A US cyber breach now costs $10.22 million on average, but the figure itself is only part of the warning. What matters more is what it reveals about the way organizations are managing risk.

For too long, cyber risk has been treated as a technical problem to be solved by technical teams, but that position is becoming harder to defend. The companies hit hardest by cyber incidents are those without the visibility, governance and accountability to respond when pressure hits.

According to IBM’s latest research, the average cost of a data breach in the US is the highest of any region globally. At the same time, FBI data continues to point to hundreds of thousands of cybercrime complaints each year, with losses measured in the tens of billions.

A growing proportion of businesses are also now formally disclosing incidents, with one 2025 survey suggesting that 76% reported a breach or potential breach to authorities.

The direction of travel is very clear – cyber incidents are becoming more expensive, more visible and harder to contain. Leadership teams need to ask whether they can prove they have control before an incident forces that conversation.

The cost is driven by more than the attack itself

The financial impact of a breach is shaped by how long the organization remains exposed and how confidently it can demonstrate that the right controls were in place.

On average, it takes 241 days to identify and contain a breach – this extended lifecycle creates a prolonged period of uncertainty where operational disruption, regulatory obligations, customer impact and reputational damage begin to compound.

This is where the difference between security activity and business governance becomes clear. Two companies can experience similar attacks, but very different outcomes.

One may detect the breach internally, escalate quickly and respond in a controlled way, while another may only become aware when an attacker, customer, partner or regulator forces the issue into the open.

That gap comes down to whether risks were understood in advance and if the business had a defensible framework for responding under pressure.

Exposure is not random

Cybercrime exposure varies significantly between organizations, states and sectors, but it is rarely random. Industries such as healthcare, financial services and technology continue to carry higher risk because of the volume and sensitivity of the data they manage.

IBM’s research shows that healthcare breaches remain among the most expensive, with extended recovery times and higher regulatory scrutiny.

However, some of the more complex risks are emerging beyond the obvious high-value targets. Supply chain compromise is now one of the costliest attack vectors because a single weakness in a third-party system can create consequences across multiple businesses.

In an increasingly connected commercial environment, exposure often sits outside the four walls of the company itself.

Phishing also remains one of the most persistent routes in and attacks are becoming more targeted, more convincing and harder to detect at scale, particularly where there is limited visibility across people, processes and third-party access points.

When you bring these factors together, exposure starts to look like a reflection of how an organization is built, governed and controlled.

AI is widening the governance gap

AI is now changing both sides of the cyber risk equation. For attackers, it is making familiar methods more effective. Around 16% of breaches now involve the use of AI, most commonly to enhance phishing and social engineering attacks, lowering the barrier to make these more convincing and personalized.

For businesses, the risk is just as much internal. AI tools are being adopted quickly, often by teams looking to improve productivity or accelerate decision-making. The problem is that adoption is frequently moving faster than oversight.

The report highlights that 63% of companies still lack formal governance policies for AI, and where AI-related breaches do occur, the vast majority involve systems without proper access controls.

There is a familiar pattern here. As with cloud adoption a decade ago, enterprises are moving quickly to capture the benefits of a new technology, while the controls needed to manage its risks are still catching up. The result is a widening gap between those experimenting with AI and those that can evidence how it is used.

Governance is becoming the dividing line

The businesses that manage breaches most effectively tend to have done the work before the incident happens. They understand where their risks sit, know who owns them, and have defined processes for escalation and recovery. Just as importantly, they can evidence that structure when customers, regulators or insurers ask difficult questions.

That’s why recognized frameworks such as ISO 27001 are becoming more important, forcing companies to take a systematic approach to risk, governance and accountability. They also create a baseline that can be reviewed and tested over time.

This distinction matters both operationally and commercially. Around 86% of affected organizations report operational disruption following a breach and, in many cases, that disruption directly affects revenue, service delivery and customer trust.

For the businesses that can evidence good practice, strong governance frameworks are opening doors, particularly in regulated sectors and complex supply chains. For those that cannot, this creates more friction and risks lost opportunities.

Compliance is now part of business resilience

There is still a tendency in some companies to treat compliance as an administrative exercise, but that view is becoming swiftly outdated. Today, compliance is becoming a way for businesses to prove they manage risk consistently. It brings structure to decision-making, accountability to ownership and evidence to claims of good practice.

This is especially important as cyber risk becomes more visible to investors, customers and regulators. A business may have strong technical controls, but if it cannot demonstrate how those controls are governed, reviewed and maintained, it will struggle to build trust when scrutiny increases.

The ability to evidence control is becoming almost as important as the control itself.

A more realistic view of cyber risk

Geography plays a role in cybercrime exposure, but it’s not the root cause. Differences in governance, investment, leadership focus and operational discipline all shape how businesses experience and manage cyber risk.

That means exposure can be reduced, but only when leadership teams understand where risk actually sits and what is needed to manage it. The mistake is assuming that cyber resilience can be achieved through technology alone. Technology is essential, but it doesn’t define ownership, test processes, align teams or prove accountability – governance does that.

For leadership teams, the starting point is knowing where risk exists, how it could materialize and what the potential business impact would be. From there, the challenge is putting the frameworks in place, along with the ownership and oversight that allows them to operate with clarity under pressure.

Businesses that navigate incidents well have prepared for the moment before it arrives. That preparation shows up in faster decisions, clearer responsibilities and a more controlled recovery.

The scale of cybercrime in the US will continue to grow, but the difference in impact will still come down to how well the organization was governed before it needed to prove it.

We've featured the best endpoint protection software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit