Attackers compromised service records of about six million Qantas customers.

Half of financial services firms plan to prioritize cloud adoption in 2026.

The median enterprise maps its controls to about seven frameworks.

The amount of data most organizations got back after paying a ransom was 51–75%.

25% of internal shared-resource financial services firms require two to four weeks to contain a breach.

The median enterprise maps its controls to about 2,700 requirements.

44% of organizations suffered from multiple, damaging attacks.

11% of leaders at financial services firms say they are unprepared to recover effectively from a Vendor or third-party breach.

More than half (57%) of financial services firms are not monitoring threats in real time.

30% of internal financial services firms say they skip vulnerability assessments.

37.86% of IT decision-makers at financial services firms reported that attack surface management / continuous monitoring is currently fully or partially managed by an MSP or MSSP.

There are an estimated 20,000 repositories in GitHub implementing open-source Model Context Protocol (MCP) servers.

42.72% of IT decision-makers at financial services firms reported that email security is currently fully or partially managed by an MSP or MSSP.

55% of organizations still do not have a good understanding of Cyber Resiliency.

78% recognize Cyber Resiliency is a business problem, not just an IT issue.

75% think Cyber Resiliency is the new disaster recovery.

54% of organizations attacked paid a ransom.

92% of organizations still lost data after paying a ransom.

8% of organizations got all their data back after paying a ransom.

7% of organizations recovered in a day or less after an attack.