Copilot is deployed on 97.5% of enterprise-managed mobile devices across both iOS and Android.

ChatGPT is installed on 91% of enterprise-managed iOS systems.

Gemini is installed on 61% of enterprise-managed Android systems.

More than 50% of Windows and Android devices in regulated industries such as healthcare and pharma are five major OS updates behind.

74% of organizations say AI agents often receive more access than necessary.

79% of organizations believe AI agents create new access pathways that are difficult to monitor.

52% of organizations say AI agents inherit access originally intended for humans or other systems at least sometimes.

Responsibility for AI agent identity and access is fragmented: 28% of organizations assign primary ownership to security leads, 21% to development/engineering, 19% to IT, and 9% to IAM teams.

20% of digital trust professionals say they do not know how humans oversee AI decision-making at their organization.

33% of organizations do not know how often AI agent credentials are rotated.

22% of organizations report that access frameworks are applied very consistently to AI agents.

The majority of the 50 most-targeted network infrastructure vulnerabilities (66%) affect device-specific firmware.

32% of organizations are uncertain how much time is required to implement and maintain authentication or credential handling for a typical AI agent.

Across all industries, 25% of connected devices are unaccounted for.

Critical OS patching across PCs running Windows 10 and 11 is behind an average of 127 days, up from 56 days in 2025.

SSH is the second most common protocol observed, with rising usage in nearly every sector except retail.

39% of digital trust professionals are completely or fairly confident in their organization’s data governance around AI.

IoT attacks climbed 11% to 610 million hits.

56% of digital trust professionals indicate they do not know how quickly they could halt an AI system due to a security incident if needed.

7% of digital trust professionals say it would take them more than 60 minutes to halt an AI system after a security incident.