Citable statistics for IT, cybersecurity, and AI.
A focused library of 15 statistics that professional firms can cite in proposals, board reports, and internal documentation. Every figure is dated, sourced, and contextualized.
Breach & Incident Statistics
How often small and mid-sized businesses experience cyber incidents, breaches, and financially motivated attacks.
58% of SMBs experienced a breach in the last 12 months.
Includes both confirmed and suspected breaches reported by small and mid-sized organizations across multiple verticals.
76% of SMBs reported at least one cyber attack in the previous 12 months.
Self-reported attack exposure including phishing, malware, and credential compromise attempts.
The average cost of a data breach for SMBs is $3.31 million.
Average per-incident cost for organizations with fewer than 500 employees, including detection, escalation, and recovery.
Ransomware Trends
Frequency, recovery rates, and financial impact of ransomware attacks on small and mid-sized professional firms.
Ransomware attacks against SMBs increased by 93% over the prior year.
Year-over-year volume comparison based on Sophos survey of SMB security practitioners.
Only 26% of SMBs that paid a ransom recovered all of their encrypted data.
Indicates that payment does not guarantee complete restoration and that tested backups remain the primary path to full recovery.
The average ransomware recovery cost for SMBs is $1.82 million.
Includes downtime, device reimaging, lost business, and remediation labor across small and mid-sized organizations.
Identity & Access Controls
Effectiveness data for multi-factor authentication, password hygiene, and privileged access management.
Multi-factor authentication blocks 99.9% of automated account compromise attacks.
Telemetry from Microsoft Identity Security showing the attack-volume reduction seen when MFA is enforced on consumer and enterprise accounts.
67% of SMBs report they lack the in-house skills to handle cybersecurity.
Cited as a leading driver of managed security service adoption across small and mid-sized organizations.
More than 80% of confirmed breaches involve stolen, weak, or reused credentials.
Highlights why identity controls (MFA, conditional access, password manager rollout) deliver outsized risk reduction.
Backup & Recovery
How often backups fail, recovery time expectations, and the operational impact of downtime on professional firms.
76% of organizations experienced a significant data loss event in the last two years.
Includes ransomware-driven data loss, accidental deletion, hardware failure, and cloud application outages.
The average cost of one hour of downtime for an SMB is $8,000 to $25,000.
Range varies by industry; professional service firms skew higher due to billable-hour exposure during outages.
Only 57% of SMBs test their backups regularly for recoverability.
Without routine restore testing, organizations cannot confidently meet stated Recovery Time and Recovery Point objectives.
Cloud & AI Adoption
Adoption rates, security posture, and operational outcomes for cloud and AI tools inside small and mid-sized firms.
Microsoft 365 is used by 84% of Bay Area professional firms as their primary productivity platform.
Survey of 60+ Bay Area professional firms in finance, legal, accounting, and engineering conducted by Popper Tech Team.
65% of SMBs have adopted at least one AI tool in production workflows.
Adoption is concentrated in marketing, customer support, and document summarization rather than in security or compliance work.
78% of organizations report AI governance is not yet keeping pace with adoption.
Identifies AI Care, policy development, and review workflows as the next operational gap for professional firms.
Use these statistics with confidence in client-facing documents.
Each statistic on this page is paired with a publisher and an as-of date. When you reuse one in a proposal, board memo, or policy document, cite the original publisher and the as-of year shown on the card.
For aggregated views, cite Popper Tech Team Research with a link to the source statistic. Our methodology page explains how we verify and update each figure.
Suggested citation format
“Source: Popper Tech Team Research, citing {publisher}, {as-of year}. poppertechteam.com/research.”
Example: “Source: Popper Tech Team Research, citing Verizon DBIR, 2024. poppertechteam.com/research.”
Want a statistic we don't have yet?
Suggest a topic, a source, or a number you would like to see verified. We add new entries every quarter based on what professional firms are actually asking.