What breach data says about response time

Security spending is often hard to justify because its return is the absence of an event. The annual breach-cost research is useful precisely because it turns that absence into numbers. IBM's Cost of a Data Breach report, conducted with the Ponemon Institute, put the global average cost of a breach at USD 4.45 million in 2023.

More useful than the headline is the mechanism behind it. The same research consistently finds that the cost of a breach is strongly related to how long it goes undetected and uncontained.

In the 2023 report, organisations took an average of 277 days to identify and contain a breach. That window, around nine months on average, is where much of the damage accumulates: more records exposed, more systems reached, more regulatory and recovery cost incurred.

Organisations that detected and contained breaches faster reported materially lower costs. The lever, in other words, is not only prevention. It is the speed of detection and response.

Shortening the window is largely a matter of visibility. Systems that record consequential actions, monitor for anomalies, and make it possible to reconstruct what happened let a team detect a problem sooner and scope it faster once found.

This is where auditability earns its keep beyond compliance. The same audit trails that make a system explainable to a regulator are what let a responder answer, quickly, the only questions that matter during an incident: what was accessed, by whom, and when.