Executives responsible for cybersecurity can quantify to the dollar what their organization spent last year on compliance, including training, policy enforcement, and awareness campaigns. But quantifying the benefits from those expenses is surprisingly difficult. There is no strong evidence that spending more and more on compliance produces fewer or less severe cyber incidents. According to Verizon’s 2026 Data Breach Investigations Report, 62% of breaches last year involved a human element—roughly where this number has sat for three years. At the same time, compliance budgets have grown. If compliance alone was working, these numbers would be falling.
