The average data breach now costs $6 million and takes 247 days to detect and contain. For the first time in five years, that detection window is getting longer. The uncomfortable truth buried in IBM’s just-released 2026 Cost of a Data Breach Report. To put it in perspective: The average company loses $1,100 for every hour a breach goes uncontained.

These stats haven’t moved since the beginning of the pandemic. 68% of breaches involve some kind of employee mistake or misuse, and almost 95% of security issues have a human element somewhere in the chain. The single most effective way to reduce costs is to train them better.

How to do that? Frequency matters more than duration: frequent, short simulations beat annual long training every time. Realistic scenarios: content and simulations should mirror actual threats your industry faces, not generic examples. And above all: no punishment. Shaming employees who click drives mistakes underground; learning cultures report more and hide less.

Organizations that catch breaches in under 200 days pay roughly $1 million less than those that don’t. MFA eliminates the easiest credential-theft path. And phishing, which is the most common entry point for the fourth straight year, is one of the most trainable threats in cybersecurity. The employees who are currently the biggest vulnerability can, with the right awareness program, become the organization’s most reliable early-warning system.