A new business-impact study from data security firm Cohesity is putting a hard number on something most executives have only felt anecdotally: a serious cyberattack now costs a company roughly 15% of its annual revenue, according to CEOs surveyed for the research. The findings, detailed in a September 3, 2026 report from Insurance Edge titled “Cohesity Takes a Deep Dive Into Cyber Attack Consequences for Business,” land alongside related data from Unit 42, thenationalnews.com and Cryptopolitan, painting a picture of cyber incidents that no longer stay contained to the IT department. They hit earnings calls, stock prices, insurance claims, customer rosters and, increasingly, the careers of the executives left holding the recovery plan.
What Cohesity’s New Report Actually Found
Cohesity’s research, published under the banner “Risk-Ready or Risk-Exposed: The Cyber Resilience Divide” and expanded in its 2026 Global Cyber Resilience Report, surveyed organizations about what happens after a material cyberattack, meaning an incident with measurable financial, reputational, operational or customer impact. The topline figure is stark: 76% of organizations report having experienced at least one material cyberattack. That is not a company that got phished once and moved on. That is three out of every four businesses absorbing a hit large enough to show up in a quarterly review.
What separates this report from the usual breach-count tallies is its focus on downstream business consequences rather than technical root cause. Cohesity’s researchers, and the Insurance Edge coverage that broke out the September 2026 figures, tracked what companies did afterward: whether they changed financial guidance, whether their stock moved, whether regulators came calling, and whether the people in charge of recovery kept their jobs. That framing is why the report is getting attention from insurance underwriters and CFOs as much as from security teams.
The Headline Number: Cyberattacks Erase 15% of Revenue
The figure driving most of the coverage is that CEOs surveyed estimate a cyberattack could cut their organization’s revenue by an average of 15.17%, according to the Insurance Edge deep dive on the Cohesity research. That is not a hypothetical worst case pulled from a tabletop exercise. It is executives putting a number on what they have already lived through or watched happen to peers. For a mid-size public company doing $500 million in annual revenue, that average works out to roughly $76 million in lost income, before recovery costs, legal fees or ransom payments are even added to the ledger.
The revenue damage is not evenly distributed. Insurance Edge’s coverage of Cohesity’s UK-focused data found that 84% of businesses said revenue was directly impacted by a cyberattack, with 31% reporting losses in the 1% to 10% range of annual revenue. Regional data cited alongside the Cohesity findings shows an even sharper picture in Australia, where 91% of affected enterprises experienced revenue loss, with roughly a third of those losing up to 10% of annual revenue and more than 40% losing clients outright as a direct result of the incident.
Public Companies Can’t Hide the Damage From Wall Street
For publicly traded companies, Cohesity’s research found that a cyberattack rarely stays an internal matter. 70% of publicly traded organizations in the study reported adjusting earnings or financial guidance after a cyberattack, and 68% said they observed a direct impact on their stock price following a material incident. That is a majority of listed companies telling investors, in one form or another, that a security breach moved the numbers enough to require a correction.
Cohesity’s chief executive and president, Sanjay Poonen, framed the pattern bluntly in the company’s research release: “These findings show that cyberattacks now touch every part of an organization, testing even the most well-prepared as aftershocks spread beyond technical recovery,” according to Cohesity’s newsroom. Poonen went further in the same release, arguing that “when incidents compel companies to rethink forecasts, absorb market reactions, and redirect budgets, cyber resilience is no longer just a technology issue. It’s a business and financial imperative,” a comment that captures why this data is increasingly showing up in board decks rather than just SOC dashboards.
Private Companies Pay a Quieter but Real Price
Private companies do not have to disclose earnings guidance changes or answer to a stock ticker, but Cohesity’s data suggests they are not spared. 73% of privately held organizations in the survey redirected budget away from innovation and growth initiatives after a cyberattack, funneling that money instead into recovery, compliance work and resilience upgrades. For a private firm competing against better-capitalized rivals, a year of frozen product investment can matter as much as any single quarter’s lost revenue.
This is arguably the least visible consequence in the entire report, because it never shows up in a press release or an SEC filing. A private company that quietly shelves a product launch or delays a hiring plan to cover incident response costs will not generate headlines the way a public company’s stock drop does. But the opportunity cost compounds over time, and it is one reason cyber insurers and private equity due-diligence teams have started asking pointed questions about backup architecture and ransomware readiness before closing deals.
