Mainframe Security
Four Numbers Every Mainframe Team Should Be Able to Produce
By SDS • 4 min read • October 2026
Cybersecurity Awareness Month generates an enormous amount of advice and very little that anyone can check.
Encrypt your data. Control access. Monitor continuously. Patch promptly. Train your people. All true, all published every October by every vendor, including us, and none of it tells you whether your own environment is in good shape.
So as this one closes, here is the opposite of that: four questions with numeric answers, each tied to something the 2026 Cost of a Data Breach Report actually measured. If your team can produce all four, you are in better shape than most of the 602 organizations IBM and Ponemon studied. If you cannot produce them, the gap is not a control gap yet. It is a measurement gap, and that is cheaper to close.
1. What percentage of your sensitive z/OS data is encrypted at rest?
Why this number: 53% of breached organizations were not encrypting sensitive data at rest and in motion at the time of the breach. Another 10% did not know whether they were.
That 10% is the more interesting figure. Those organizations were not deciding against encryption. They simply could not say.
Encryption reduced average breach cost by USD 213,478, compared with a USD 4.99 million global average. Data security and protection software reduced it by USD 198,259.
What a good answer sounds like: “Sixty-eight percent of datasets in PCI scope, and here is the report.” Not “we have an encryption product.”
If you cannot answer it: Start by identifying which datasets hold regulated data. Most teams discover that the inventory itself is the missing piece, not the encryption.
2. How many SSH keys and authorized-key entries exist, and how many have no owner?
Why this number: 61% of organizations lack controls to monitor and secure cryptographic assets such as keys, certificates, and algorithms. Only 34% have them.
Mismanaged secrets and keys added USD 198,933 to average breach cost. Excessive privileges and poor role management added USD 177,313. Identity and access management reduced it by USD 225,622, the second largest reducer across all 30 factors the report analyzed.
What a good answer sounds like: A count, and a smaller count of orphans.
If you cannot answer it: This is the single most common finding on a mainframe security review and one of the cheapest to start on. The count usually surprises somebody senior enough to fund the next step.
3. Do z/OS security events reach your SIEM, and has anyone built correlation rules against them?
Why this number: Mean time to identify and contain a breach rose to 247 days this year, reversing a five-year decline. Breaches running past 200 days averaged USD 5.65 million. Under 200 days, USD 4.32 million. Roughly a third more for the same class of event, based on duration alone.
The report then breaks it out by who found the breach. Internal IT and security teams identified and contained breaches in 209 days, 15% faster than the global average. When a third party found it, 281 days. When the attacker disclosed it, it took 268 days, at an average cost of USD 5.12 million.
Internal teams found 38% of breaches, and the report attributes their speed to tooling: they have the detection stack and visibility into their own environment.
What a good answer sounds like: Naming the event types flowing and naming a rule that would fire.
If you cannot answer it: Feeding events into a platform nobody has tuned is not visibility. Both halves have to be true.
4. What is your current count of open STIG findings, and when was the last check?
Why this number: Noncompliance with regulations added USD 201,112 to the average breach cost. Security system complexity added USD 208,265, the second largest amplifier in the study. Lack of visibility into the number and location of applications added USD 201,165.
What a good answer sounds like: A number and a date within the last month.
If the answer is “the annual audit”: You are measuring drift once a year against attackers who operate continuously. Every exception in your environment was reasonable when somebody made it. That is what makes drift hard. There is no bad decision to find, only a long accumulation of sensible ones and no running total.
The fifth question, which is really about everything else
One more is worth adding, and it tends to change how the other four are treated.
Can somebody outside the mainframe team see mainframe security posture without asking the mainframe team?
If the answer is no, the mainframe is a black box to your CISO, and a black box does not appear on a risk register with a number next to it. It appears as a line item that says “mainframe” and gets funded accordingly.
This is also why the four questions above are phrased as numbers rather than as controls. Numbers travel upward. Controls do not.
What the report does not tell you
Worth saying plainly, because it is the honest version of this campaign.
The 2026 report studied 602 organizations across 17 industries and 16 countries. It segments by industry, by region, by attack vector, by storage location, and by AI exposure. It does not break out the mainframe once, and neither does any other major breach study.
It does show that 30% of breaches involved data stored on premises, up from 28% last year and 20% in 2024, and that those breaches took 244 days to identify and contain, up from 217. The mainframe is inside that number. Nobody is measuring it separately.
That means the only mainframe-specific security data you’ll get this year is the data you produce about your own environment. That is what these four questions are for.
Fifteen minutes and a score
Our 2026 Mainframe Security Self-Assessment asks twenty questions across encryption, keys and access, visibility, and configuration drift. The four above are items 1, 6, 11, and 16, and they carry most of the weight.
It scores out of 40, produces a one-page summary built to be forwarded without editing, and includes the report finding behind every section so it holds up when somebody checks.
November is a better month to act on this than October anyway. The noise has passed and the budget conversations are starting.
Source: IBM and Ponemon Institute, “Cost of a Data Breach Report 2026: The AI Tipping Point.” Findings referenced above appear on pages 15, 18, 19, 21, 26, 27, 29, 31, 50, and 63. Figures are global averages across the study population and are not specific to any platform, industry, or organization.
Free Demo/Trial
We offer individualized product demonstrations by request. Your organization can also try SDS Software on your system for 30 days, free of charge.
Phone: (800) 443-6183
Phone: (763) 571-9000
200 Village Center Drive, Suite 250
North Oaks, MN 55127
USA
