51% of organizations say AI is effective in reducing the time to detect anomalies or emerging threats.

70% of enterprises have confirmed or suspected vulnerabilities introduced by AI-generated code in their production systems.

68% of organizations cannot clearly distinguish between human and AI agent activity.

Globally-distributed PCs are vulnerable to AI-driven attacks and cyber incidents up to 76 days per year.

10% of PCs run Windows 10, which Microsoft ended support for in October 2025.

Endpoint security tools fail 20% of the time.

Telnet exposure in healthcare is 8%, up from 6%.

11 device types appear on the riskiest devices list for the first time: Serial-to-IP Converters and Workstations (IT) Printers, Time Clocks, and RFID Readers (IoT) Power Distribution Units (PDUs), I/O Modules, and BACnet Routers (OT) Medication Dispensing Systems, Medical Image Printers, and DICOM Gateways (IoMT)

36% of digital trust professionals say humans approve most AI-generated actions before execution.

26% of digital trust professionals report that humans review selected AI decisions or patterns after execution.

10% of organizations are unsure of their actual unstructured data protection coverage.

43% of digital trust professionals are completely or fairly confident in their organization’s ability to investigate and explain to leadership or regulators if a serious AI system incident occurred.

18% of digital trust professionals indicate that disclosure is required and enforced when AI has been used to create or substantially assist with work products.

20% of digital trust professionals say disclosure of AI use is required but not consistently enforced.

Organizations first detected evidence of malicious activity internally 52% of the time in 2025, up from 43% in 2024.

Median time between initial access and hand-off to a secondary threat group was 22 seconds in 2025, down from more than 8 hours in 2022.

Email phishing accounted for 6% of intrusions in 2025.

Mean time to exploit vulnerabilities was -7 days, indicating exploitation routinely occurs before patches are released.

BRICKSTORM achieved dwell times of nearly 400 days.

Median dwell time for cyber espionage incidents and North Korean IT worker incidents was 122 days.