The Legal and Regulatory Bill Nobody Budgets For
Perhaps the most consistent number across every version of Cohesity’s research is the legal and regulatory fallout rate. 92% of organizations that suffered a material cyberattack reported legal, regulatory or compliance consequences, a figure that appears both in the original “Risk-Ready or Risk-Exposed” study and again in the 2026 Global Cyber Resilience Report, where it sits alongside 42% of organizations losing customers and 87% losing revenue after an attack. Insurance Edge’s UK breakdown adds a sharper edge to the same trend: 45% of businesses received fines or formal penalties, and 86% reported inquiries or increased pressure from shareholders following a material incident.
That consistency across multiple survey waves and regions suggests the regulatory exposure is not a one-off artifact of a single jurisdiction’s disclosure rules. It is a structural feature of how governments and shareholders now respond to breaches, and it means the true cost of an attack extends well past the incident response invoice. Legal counsel, regulatory filings, shareholder communications and potential litigation now sit on the same balance sheet line as the ransomware recovery itself. The scale of the data at risk keeps climbing too, as seen in the FBI’s active probe into a breach exposing 153 million driver’s licenses and Manchester Airport Group’s breach affecting 8.7 million customers.
Ransom Payments Are Still Business as Usual
Despite years of law enforcement guidance discouraging ransom payments, Cohesity’s research and the Insurance Edge coverage of it show paying up remains the norm rather than the exception. 71% of UK businesses said they had paid a ransom in the last 12 months, and 33% of organizations globally have paid $1 million or more in a single ransom payment. Average UK ransomware payments land around $1.4 million, slightly above the global average of $1.3 million cited in the same reporting.
A Cohesity research report captured why organizations feel they have no choice but to pay: “When an organization gets hit by ransomware, and data is stolen, wiped, infected, or otherwise compromised, that organization can’t properly function until its data, processes, operations, and applications are restored,” according to the company’s State of Data Security and Management report. That operational paralysis, more than any ethical calculus about funding criminal groups, is what keeps ransom payments elevated year after year. Recent incidents bear this out: McKesson’s confirmed breach came with a $55 million ransom demand tied to 284 million records, and Berlin’s government confirmed 5.79TB of stolen data after a Rhysida ransomware attack, both illustrating the same pressure Cohesity’s survey respondents describe.
Why “Just Restore From Backup” Isn’t Simple
Cohesity’s own CISO, Tim Brown, has pushed back publicly on the assumption that backups alone solve the ransomware problem. In comments covered by SiliconANGLE, Brown noted that “your backups won’t save you if they can be accessed by threat actors, and the sooner that an organization comes to that realization, the better,” a point discussed at length in SiliconANGLE’s coverage of a Cohesity cyber resilience discussion. Modern ransomware groups routinely target backup repositories first, precisely because they know recovery capability is what gives victims leverage to refuse payment.
Cyber Insurance Isn’t the Safety Net Executives Think It Is
One of the more uncomfortable findings in Cohesity’s data concerns cyber insurance. 90% of British businesses relied on cyber insurance to help fund recovery after an attack, but 91% of those same businesses said the insurance did not adequately cover the actual recovery costs. In other words, nearly every affected company had a policy, and nearly every one of them found it insufficient once the bills came in.
This gap matters because it changes how companies budget for cyber risk. A policy that covers a fraction of real recovery costs is not risk transfer in any meaningful sense; it is a partial subsidy that still leaves the organization exposed to the revenue hit, legal costs and reputational fallout described elsewhere in the report. Insurers themselves are adjusting: premiums for organizations without demonstrated backup immutability and tested recovery plans have climbed, and some underwriters now require proof of isolated, air-gapped backup copies before issuing or renewing a policy. That requirement dovetails with broader defensive practices like network segmentation against ransomware, which insurers increasingly treat as a baseline control rather than a nice-to-have.
