94% say a proactive cybersecurity posture in 2026 will depend on integrating threat intelligence with exposure management.

48% of surveyed organisations in the UK deploy autonomous AI agents capable of taking actions on their own

16.4% of Australian SME owner or managers said being a victim created additional business expenses

323 UK organisations reported a ransomware attack between April 2025 and March 2026.

Only 7.8% of vulnerability alerts warrant Critical or High attention after exploitability validation, so more than 90% do not require immediate remediation focus.

Phishing websites account for 10.5% of critical exposures, up sharply from 1.0% the year before.

76% of all critical exposures come from just two categories: vulnerabilities and internal information disclosure.

Vulnerabilities account for 78.2% of critical exposures in Utilities.

Vulnerabilities account for 56.4% of critical exposures in Government.

Internal information disclosure accounts for 63.6% of critical exposures in Healthcare.

Internal information disclosure accounts for 42.7% of critical exposures in Financial Services.

Healthcare records the slowest median remediation time at 158.8 hours.

97.4% of institutions have at least one Microsoft product.

28% of the top 100 vendors most commonly used by universities have experienced a data breach since 2024.

11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.

95% of universities have at least one vendor with embedded AI exposure.

Around 50% of universities have detectable third-party AI embedded in their services.

80% of higher education institutions share the same 11 vendors.

57.7% of teams use AI for simple functions and 57.7% use AI for code review.

80.5% of organizations have reworked development and release processes for AI-generated code.