Insurance organizations have the highest proportion of critical findings at 1.76%.

Between January 1 and December 31, 2025, government organizations worldwide faced the highest number of threat campaigns, with 274 attacks targeting various federal, state, and municipal bodies.

Eight of the ten types of leaked secrets showing the sharpest increase year over year are tied to AI services.

75% of network-layer DDoS attacks last less than one minute.

Only 2% of network-layer DDoS attacks extend beyond ten minutes.

80% of consumers are worried about using AI tools.

33% of consumers say they would avoid using AI for security advice because they don't trust the answers to be accurate.

Only 41% of organizations have AI-specific data privacy policies in place.

58% of organizations say prompt or input risks (e.g., misleading, inaccurate, or harmful responses) are very or extremely difficult to minimize.

For network intrusions, unpatched vulnerabilities were the root cause 21% of the time.

Critical findings constitute 0.092% of raw findings, up from 0.035%.

The average number of daily API attacks rose 113% year over year.

53% of security, IT, and compliance professionals cite collecting evidence across multiple tools as the most common bottleneck in the audit process.

91% of security, IT, and compliance professionals must resubmit audit evidence at least sometimes due to miscommunication or shifting auditor expectations.

LLM infrastructure (orchestration, retrieval augmented generation (RAG), vector storage) is leaking 5x faster than core model providers.

Developers who rely on Claude Code to produce code and co‐author commits leak secrets at 2x the baseline rate.

MCP servers exposed 24,000+ secrets in their first full year of adoption.

28% of respondents from CNI organisations said trust in cybersecurity tools is the biggest security challenge in 2026.

27% of respondents from CNI organisations said complying with regulations is the biggest security challenge in 2026.

The median time from a vulnerability's publication to its inclusion in the CISA KEV catalog dropped from 8.5 days to 5.0 days.