31% of healthcare practices are still running on legacy systems that cannot contain a breach quickly once it starts.

There has been an increase in businesses reporting that the breach or attack led to loss of revenue or share value (2% in 2024/2025 to 5% in 2025/2026) and an increase in those reporting it resulted in reputational damage (1% in 2024/2025 to 3% in 2025/2026).

Medium (65%) and large (69%) businesses were more likely to have experienced a cyber breach or attack in the last 12 months compared to micro (42%) and small (46%) businesses.

The median perceived cost of the most disruptive breach or attack was £0 for businesses and £0 for charities, increasing to £30 for medium and large businesses.

Just over four in ten businesses (43%) and around three in ten charities (28%) reported having experienced any kind of cyber security breach or attack in the last 12 months.

The proportion of businesses and charities experiencing any negative outcome following a breach or attack has remained consistent with 2024/2025 (19% for business and 11% for charities in 2025 compared to 16% for both businesses and charities in 2024/2025).

The fastest ransomware case observed, involving Akira ransomware, takes just three hours from breach to encryption.

In 2025, 61% of CISOs indicated that their organization’s board and C-suite expect the cybersecurity group to guarantee zero breaches and ransomware incidents.

Just 16% of MSSP-supported financial services firms require two to four weeks to contain a breach.

25% of internal shared-resource financial services firms require two to four weeks to contain a breach.

The C-Suite ranks cyber attack or breach as the #1 current risk for global organizations.

Finance ranks cyber attack or breach as the #2 current risk (after economic slowdown or slow recovery) for global organizations.

How cyber attack or breach ranked as current risk over the recent years: 2025 - #1, 2023 - #1, 2021 - #1, 2019 - #6, 2017 - #5, 2015 - #9.

Cyber attack or breach remains the top concern globally across current and future risks (no change from 2023) for global organizations.

Risk management ranks cyber attack or breach as the #1 current risk for global organizations.

HR ranks cyber attack or breach as the #3 current risk (after increasing competition and economic slowdown or slow recovery) for global organizations.

The 2025 breach at DaVita compromised over 900,000 patients' personal and clinical data.

98% of organisations experienced a breach stemming from vulnerable code in the past year.

Within the next 12 to 18 months, nearly a third (32%) of CISOs, AppSec managers and developers expect Application Programming Interface (API) breaches via shadow APIs or business logic attacks.

62% of breaches in H1 2025 involved data stored on network servers.