Executives Are Now Personally on the Hook
Perhaps the clearest sign that cyberattacks have become a boardroom issue rather than an IT issue is what happens to the people in charge of recovery. Over 80% of CEOs surveyed in Cohesity-linked research agree that the position of whoever is responsible for recovery is at risk if that person fails to deliver a fast and secure recovery. When asked who ultimately bears responsibility for the long-term business impact of an attack, the CEO role itself was the single most commonly cited answer, at 20%, ahead of the CISO, CIO or board.
A Cohesity spokesperson summarized the shift this way in an earlier company release: “The reality for organizations is that destructive cyberattacks, like ransomware, are a ‘when’ not ‘if’ reality that threatens their business continuity,” a framing echoed across the company’s 2024 and 2026 research releases. That “when, not if” language has effectively become the standard talking point for cyber insurers, resilience vendors and now, increasingly, corporate boards drafting succession and accountability plans.
Unit 42 Data Shows Why Attacks Are Getting More Costly, Faster
Cohesity’s business-impact numbers do not exist in isolation. The 2026 Unit 42 Global Incident Response Report, produced by Palo Alto Networks’ threat intelligence arm, and a joint Cohesity-Unit 42 webinar referenced alongside the Insurance Edge coverage both point to the same underlying driver: attacks are compressing the window between initial access and material business disruption. Where breaches once took days to escalate from a foothold to full-blown business impact, Unit 42’s research describes disruption now unfolding in minutes in the most severe cases.
That speed is precisely why the financial and legal consequences tracked by Cohesity have become so consistent across company size and geography. When an attacker can move from initial compromise to encrypting backups or exfiltrating regulated data in a matter of hours, the traditional incident response playbook, detect, contain, eradicate, recover, has far less time to work before the damage reaches the point of no return for that quarter’s numbers. You can review Unit 42’s broader research directly at unit42.paloaltonetworks.com.
How Cohesity’s Findings Compare to Other Industry Reports
Cohesity is not the only vendor tracking the business cost of cyberattacks, and its findings sit within a broader ecosystem of annual security research. IBM’s long-running Cost of a Data Breach report, Verizon’s Data Breach Investigations Report, and Unit 42’s incident response research all approach the same underlying question from different angles, one skewed toward technical breach mechanics, another toward direct dollar-cost averages, and Cohesity’s toward the operational and governance aftermath. The table below lines up how each report frames its headline metric.
| Report | Primary Focus | Headline 2025-2026 Metric | Source |
|---|---|---|---|
| Cohesity Global Cyber Resilience Report | Business and governance aftermath | 92% face legal/regulatory consequences; 87% lose revenue | Cohesity newsroom |
| Cohesity / Insurance Edge UK deep dive | Revenue and insurance impact | CEOs estimate 15.17% average revenue loss | Insurance Edge, Sept. 3, 2026 |
| IBM Cost of a Data Breach | Average per-incident dollar cost | Multi-million dollar average breach cost, tracked annually | ibm.com/reports/data-breach |
| Verizon Data Breach Investigations Report | Breach patterns and threat actor tactics | Annual analysis of confirmed data breaches worldwide | verizon.com/business/resources/reports/dbir |
| Unit 42 Global Incident Response Report | Attack speed and incident response | Business disruption now measured in minutes, not days | unit42.paloaltonetworks.com |
The differences in methodology matter less than the direction they all point. Whether a report measures dollars, days, or disclosure obligations, every major 2025-2026 dataset shows cyberattacks pushing further into the business side of the organization, out of the SOC and into the CFO’s forecast model.
Cohesity’s Business-Impact Metrics at a Glance
To make the scale of these findings easier to compare, the table below consolidates the key figures from Cohesity’s research as reported by Insurance Edge and Cohesity’s own newsroom.
