year. *2026 runs to September 21, the latest submission in our October 2026 download.

    195 of 802

    large healthcare breaches reported to HHS in 2025 listed email as a location of breached data (24.3%). 158 of them were classed as hacking or IT incidents; most of the rest were unauthorized access or disclosure.

    Email breaches peaked at 245 in 2020, and the email share peaked at 42.1% in 2019. They are frequent but small: 3,377,324 individuals in 2025, 2.4% of everyone affected, with a median of 2,703 records against 4,836 for all breaches. By September 21, the 2026 file has 116 email breaches out of 566 (20.5%), against 158 of 605 (26.1%) by the same date in 2025. Our healthcare data breach report breaks down the rest of the HHS file.

    Is phishing rising while complaints fall?

    Partly. Indexed to 2021, APWG’s phishing site count is 133 while IC3 phishing complaints are at 56. Over the full period the two moved in opposite directions. Since 2023 both fell, but complaints fell harder (-36% against -24% for sites). In 2025 both were roughly flat (sites +1.0%, complaints -1.0%).

    408012016020020212022202320242025APWG phishing sites, 2021: 100 (2021 = 100)APWG phishing sites, 2022: 167 (2021 = 100)APWG phishing sites, 2023: 175 (2021 = 100)APWG phishing sites, 2024: 132 (2021 = 100)APWG phishing sites, 2025: 133 (2021 = 100)IC3 phishing/spoofing complaints, 2021: 100 (2021 = 100)IC3 phishing/spoofing complaints, 2022: 94 (2021 = 100)IC3 phishing/spoofing complaints, 2023: 87 (2021 = 100)IC3 phishing/spoofing complaints, 2024: 56 (2021 = 100)IC3 phishing/spoofing complaints, 2025: 56 (2021 = 100)IC3 BEC complaints, 2021: 100 (2021 = 100)IC3 BEC complaints, 2022: 109 (2021 = 100)IC3 BEC complaints, 2023: 108 (2021 = 100)IC3 BEC complaints, 2024: 107 (2021 = 100)IC3 BEC complaints, 2025: 124 (2021 = 100)HHS breaches involving email, 2021: 100 (2021 = 100)HHS breaches involving email, 2022: 84 (2021 = 100)HHS breaches involving email, 2023: 67 (2021 = 100)HHS breaches involving email, 2024: 84 (2021 = 100)HHS breaches involving email, 2025: 95 (2021 = 100)● APWG phishing sites 133● IC3 BEC complaints 124● HHS breaches involving email 95● IC3 phishing/spoofing complaints 56

    Each series divided by its own 2021 value and multiplied by 100. 2026 is excluded because IC3 has not published it and the other two are partial.

    What the data supports. Reported phishing infrastructure stayed near 3.8 million sites a year in 2024 and 2025, 33% above 2021. BEC complaints and losses reached six-year highs in 2025. Email remains a location in about one in four large healthcare breaches.
    What it does not support. That phishing is fading. Phishing complaints fell 44% from 2021 while total IC3 complaints rose 19%, and none of the three sources gives a reason for the fall. APWG itself notes that its counts are reports and that some mail systems now stop users from forwarding phishing emails to it.

    All four measures, year by year

    Year APWG FBI IC3 HHS OCR (healthcare)
    Unique phishing sites Phishing/spoofing complaints Share of all complaints Phishing/spoofing losses BEC complaints BEC losses Breaches listing email Share of all breaches Individuals in email breaches
    2020 1,209,066a 269,560 34% $270.8M 19,369 $1.87B 245 37.0% 13,184,483
    2021 2,847,773 342,494 40% $126.4M 19,954 $2.40B 205 28.7% 7,720,126
    2022 4,744,699 321,136 40% $160.0M 21,832 $2.74B 173 24.1% 5,813,541
    2023 4,987,809 298,878 34% $18.7M 21,489 $2.95B 137 18.4% 2,923,961
    2024 3,763,576 193,407 23% $70.0M 21,442 $2.77B 173 23.3% 3,794,586
    2025 3,799,693 191,561 19% $215.8M 24,768 $3.05B 195 24.3% 3,377,324
    2026* 2,040,863b IC3 2026 report not yet published 116 20.5% 1,002,990

    a July to December 2020 only (APWG counting method changed in Q3 2020). b January to June 2026. *2026 HHS figures run to September 21.

    Is it true that 90% of cyberattacks start with phishing?

    Not in the primary data we could check. The figure circulates widely, but none of these sources produces anything close to it. When we coded every CISA #StopRansomware advisory by entry technique for our analysis of ransomware initial access vectors, phishing appeared in 13 of the 22 advisories that list initial access (59%), behind exploits of public-facing applications. In the HHS file, 24.3% of 2025 breaches listed email as a location of breached data. In IC3’s 2025 data, phishing/spoofing was 19% of complaints. Phishing is common in each dataset; it is not nine in ten in any of them.

    What this means for MSPs

    Reported phishing sites are still a third above their 2021 level, so falling complaint counts are not a reason to cut email security from a client stack. The money is in BEC: the average BEC complaint in 2025 reported about $123,005 lost. Practical priorities:

    • Phishing-resistant MFA first for admins and finance staff. CISA, NSA, the FBI and MS-ISAC write in their joint phishing guidance that “if weak forms of MFA are enabled, malicious actors can still obtain access through phishing and other techniques,” and that FIDO or PKI-based MFA is phishing resistant.
    • DMARC at reject. The same guidance says to ensure DMARC is set to “reject” for sent emails, so that spoofed emails impersonating the domain “are rejected at the mail server prior to delivery.”
    • Out-of-band payment checks. A call-back rule for any change to bank details targets BEC, the crime type with the second-largest losses in IC3’s 2025 data, behind investment fraud.
    • Mailbox breach readiness for healthcare clients. About one in four HHS-reported breaches in 2025 involved email. Turn on mailbox audit logging so that, after an account compromise, you can establish which messages and records were accessed.
    • Report phishing upstream. APWG’s counts depend on reports. Forwarding samples to reportphishing@apwg.org and filing BEC losses at ic3.gov quickly also feeds the FBI’s Recovery Asset Team.

