Stop hoping to block every thief — learn how to survive getting hit

Look at this number: in 2025 the global average cost of a single data breach was $4.44 million, and for US companies it hit an all-time record of $10.22 million. For ransomware/extortion cases specifically, the average was $5.08 million each — this isn't an IT-department line item, it's a number that can sink a company.

When the stakes get this high, the industry's whole mindset changes. The old goal was 'don't get hit' (prevent), but once ransomware spread so far that nearly every large organization had been hit or knew someone who had, the assumption flipped to 'assume breach' — take it as given that you will get hit. And the measure of strength became 'how fast can you recover?', not 'how many times did you block it?'

The most important angle is the ransom negotiation. If a company has clean copies and can recover fast, ransomware loses almost all its leverage instantly — there's no need to pay for the decryption key. In 2025 the share of organizations that 'refused to pay' rose to 63% (from 59% the year before), partly because recovery got better. That's exactly why so much money is pouring into this arena.

So the market is growing fast — the data protection & recovery market was worth about $10.7 billion in 2025 and is expected to reach about $20.4 billion by 2030 (roughly 14% a year). Some firms that count a broader scope (data resiliency) put it as high as $44 billion by 2030.

The heart of 'cyber resilience' is a strategy that sounds like giving up but is actually smart: accept from the start that the thief can get in, then have a backup plan so the data survives. It addresses the way modern ransomware keeps getting nastier — these days the thief doesn't rush to encrypt your work files; they hunt down and destroy the 'backups' first, because they know that if the victim has copies, they'll never pay the ransom.

The fix is to make the copies 'indestructible'. The modern golden rule is the 3-2-1-1-0 rule — keep several copies, with at least one immutable/offline and separated so ransomware can't reach it (deep dive in the child page).

The 'protect the data' side (DSPM/DLP) works on a different beat — it acts before anything happens, tackling a question that sounds easy but is very hard in big organizations: 'where does our confidential data live, who can reach it, and is any of it left open by accident?' DSPM tools scan across the cloud, classify the data (e.g. credit-card numbers, medical records) and flag the risky spots. DLP, meanwhile, watches to stop that data from being sent outside the organization — all to shrink the surface a thief can rob in the first place.

This node is one of several layers in Cybersecurity & Digital Trust, and it's tightly connected to the others, because 'data security' doesn't stand alone:

• Paired with Identity & Access Management: to control who can touch the data, you first have to know 'who is who' — managing data and managing identity are siblings
• The last line of defense for AI Security & Agent Guardrails: an AI assistant (like Copilot) reads a whole pile of internal data to answer questions. If access permissions were messy to begin with, the AI will accidentally 'expose' secrets to people who shouldn't see them — so tidying up the data becomes the foundation for using AI safely
• Sits on top of Enterprise Data Storage and Data Platforms & Analytics: before you can protect or back up data, you need to know where it's stored and where it flows — so this arena is entangled with the whole data infrastructure
• Driven two ways by Artificial Intelligence: AI makes thieves better (writing malware/phishing fast), but it also helps defenders recover and detect faster — IBM found that organizations using AI defenses fully cut their incident response by ~80 days and saved nearly $1.9 million per incident

The event that best shows how hot this arena is: Rubrik went IPO in April 2024 and became the star of the 'data resilience' wave — a company that reinvented itself from a backup vendor into a 'security company with backup at its core'. It closed fiscal 2026 (January 2026) with subscription ARR hitting $1.46 billion, up 34%, and kept growing to $1.57 billion the next quarter.

ภาพประกอบ (boom.png)

This wave also sparked consolidation and fierce competition on the recovery side — big players like Cohesity (which absorbed Veritas), Veeam and Commvault are the incumbents slugging it out. Dig deeper in the child page.

But if 'recovery' is the wave you can see clearly on the stock market, the 'stop the leak' side is just as hot. The 'stop the leak' side (DSPM/DLP) saw big bidding wars: Google bought Wiz for ~$32 billion, and Cyera raised money that pushed its valuation from $3 billion to $12 billion in a single year. 'Finding and locking down confidential data' has become a major investment field running parallel to recovery — see more at Data Security Posture & DLP.

This side is a newer, more fragmented market. Gartner says DSPM adoption was barely under 1% in 2022 but will blow past 20% by 2026 — one of the fastest-growing categories in security, driven by the AI wave forcing organizations to 'tidy up their data' before opening it to AI.

The first direction is the two sides melting into one. 'Protecting data' and 'recovering data' used to be separate products, separate teams — but they're converging into a single platform. Rubrik and Commvault both now call themselves 'cyber resilience', bundling security, detection and recovery in one place, because customers want to see 'how safe and how recoverable is my data' from one screen.

The second direction is AI as both a tool and a new battlefield. Defenders use AI to speed up detection and recovery (e.g. identifying which copy is 'clean' before restoring, so they don't bring malware back with it). At the same time, the rush to adopt AI across organizations creates enormous demand for DSPM, because access permissions to data have to be reorganized from scratch before AI can read it — that's why Gartner sees DSPM going from almost zero to 20%+ in just a few years.

The third direction is consolidation getting even fiercer. The Cohesity–Veritas deal is just the start. A market like this — lots of specialist players, growing fast — usually ends with giants (both platform companies like Microsoft and category leaders) buying up the pieces to complete the jigsaw. For investors, that means a small player with standout tech can become a takeover target.

The first risk is ransomware evolving faster than the defenders. As every organization adopts immutable backups, the thieves change the game — instead of just encrypting your data, they steal it first and threaten to 'leak' it (double extortion), which a backup can't help with at all, because the secrets are already out. It's an endless cat-and-mouse, and it makes the 'stop the leak' side (DLP/DSPM) matter more and more.

The second risk is AI opening a new door to data leaks. The more an organization rushes to adopt AI, the greater the risk of exposing data by accident — both from AI assistants reading messy data and from shadow AI that employees use on the sly. Keeping data tidy at the speed AI is being adopted is a problem many organizations still can't keep up with, and a gap whose cost climbs every year.

The third risk is getting squeezed by the big platforms. When Microsoft bundles DLP and data-classification tools (Purview) free with Microsoft 365, specialist players have to prove they're 'genuinely better than the freebie'. This risk looks like every software arena — a feature that once sold as a standalone product can become a throw-in inside a bigger platform.

In short: this is the story of the security industry dropping the self-deception that it can block every thief, and instead investing in 'surviving and standing back up'. The once most-boring job of all — 'data backup' — became the lifeline that lets a company avoid paying the ransom. And once AI arrived, knowing 'where our confidential data lives' became an indispensable foundation of the new era.