| Metric | Reported Figure | Source |
|---|---|---|
| Organizations experiencing a material cyberattack | 76% | Cohesity, “Risk-Ready or Risk-Exposed” |
| Public companies adjusting earnings guidance post-attack | 70% | Cohesity research release |
| Public companies reporting stock price impact | 68% | Cohesity research release |
| Private firms redirecting budget from growth/innovation | 73% | Cohesity research release |
| Organizations facing legal/regulatory consequences | 92% | Cohesity Global Cyber Resilience Report |
| Average CEO-estimated revenue loss from an attack | 15.17% | Insurance Edge, Sept. 3, 2026 |
| UK businesses that paid a ransom in the past 12 months | 71% | Insurance Edge / Cohesity UK data |
| Organizations paying $1 million or more in ransom | 33% | Insurance Edge / Cohesity UK data |
| UK businesses saying insurance didn’t cover recovery costs | 91% | Insurance Edge / Cohesity UK data |
| Businesses reporting shareholder pressure post-attack | 86% | Insurance Edge / Cohesity UK data |
Historical Context: From IT Problem to Boardroom Crisis
It is worth remembering how recently this framing shift happened. A decade ago, a ransomware infection was largely treated as an operational nuisance, something the IT department cleaned up over a long weekend, with a brief note to customers if a compliance rule required it. The 2017 WannaCry and NotPetya outbreaks began changing that calculus by demonstrating that malware could halt shipping lines, hospitals and manufacturing plants simultaneously. The 2021 Colonial Pipeline ransomware attack pushed the conversation further into the political and regulatory sphere, forcing a US government response and new disclosure expectations.
What Cohesity’s 2026 data captures is the next stage of that evolution: cyberattacks as a routine, quantifiable line item in enterprise risk management, with standardized metrics, insurance underwriting criteria and executive accountability structures built around them. The security industry has spent years trying to translate technical risk into a language boards and CFOs understand. Frameworks like Annualized Loss Expectancy have existed for decades precisely to bridge that gap between a vulnerability scan and a budget line.
Annualized Loss Expectancy (ALE) = SLE x ARO
SLE (Single Loss Expectancy) = Asset Value x Exposure Factor
ARO (Annualized Rate of Occurrence) = Expected incidents per year
Example, using Cohesity's reported averages:
Asset Value (annual revenue) = $500,000,000
Exposure Factor (avg. reported)= 15.17%
SLE = $75,850,000
ARO (material attack likelihood)= 0.76
ALE = $57,646,000 / year
That kind of back-of-envelope math, using Cohesity’s own reported averages, is exactly what is now showing up in board risk committee presentations, and it explains why cyber resilience budgets are increasingly approved alongside capital expenditure rather than treated as a discretionary IT line item.
The Gap Between CEO Estimates and CISO Reality
One nuance worth flagging in Cohesity’s data: the 15.17% revenue-loss figure comes from CEO estimates, not confirmed post-incident accounting. That distinction matters. CISOs and CFOs closer to the actual recovery ledger may arrive at different numbers once ransom payments, legal fees, insurance shortfalls and lost contracts are fully tallied months later. The gap between what executives expect going in and what an attack actually costs once every invoice clears is itself a data point the industry has struggled to standardize, which is part of why reports like Cohesity’s, IBM’s and Verizon’s still diverge on methodology even as they converge on direction.
Market Impact: Why Cyber Resilience Is Becoming a Wall Street Metric
The market reaction data in Cohesity’s report, 68% of public companies reporting a stock price impact and 70% adjusting guidance, has implications well beyond the companies directly affected. Institutional investors and ratings agencies have started treating disclosed cyber incidents as a factor in valuation models, not unlike environmental liabilities or pending litigation. A 15% average revenue hit, if it materializes as CEOs in the Cohesity survey expect, is large enough to move a company’s forward earnings estimates on its own.
This is also reshaping the vendor landscape around data protection and recovery. Backup and resilience vendors, Cohesity included, are increasingly pitching their products using the language of business continuity and financial risk reduction rather than pure technical uptime, because that is the language now driving purchasing decisions at the board level. Expect security budgets in 2027 to shift further toward provable, testable recovery capability rather than prevention-only tooling, since Cohesity’s data shows prevention alone is clearly not stopping 76% of organizations from experiencing a material incident. That shift is already visible in the market: cybersecurity stocks climbed 102% following recent AI-driven cyberattack warnings, and vendors are racing to keep pace with faster-moving threats like the StormEncryptor ransomware campaign exploiting an unpatched N-able bug.
What Comes Next: Five Predictions for Cyber Resilience
- Cyber insurance underwriting will tighten further. With 91% of UK businesses saying their coverage fell short, insurers are likely to demand proof of immutable, air-gapped backups and tested recovery plans before issuing or renewing policies.
- Boards will formalize post-incident accountability structures. With 20% of CEOs already viewed as the party responsible for long-term business impact, expect more companies to write explicit incident-accountability clauses into executive contracts.
