78% of organizations lack formal AI governance policies.

58% of organizations utilize pentesting-as-a-service (PTaaS) for continuous testing.

88% of organizations plan to increase offensive security spending over the next 12 months, with 65% planning moderate increases and 23% planning significant increases.

More than 30% of US organizations report experiencing a major AI-related security incident in the past 12 months.

Nearly 70% of US CISOs and senior security leaders say they are actively following AI-related regulations or standards.

85% of IT professionals report having AI policies or oversight mechanisms in place.

56% of organizations now deploy AI broadly across multiple IT workflows or at business‑critical scale.

2% of organizations report no AI use at all.

Nearly 72% of IT organizations have created dedicated AI roles or teams, and another 13% plan to do so.

45% of IT professionals plan to use AI to automate patch deployment within the next 24 months.

42% of IT professionals say accountability for AI decisions is clear.

24% of IT professionals say AI policies are followed very consistently in day‑to‑day work.

68% of IT professionals have personally seen AI generate hallucinations with potential operational impact.

Nearly a quarter of IT professionals cite data challenges as the biggest barrier to AI deployment.

29% of leaders find it materially harder to secure budget for AI projects due to market hype.

Nearly a third of the most mature IT organizations are still operating without fully embedded governance.

Direct ransomware attacks on financial institutions spiked 76% year-over-year in Q1 2026.

Across all financial services vendors, 50.2% carry high-severity CVEs.

The number of distinct threat groups targeting finance increased from 37 in 2023 to 45 in 2024 and to 48 in 2025.

Over 48,000 CVEs were published globally in 2025, an 18% year-on-year increase.