Security teams require mid-to-high levels of manual intervention for investigation, at 49%.

SOC analysts spend just 44% of their time on proactive efforts like threat hunting and detection engineering.

30% of security and IT leaders report AI-generated alerts produce false positives that negatively impact investigation timelines.

40% of security and IT leaders identify AI-enhanced external attacks as security incidents tied to AI systems.

38% of security and IT leaders identify compromised AI identity and session theft as security incidents tied to AI systems.

36% of security and IT leaders identify third-party vendor or supply chain breaches involving integrated AI or agents as security incidents tied to AI systems.

Adversaries maintained access to enterprise networks for nearly 2.5 weeks on average before being detected in ransomware incidents.

49% of organizations did not detect the threat until after data is stolen, up from 31% the previous year.

14% of organizations were unaware of an attack until they receive a ransom demand, compared to 6% the previous year.

34% of security and IT leaders report adversaries use valid, high-privilege account permissions, delaying critical alerts.

55% of security and IT leaders cite AI agents, agentic infrastructure, and Gen AI applications as the biggest cybersecurity risk to their organization.

In the first 63 days of the Anthropic Claude Mythos Preview, Mythos disclosed 1,596 verified vulnerabilities across 281 open-source projects.

95% of Anthropic Mythos disclosures have no public advisory and are not visible through CVE, NVD, GitHub advisory, or scanner-driven workflows.

AI-driven discovery outpaces visible Mythos-attributed remediation by roughly 16.5x, with about 25.3 disclosures per day versus about 1.5 patches per day.

Only 6.1% of Mythos disclosures are marked as patched, despite 90.9% maintainer acknowledgment.

73% of organizations say overall code quality has improved with AI coding tools.

85% of developers and technology buyers agree AI has shifted the bottleneck from writing code to reviewing and validating it.

84% of developers and technology buyers agree the biggest challenge with AI-generated code is governing what happens to it after it's created.

87% of developers and technology buyers are confident their team could determine within 24 hours whether AI-generated code contributed to a production incident.

34% of organizations that experienced a production incident in the past year cannot determine whether AI-generated code contributed to it.