The human attack rate saw only a marginal (1%) increase in 2024.

88% of executives had interior photos or floor plans available

49% of CISOs say that buyers now factor application security (AppSec) into purchasing decisions.

57% of senior network decision-makers in manufacturing and automotive industries do not believe that AI has been overhyped and state that they are already seeing real benefits across their businesses.

One in nine (11%) password reset attempts in 2024 was a fraud attack. This rate rose to over one in four (27%) reset attempts initiated on a desktop computer.

24% of respondents indicated that application security is “always” a factor in purchasing decisions.

Small and mid-sized businesses (SMBs) in the $4M-$8M range were the most frequently targeted.

Ransomware was responsible for 67% of known third-party breaches.

In Europe, 58% of respondents report that security is “always” a factor in purchasing decisions.

56% of organisations say that most of their development teams are fully integrated with AppSec programmes.

62% of CISOs report AppSec metrics to their board.

In organisations developing software-based products, responsibility is split: 50% of organisations assign security responsibility to CISOs, while 43% move security oversight to development teams.

Account takeover (ATO) fraud represents a further 27% of global reported fraud. This is down by ~2% year on year.

There has been a 123% increase in ransomware attacks over two years.

75% of organizations require employees to complete security awareness training at least quarterly.

The number of publicly disclosed victims saw a 25% increase from the previous year (between April 2024 and March 2025)2. This follows an 81% surge in the period before that.

98% of company executives had property addresses publicly linked to their name.

A significant minority (37%) of manufacturing and automotive decision-makers foresee AI causing network costs to rise.

Traffic to threat sites that include the word "travel" spikes between May and June each year.

On May 8, 2024, traffic to threat sites that include the word "travel" peaked, marking 256% over the average between 2023 to April 2025.