Only 45% of the full respondent pool say they remediate critical software vulnerabilities within a day.

80% of SMBs with a formal incident response plan in place were able to avoid major damage during an attack.

SMS toll fraud now comprises 78% of all attacks on the gig economy, up from 48% a year prior.

In Q3 2025, SMS toll fraud malicious traffic surged by 67% over Q2 2025, making it the fastest-growing attack type of the quarter.

65% of organizations do not have a formal CEO security program, indicating a view of executive protection as discretionary rather than fundamental.

U.S. IT leaders manage an average of over nine different tools.

Nearly 40% of schools feel underprepared for ransomware in 2025

High confidence in cybersecurity among school IT leaders dropped from 30% in 2024 to 18% in 2025

AI-generated pull requests contain approximately 1.7 times more issues on average than human-written pull requests based on an analysis of 470 open-source GitHub pull requests.

28% of organizations reported unrestricted network access between cloud workloads as a growing threat.

Potentially Unwanted Programs (PUP) detections increased by nearly 75% in the June to November 2025 period compared to the December to May period.

59% of respondents that prioritize SBOM validation typically respond to critical software vulnerabilities within one day.

95% of surveyed organizations reported using AI tools in software development.

54% of organizations using at least four compliance controls remediate critical vulnerabilities within a day.

31% of SMB owners don't know exactly how much they spend on cybersecurity.

99% of organizations experienced at least one attack on their AI systems in the past year.

42% of leaders at U.S. organizations are making identity and access management a top budget priority over the next two to three years.

Only 34% of SMB owners have a formal incident response or continuity plan developed with a cybersecurity professional.

In Q3 2025, the gig economy experienced 51% fewer attacks but 49% more malicious traffic, resulting in a 300% increase in average attack size.

Organizations classified as 'Exceptional' in AppSec maturity are 1.9 times less likely to experience a data breach than Emerging programs.