27% of security and IT leaders report undetermined baseline behavior enables anomalous actions to go undetected, delaying critical alerts.

Average ransom payment dropped to $2.8 million, down from $3.6 million in 2025.

83% of ransomware victims paid a ransom, up from 70% previously.

Downtime per incident averaged almost 30 hours.

85% of security and IT leaders identify security incidents, data exposures, or near misses where the root cause is an AI system.

35% of security and IT leaders identify shadow AI exposure as security incidents tied to AI systems.

31% of security and IT leaders identify agentic/API logic failures as security incidents tied to AI systems.

38% of security and IT leaders report attacker activity mirrors legitimate, authorized workflows and processes, delaying critical alerts.

The end-to-end window from private disclosure to enterprise patch-in-production can stretch 90 to 150 days.

A single ImageMagick CVE can propagate to 18+ NuGet variants via Magick.NET.

85% of developers and technology buyers agree the next phase of AI in software will focus less on generating code and more on governing it.

60% of organizations say AI coding ROI has exceeded expectations.

73% of developers and technology buyers are concerned about the maintainability of AI-generated code in their organization's codebase.

40% of IT decision-makers report security vulnerabilities appearing faster, 40% report governance getting harder, 37% report higher change volume, 35% report increased pipeline strain, and 35% report growing infrastructure drift.

Only 3% of identified servers running Dropbear – common in embedded devices – support PQC

50% of IT devices in enterprise networks use OpenSSH versions that support PQC

In enterprise networks, IT devices most commonly support PQC on TLS (8%), while specialized devices are again left behind (5.6% for IoT and IoMT, 0.8% for OT)

Ransomware attacks rose 55.1% year-over-year in the first four months of 2026 and reached an average of 171 incidents per month.

The Qilin ransomware group was linked to ransomware incidents in 26 of the 31 countries analysed.

More than half of SafePay's ransomware activity in Europe targeted German organisations.