Cybersecurity statistics:
Methodology and sources

Data sources and attribution

Queries are keyword-driven from a maintained keyword list that groups terms by category.

We synthesize information from many sources for statistics and event aggregation; each statistic is derived from article-level evidence stored with links.

Content retrieval and collection cadence

Timeouts, retries, TLS fallbacks, and referer headers are used to reduce transient failures.

Publication date and title are taken from the extractor when available; date parsing is normalized to date-only.

Daily runs query the last 1 day of content.

Feature extraction

LLM relevance assessment

Each article is evaluated by an LLM with a deterministic setting (temperature 0) and a constrained prompt that requires explicit, structured outputs:

Article type and categorization

Relevant articles are categorized via structured taxonomy prompts (primary: attack status, event type, regulatory/legal; secondary: impact metrics/class, technical specifics, sectors, geography, size, approximate damage).

Event clustering (article-to-event aggregation)

Objective: group articles that describe the same underlying incident into a single ‘event’.

Events maintain aggregated fields: first/last seen dates, article count, organizations affected, threat actors, titles, links.

Accuracy and quality assurance

Limitations

How statistics are computed

Article-level fields are derived from direct extraction and LLM outputs (stored per record).

Report statistics pull from these stored tables; each figure can be traced back to event rows and underlying article records.

Data sources and discovery

Source types

Cybersecurity-related articles and reports are collected from multiple source categories, including:

• Mainstream and technology media.
  Examples include major international news organizations and technology publications.

• Authoritative and expert cybersecurity sources.
  Including government agencies, cybersecurity research organizations, and established industry publications.

• Regional and local news outlets.
  Covering cybersecurity incidents across North America, Europe, Asia-Pacific, and other regions.

• Industry and research reports.
  Including annual breach reports, threat landscape reports, surveys, and economic analyses.

Each source is attributed at the article or report level, with publication date, outlet, and original URL preserved.

Discovery process

Content discovery is performed using automated search queries based on a maintained cybersecurity keyword list. Keywords are grouped by topic (for example: data breaches, ransomware, phishing, vulnerabilities, regulation).

Searches are run on a daily basis to capture newly published content. Each run queries recent material only, ensuring the dataset reflects current reporting.

Content collection and processing

Relevance filtering and classification

Cybersecurity relevance assessment

Each article is evaluated to determine whether it is relevant to cybersecurity statistics. Articles must meaningfully describe or analyze a cybersecurity event, threat, vulnerability, or regulatory action.

Event clustering (article-to-event aggregation)

Multiple articles often report on the same underlying cyber incident. To prevent overcounting:

• Articles describing the same incident are grouped into a single event

• Events are assigned stable internal identifiers

• Articles are linked to existing events only when there is high confidence they describe the same occurrence

Indicators used for clustering include affected organizations, threat actors, timelines, and incident descriptions.

Event-level records maintain:

• First and last appearance dates

• Number of related articles

• Affected organizations

• Referenced threat actors

• Source links for verification

Use of automated analysis and quality controls

Automated classification

Structured, deterministic language-model analysis is used for classification, extraction, and aggregation. All automated outputs follow predefined schemas to ensure consistency.

The models operate with deterministic settings to reduce variability and hallucination risk.

Quality assurance

To maintain accuracy:

• Schema validation ensures only properly structured outputs are counted

• Regular monthly sampling and review procedures, including a precision review, are conducted to detect classification drift. This review identifies shifts in classification, which then informs and necessitates adjustments to the model.

• Ambiguous or high-impact cases are flagged for human review

• Aggregated statistics retain traceability to individual articles and events

How statistics are calculated

Article-level vs event-level metrics

Some statistics are based on:

• Article-level counts (e.g., volume of media coverage)

• Event-level counts (e.g., number of distinct breaches or incidents)

Where applicable, event-level metrics are preferred to reduce duplication.

Interpretation of counts and frequencies

Statistics such as “incidents per day” or “breaches per year” represent reported or media-visible activity, not total global activity.

Vendor telemetry, government complaint systems, and economic projections often report significantly higher volumes due to differences in scope and methodology. These differences are noted where relevant.

Limitations and considerations

While care is taken to ensure accuracy and consistency, the data has inherent limitations:

• Not all incidents are publicly disclosed or reported

• Media coverage varies by region, sector, and incident scale

• Some sources restrict access

• Classification errors may occur in edge cases

• Economic loss figures may change as investigations evolve

Statistics should therefore be interpreted as directional indicators, not exhaustive measurements.

Sources Index

Each numbered source below corresponds to a superscript reference used on the Cybersecurity Statistics page. Superscripts link directly to the relevant source entry on this page.