33.3% of IT and security professionals identify identity and access management (IAM) systems as a top security concern.

55.2% of IT and security professionals who experienced a security incident or breach in the past 12 months state they were told to keep it confidential despite believing it should have been reported.

The 55.2% of IT and security professionals told to keep breaches confidential is slightly down from 57.6% in 2025 and substantially higher than 42% in 2023.

68.6% of IT and security professionals in the U.S. who experienced a breach report being told to keep it confidential, the highest regional rate.

57.2% of IT and security professionals in both Germany and the U.K. who experienced a breach report being told to keep it confidential.

56.8% of IT and security managers and 53.5% of practitioners who experienced a breach report pressure to stay silent.

41.8% of IT and security professionals report experiencing a cloud infrastructure or application breach in the past 12 months.

35.9% of IT and security professionals report experiencing business email compromise (BEC) resulting in financial or data loss in the past 12 months.

25.6% of IT and security professionals report experiencing ransomware in the past 12 months.

54.7% of IT and security professionals in the U.S. report experiencing BEC incidents, nearly 19 percentage points above the overall average.

59.2% of IT and security professionals confirm experiencing AI-driven social engineering attacks in the past 12 months.

The top barriers to reducing the attack surface reported by IT and security professionals are high overhead in maintaining hardening rules and exceptions (38%), fear of operational disruption (35.4%), and resource constraints (34.6%).

Difficulty securing legacy systems is reported by 34.5% of IT and security professionals and visibility gaps are reported by 33.8%.

87% of IT and security professionals in the U.S., 85% in the U.K., and 77% in Germany say they would likely switch cybersecurity vendors due to data sovereignty concerns.

IT and security professionals rate attackers using AI to generate self-mutating malware as a high or extreme risk at 55.9%, employees leaking sensitive data into public LLMs at 53.5%, AI-driven evasion techniques at 52.5%, and deepfakes or voice cloning used in fraud or BEC at 51.9%.

0.5% of IT and security managers report zero visibility into AI tool usage versus 4.5% of practitioners.

20.4% of IT and security professionals rate employees leaking sensitive data into public LLMs as a low or extremely low risk.

58% of U.S. organizations report a fully established CTEM program.

52% of North American organizations report having a fully consolidated view of cyber risk exposure.

51% of North American organizations use threat intelligence within a continuous, automated validation process.