Across all financial services vendors, 50.2% carry high-severity CVEs.

The number of distinct threat groups targeting finance increased from 37 in 2023 to 45 in 2024 and to 48 in 2025.

Over 48,000 CVEs were published globally in 2025, an 18% year-on-year increase.

In September 2025, Qilin's compromise of a single South Korean MSP affected 32 financial institutions and resulted in over 2 terabytes of stolen data.

Qilin was responsible for 59 finance-sector incidents in the past year.

15% of security leaders cite misalignment with internal security policies as a major concern with AI-generated code.

90% of security leaders have active concerns about security risks introduced by AI-generated code.

38% of organizations still rely primarily on manual review for AI-generated code.

29% of security leaders identify insecure coding patterns as the leading risk introduced by AI coding assistants.

88% of executives say agent-washing has negatively affected their trust in AI broadly.

86% of enterprise leaders cite reliability, security, privacy, and accuracy as the top blockers preventing the implementation of autonomous agents.

47% of agentic AI deployments include dedicated agent-specific governance frameworks to manage risk.

Phishing consumes 36.5% of security team working hours, up from 33.5% three years ago.

50% of organizations rate phishing as a high or extreme threat, up from 33% in 2022.

62.5% of IT and security professionals say deepfake attacks are immediately disruptive.

Phishing costs $51,948 per security analyst annually, a 13.6% increase from $45,726 in 2022.

Nearly nine in ten IT professionals at scaled organizations say AI frequently helps detect or resolve issues before employees are impacted, compared with four in ten at early experimentation organizations.

Only 10% of large-scale enterprises have successfully transitioned autonomous AI agents from pilot phases into full-scale production.

29% of leaders find it materially harder to secure budget for AI projects due to market hype.

20% of IT and security professionals expect phishing to get easier to deal with in the next 12 months.