    Frequently asked questions

    What are the latest phishing statistics?

    APWG counted 3,799,693 unique phishing sites in 2025, about level with 3,763,576 in 2024 and below the record 4,987,809 in 2023. In January to June 2026 it counted 2,040,863, against 2,053,955 in the same months of 2025. June 2026 alone had 425,808, the highest monthly total since April 2023.

    Is it true that 90% of cyberattacks start with phishing?

    None of the primary datasets we checked shows a figure near 90%. Phishing is listed as an initial access technique in 13 of 22 CISA #StopRansomware advisories that name one (59%), email was a location of breached data in 24.3% of 2025 HHS healthcare breaches, and phishing/spoofing made up 19% of 2025 FBI IC3 complaints.

    How many people are phished per year?

    No source counts every phishing victim. The closest US measure is FBI IC3 complaints: IC3 received 191,561 phishing or spoofing complaints in 2025, down from 342,494 in 2021. These are reports, so the real number of people targeted is far higher.

    How common is business email compromise?

    The FBI IC3 received 24,768 business email compromise complaints in 2025, with reported losses of $3.05B, about $123,005 per complaint. Both are the highest of the 2020 to 2025 reports we read.

    Are phishing attacks increasing?

    Since 2021, yes: APWG’s count of phishing sites was 33% higher in 2025 than in 2021. Over two years, no: it fell 24% from the 2023 record and has been nearly flat since, with +1.0% in 2025.

    How many healthcare data breaches involve email?

    In 2025, 195 of the 802 breaches of 500 or more records reported to HHS listed email as a location of breached information (24.3%), affecting 3,377,324 individuals. 158 of those 195 were classed as hacking or IT incidents.

    Download the data. phishing-statistics-apwg-fbi-ic3-hhs-2019-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

    Methodology

    APWG. We downloaded all 30 quarterly Phishing Activity Trends Reports from Q1 2019 to Q2 2026 from docs.apwg.org (retrieved October 2026) and extracted the monthly “Number of unique phishing Web sites (attacks)” from each report’s statistical highlights table. APWG defines this as unique base URLs of phishing sites reported by members, Global Research Partners and the public. With its Q3 2020 report APWG changed how it counts sites, so we use only July 2020 onward for trends. Annual totals are sums of the monthly values; they reproduce APWG’s own published annual figures (4,987,809 for 2023, about 3.76 million for 2024, about 3.8 million for 2025). One inconsistency: APWG’s Q2 2025 text gives 1,130,393 attacks for that quarter, but its monthly table sums to 1,050,031. We use the monthly table, which is the figure consistent with APWG’s 2025 annual total.

    FBI IC3. We read the 2020 to 2025 Internet Crime Reports and took the counts and losses for Phishing/Spoofing and Business Email Compromise from each report’s crime type tables. IC3 merged phishing and spoofing into one category in its 2023 report and restated 2021 and 2022 on that basis; we use the restated values. For 2020 we added the separate Phishing/Vishing/Smishing/Pharming (241,342) and Spoofing (28,218) rows; the same method applied to 2021 gives 342,494, matching IC3’s restatement. Losses are as reported by complainants and published by IC3. IC3 data covers complaints filed, not all incidents.

    HHS OCR. The full breach portal export (current and archived breaches of 500 or more records, 2009 to 2026), downloaded October 2026. A breach counts as an email breach if its “Location of Breached Information” field includes Email, alone or with other locations. Years are breach submission years. The location field records where the data was, not how the attacker got in, so an email breach is not proof of phishing; we report hacking/IT incidents separately as the closer proxy. 2026 is partial (to September 21) and recent submissions are added with a lag.

    What we did not use. Vendor surveys and simulated-phishing click rates, because their samples and methods change from year to year. We did not include Google Safe Browsing counts because no downloadable series was available to us.

    Not advice. This is an analysis of public data, not security advice for any specific environment.

    Cite as:The Uptime Report. "Phishing Statistics 2026: Attacks Up 33% Since 2021, FBI Phishing Complaints Down 44%." October 2026. https://theuptimereport.com/phishing-statistics/

    References

    1. Anti-Phishing Working Group, Phishing Activity Trends Reports, Q1 2019 to Q2 2026 (for example Q4 2025 and Q2 2026). Accessed October 2026.
    2. FBI Internet Crime Complaint Center, 2020 Internet Crime Report. Accessed October 2026.
    3. FBI Internet Crime Complaint Center, 2021 Internet Crime Report. Accessed October 2026.
    4. FBI Internet Crime Complaint Center, 2022 Internet Crime Report. Accessed October 2026.
    5. FBI Internet Crime Complaint Center, 2023 Internet Crime Report. Accessed October 2026.
    6. FBI Internet Crime Complaint Center, 2024 Internet Crime Report. Accessed October 2026.
    7. FBI Internet Crime Complaint Center, 2025 Internet Crime Report. Accessed October 2026.
    8. US Department of Health and Human Services, Office for Civil Rights, Breach Portal. Accessed October 2026.
    9. CISA, NSA, FBI and MS-ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One. Accessed October 2026.

    Research library

    More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

    Threats and breaches

    Infrastructure and uptime

    Regulation and disclosure

    Workforce and pay

    MSP market and spending