- Regulators will keep expanding disclosure requirements. Given that 92% of affected organizations already face legal or regulatory consequences, additional jurisdictions are likely to introduce faster mandatory breach-disclosure windows modeled on existing SEC-style rules.
- Recovery speed will become a competitive marketing point. As Unit 42’s data shows disruption now unfolding in minutes, vendors and enterprises alike will increasingly publicize recovery time objectives as a trust signal to customers and partners.
- Ransom payment volumes will stay elevated in the near term. With 71% of UK businesses paying a ransom in the last year and average payments near $1.4 million, payments are unlikely to drop meaningfully until recovery capability improves enough to remove the operational pressure Cohesity’s report describes.
What Cyber Resilience Leaders Are Saying
Cohesity executives have been consistent in describing this data as a turning point for how businesses think about resilience. As Sanjay Poonen, the company’s CEO and president, put it in the firm’s research release, cyber resilience “is no longer just a technology issue. It’s a business and financial imperative,” a comment available in full via Cohesity’s newsroom. That framing, repeated across the company’s 2024 and 2026 research cycles, is increasingly shared by outside security leaders covering the same data, including Cohesity CISO Tim Brown’s warning, reported by SiliconANGLE, that backup infrastructure itself is now a primary attacker target rather than a guaranteed fallback.
Where This Leaves Small and Mid-Size Businesses
Most of the headline figures in Cohesity’s report come from surveys skewed toward larger enterprises with the resources to track earnings guidance changes and shareholder pressure in the first place. But the underlying dynamics, ransom demands, insurance shortfalls and legal exposure, apply just as directly to smaller companies, often with less room to absorb the hit. A small business without a dedicated legal or investor relations team facing the same 92% odds of legal or regulatory fallout has fewer resources to manage that exposure than a Fortune 500 company does.
That asymmetry is part of why cyber insurance brokers and managed security providers have leaned harder into small and mid-market segments over the past two years, positioning tested backup and recovery capability as a baseline requirement rather than an optional upgrade. Given that 90% of businesses in Cohesity’s UK data already relied on insurance to fund recovery, and the vast majority found it insufficient, smaller organizations without deep cash reserves face a sharper version of the same math.
Frequently Asked Questions
What is Cohesity’s cyber resilience report actually about?
It is a business-impact study examining what happens to organizations after a material cyberattack, covering financial guidance changes, stock price impact, legal and regulatory consequences, ransom payments and executive accountability, rather than focusing purely on technical breach details.
How much revenue does a cyberattack typically cost a company?
CEOs surveyed for the Cohesity research, as reported by Insurance Edge on September 3, 2026, estimate an average revenue loss of 15.17% following a material cyberattack.
Do most companies that pay a ransom actually recover their data?
The Cohesity data does not provide a specific recovery success rate, but it shows ransom payments remain common, with 71% of UK businesses paying a ransom in the past 12 months and 33% of organizations globally paying $1 million or more.
Does cyber insurance cover the full cost of a cyberattack?
According to Cohesity’s UK data cited by Insurance Edge, 90% of businesses relied on cyber insurance for recovery, but 91% said the coverage did not adequately cover their actual recovery costs.
Who is held responsible when a company suffers a cyberattack?
Cohesity’s research found the CEO role is the most commonly cited party responsible for the long-term business impact of an attack, at 20%, and that over 80% of CEOs agree the recovery lead’s job is at risk if the response fails.
How does Cohesity’s data compare to Unit 42’s incident response findings?
Unit 42’s 2026 Global Incident Response Report focuses on attack speed, finding that business disruption now unfolds in minutes rather than days, which helps explain why Cohesity’s business-impact metrics, like the 92% legal and regulatory consequence rate, have stayed consistently high across survey waves.
Are private companies affected the same way as public companies?
Not identically. Public companies more often report stock price impacts and earnings guidance changes, while Cohesity’s data shows 73% of private companies instead redirected budget away from growth and innovation initiatives to fund recovery and resilience.
What should businesses do based on this report?
Security leaders point to testable, immutable backup infrastructure, clearer executive accountability for recovery, and closer alignment between cyber insurance coverage and actual recovery costs as the areas most directly implicated by Cohesity’s findings.