How to use breach-cost statistics without fear selling

A security slide says the average breach costs millions. The presenter pauses, then asks the customer: “Can you afford not to buy?”

That is a familiar sales move.

It is also weak evidence.

IBM's India findings from the 2026 Cost of a Data Breach Report, announced on 3 August 2026, reported an average organisational breach cost of INR 255 million, or INR 25.5 crore, in India. The announcement said this was 15.9% higher than the previous year's INR 220 million, and that the average breach in the India sample involved 39,500 compromised records. [Source: IBM India, 3 August 2026.]

Those figures can show that breach consequences are financially significant. They cannot tell one customer what their next incident will cost.

An average combines different organisations, incidents and cost profiles.

A buyer may be larger or smaller than the organisations studied. The incident type may differ. The customer's detection, response, insurance, legal exposure and operating model may differ.

The correct statement is that the study observed an average across its sample.

The wrong statement is, “This is what a breach will cost you.”

Salespeople should keep that distinction explicit.

Public breach data can help establish why cybersecurity deserves executive attention.

It should not be dropped directly into a return-on-investment model for the customer unless the customer has agreed that the figure is relevant to its own assumptions.

A business case should use customer evidence where possible: current process cost, known exposure, operational downtime assumptions, staffing burden, insurance conditions or an internal risk estimate approved by the customer's owner.

External research can support the conversation without pretending to be customer data.

A common shortcut is:

average breach cost × assumed breach probability = expected saving.

The arithmetic is easy. The evidence is usually weak.

If the customer has not established the probability, the seller should not invent one. If the product has not demonstrated a measured reduction in that probability, do not convert the result into “risk avoided.”

A security capability may reduce exposure, improve detection or shorten a process. Those are useful outcomes when supported by evidence.

They are not the same as a guaranteed financial saving.

IBM's global 2026 announcement said one in four malicious breaches in its study were AI-enabled and that those breaches cost $6 million on average, compared with a $4.99 million global average across breaches in the report. [Source: IBM, 29 July 2026.]

That is striking context.

It does not establish that a customer's threat actor will use AI, that an AI-security product will prevent the event or that the difference between those averages is the value of the proposed solution.

The seller should use the statistic to open a question, not close the commercial argument.

A buyer may be more concerned about service interruption than breach cost.

Another may care about customer trust, regulatory response, incident workload or contractual obligations.

The external statistic is less important than the customer's own consequence.

Ask what happens when the current control fails. Who is affected? Which process stops? What evidence does the organisation already use to quantify the risk?

Then build the recommendation from that.

Cybersecurity buyers already know incidents can be serious.

Exaggerating the threat does not make the product more credible.

A buyer who sees a seller misuse a public statistic may start questioning the rest of the proposal: product claims, PoC results, assurance evidence and commercial assumptions.

Evidence discipline is therefore a sales advantage.

Use public breach research to show scale, trends and why the category deserves attention. Label the source and date. State the population when it matters. Then move back to the customer's own environment.

The strongest security sale is not “something bad could happen.”

It is “this is the problem you identified, this is the evidence we have, this is what the proposed control changes, and this is what remains uncertain.”

Relevant programme: Develop evidence-led risk and commercial judgment through the ASTRA Cybersecurity Sales Specialist programme: https://www.astraready.com/programmes/