Technology breaches cost $4.97M on average, but the blast radius is unique.

IBM's sector figure measures the cost incurred by the breached entity. For a typical company that holds its own data, that captures the meaningful exposure. For technology companies, especially software-supply-chain vendors and cloud-infrastructure providers, the meaningful exposure includes the costs that propagate to every customer organisation that consumed the compromised product or service. The 2020 SolarWinds breach is the clearest example: SolarWinds itself disclosed roughly $90M in direct cost across response, SEC enforcement, and remediation. The cost across the 18,000 organisations that ran the trojanized Orion update was estimated at over $100M and probably exceeded $500M when fully tallied.

The MOVEit campaign in 2023 produced an even larger gap. Progress Software faced direct response costs in the tens of millions for the SQL injection vulnerability in MOVEit Transfer. The downstream impact across 2,700+ affected organisations, including state government agencies, universities, healthcare entities, and financial-services firms, was estimated at $2.7B in aggregate by IBM Security's 2024 supply-chain analysis. That figure does not appear on Progress Software's books, but it does represent the true economic cost of the breach.

The 2024 Snowflake campaign illustrated the cloud-service variant of the same dynamic. Threat actors used credentials harvested via infostealers to log into Snowflake accounts that lacked MFA enforcement, then exfiltrated customer data from approximately 165 Snowflake customer organisations including Ticketmaster, AT&T, and Santander. Snowflake itself was not breached, but Snowflake-hosted customer data was, with industry-wide costs already past $1B.

The IBM methodology captures PII-related cost categories well. It captures intellectual-property loss poorly, because the depreciation of stolen source code, model weights, or proprietary algorithms is difficult to quantify and slow to manifest. The cost shows up later in the form of lost competitive position, accelerated commoditization, and forced re-architecture to defend against the lookalike products that ship from competing jurisdictions 18 to 36 months after the breach.

For AI companies, the asset most exposed to breach is the model weight file itself. A foundation model that costs $100M to train represents a single artefact whose loss to a competitor (or to a state-sponsored actor) represents direct dollar-for-dollar depreciation of the training investment. The 2023 Mistral 7B model-weight leak is the most prominent public example, with the company subsequently acknowledging the leak but limiting its disclosure of internal cost. Model-weight protection is rapidly becoming the highest-priority data-protection objective at AI labs, with implications for security control investment that the IBM dataset has yet to track explicitly.

For SaaS firms, the exposed asset is typically the customer-tenant configuration plus the API integration credentials customers have stored in the SaaS platform. Tenant-isolation failures (where one customer's data is exposed to another) are particularly expensive because they trigger breach notification across multiple customer organisations simultaneously, each of which has its own regulator obligations. The 2023 Atlassian breach affecting Jira and Confluence Cloud customers was an instructive recent case.

The October 2023 SEC enforcement action against SolarWinds CISO Tim Brown is the single most consequential change to the cost calculus for tech-sector security leaders since GDPR. Until SolarWinds, breach cost was assumed to be an enterprise expense rather than a personal-liability question. The Brown complaint alleged that the CISO personally made materially misleading statements about the company's security posture in product collateral and SEC filings, and sought to bar him from serving as an officer or director of a public company. The case is ongoing as of 2026 but the precedent has already changed CISO insurance markets, with cyber D&O policies now standard at tech companies.

For tech-sector breach cost analysis, the implication is that the executive-protection insurance line item now adds materially to total cost-of-readiness. CISO D&O premium at a tech company with material public-cloud exposure runs $100K to $400K annually for $10M to $25M of coverage, and the deductibles have risen sharply since the Brown complaint. The cost is not in IBM's sector figure, but it is real, and it is permanent.