Breach cost: global average ~USD 4.4M (IBM Cost of a Data Breach 2025); the Middle East is among the most expensive regions at ~SAR 27M (~USD 7.3M). Root causes: the Verizon DBIR consistently finds most breaches involve a human element (credentials, phishing, error) plus exploitation of vulnerabilities in internet-facing systems. Adoption: penetration testing is now a baseline expectation - required or strongly expected under PCI DSS, SOC 2, ISO 27001, and the GCC's CBB/NCA/SAMA regimes, and demanded by customers and insurers. Remediation: fix criticals fast (days to weeks) and retest - the exploit window is shrinking. All figures cited below; our own experience is flagged as directional.
// 01 The cost of a breach
The single most-cited statistic in security business cases is breach cost, and the authoritative annual source is the IBM Cost of a Data Breach Report. Its 2025 edition put the global average at roughly USD 4.4 million per breach. Regionally, the Middle East consistently ranks among the most expensive places to suffer a breach - reported at approximately SAR 27 million (around USD 7.3 million) and repeatedly near the top of the global table. Costs skew higher in regulated sectors like finance and healthcare, where the data is more sensitive and the regulatory consequences steeper. The practical takeaway for a GCC board: a breach here is not a discount event - it is one of the costliest in the world, which reframes the price of a penetration test as a rounding error against the downside.
// 02 What actually causes breaches
The human element
Verizon's DBIR consistently attributes the majority of breaches to a human element - stolen credentials, phishing and simple error.
Exploited vulnerabilities
Exploitation of weaknesses in internet-facing systems and web apps is a recurring and growing initial-access route.
Weak / stolen credentials
Credential abuse remains one of the most common root causes across reports.
Misconfiguration
Unpatched and misconfigured systems - especially in cloud - repeatedly enable compromise.
The pattern is stable year over year: attackers get in through people and unpatched or misconfigured technology. That is exactly the surface penetration testing and phishing simulation are designed to probe - which is why testing pairs with identity controls and awareness rather than replacing them.
// 03 The weaknesses we see most (directional)
Beyond the public reports, buyers often ask what we find most often. Being honest about the nature of this data: it is directional experience, not a formal statistical study, so we present it as a pattern rather than a percentage. Across GCC web and API engagements the recurring high-impact themes are broken access control - especially object-level authorisation flaws where one user can reach another's data - business-logic abuse, weak authentication and session handling, security misconfiguration, and injection in its various forms. This mirrors the OWASP Top 10 and API Top 10, where authorisation failures lead. The consistent lesson: the breach-causing bugs are logic and access-control flaws a scanner cannot find - the case for manual testing, made from the field.
// 04 Testing adoption & the compliance driver
Penetration testing has crossed from optional to baseline. Precise global adoption percentages differ by survey, but the structural drivers are unambiguous: testing is required or strongly expected under PCI DSS, SOC 2, ISO 27001, HIPAA and the GCC regimes - the CBB, NCA and SAMA frameworks - and it is routinely demanded by enterprise customers (via security questionnaires) and cyber insurers (as a condition of cover). For a medium-to-large GCC organisation, the question in 2026 is not whether to test but how well.
// 05 Remediation speed - the shrinking window
The final statistic that matters is time. Industry reporting repeatedly shows the gap between a vulnerability becoming known and being exploited is shrinking, so remediation speed is now a risk variable in its own right. Good practice: fix critical and high-severity findings within days to a few weeks, retest to confirm closure, and schedule lower-severity issues on a risk basis. This isn't just hygiene - PCI DSS explicitly requires exploitable findings to be corrected and the testing repeated, making prompt remediation and retest part of compliance. A test that finds problems but sits unactioned converts a private finding into a future public breach - the expensive kind the first statistic measured.
// 06 Frequently asked questions
How much does a data breach cost in 2026?
Per IBM's Cost of a Data Breach Report 2025, the global average was around USD 4.4 million. The Middle East is among the most expensive regions, reported at roughly SAR 27 million (~USD 7.3 million) and consistently near the top globally. Costs vary by sector, with finance and healthcare at the higher end. These are the most commonly cited benchmarks, updated annually.
What are the most common causes of breaches?
Reporting such as the Verizon DBIR consistently finds most breaches involve a human element - credential theft, phishing and error - alongside exploitation of vulnerabilities in internet-facing systems and web apps. Stolen/weak credentials and unpatched or misconfigured systems are recurring root causes, which is why testing pairs with awareness and identity controls.
How many organisations perform penetration testing?
It's now mainstream - required or strongly expected under PCI DSS, SOC 2, ISO 27001, HIPAA and the GCC CBB/NCA/SAMA regimes, and demanded by enterprise customers and cyber insurers. Exact global adoption figures vary by survey, but regular human-led testing is now a baseline expectation for medium and large organisations, driven by regulation and commercial pressure.
How quickly should findings be fixed?
No single mandated timeline, but good practice is to remediate critical and high findings within days to a few weeks and retest to confirm closure, with lower-severity issues on a risk-based schedule. The exploit window is shrinking, so slow remediation raises risk. PCI DSS explicitly requires exploitable findings to be corrected and retested, making prompt remediation part of compliance.
// 07 Sources & related reading
- Sources: IBM Cost of a Data Breach Report 2025; Verizon Data Breach Investigations Report 2025; the CBB, NCA, SAMA, PCI DSS and ISO 27001 frameworks. Our own findings are flagged as directional experience.
- How much does penetration testing cost? and OWASP Top 10 in real engagements.
- Building the pentest business case and penetration testing ROI.