33% of respondents at middle market organisations indicated they have five or fewer data security and privacy employees.

60% of the top 10 vulnerabilities had been actively exploited or had a publicly available exploit from less than two weeks after disclosure to a zero day.

The number of infostealers delivered via phishing emails per week increased by 84% year-over-year.

The global average cost of a data breach hit a record $4.88 million in 2024.

The top initial access vector observed in 2024 was a tie between exploitation of public facing applications and use of valid account credentials, both representing 30% of X-Force incidence response engagements.

Manufacturing is the #1-targeted industry by attacks for the fourth year in a row.

Of all the malware cases, 28% involved ransomware, followed by backdoors and webshells, at 20% and 13% respectively.

12% of respondents from smaller middle market firms (with revenue between $10 million to less than $50 million) reported a breach.

A smaller share of Canadian middle market firms indicate they don't have AI governance in place compared to U.S. respondents (5% versus 20%).

Ransomware made up 28% of malware cases in 2024.

15% of smaller middle market organisations reported at least one ransomware attack or request.

Manufacturing organisations experienced 29% of attacks involving extortion.

Positive responses regarding familiarity with cyber insurance policy coverages among smaller middle market firms decreased to 51% from 66% last year.

Analysis of dark web data reveals a 25% increase in ransomware activity year-over-year.

In 2024, the top impact experienced by victim organisations was credential harvesting, occurring in 28% of incidents.

24% of respondents in larger middle market organisations (with revenue between $50 million to $1 billion) reported a breach.

Manufacturing had the highest number of ransomware cases in 2024.

On average, Canadian respondents at middle market organisations have larger cybersecurity teams, with 39% saying they have 16 or more employees, compared to 11% in the U.S..

Identity-based attacks made up 30% of total intrusions for the second year in a row.

18% of middle market organisations experienced a data breach in the last year.