38% of security and IT leaders report attacker activity mirrors legitimate, authorized workflows and processes, delaying critical alerts.

Security teams require mid-to-high levels of manual intervention for detection, at 42%.

41% of security and IT leaders report attackers use encrypted channels to bypass detection, delaying critical alerts.

14% of organizations were unaware of an attack until they receive a ransom demand, compared to 6% the previous year.

49% of organizations did not detect the threat until after data is stolen, up from 31% the previous year.

Adversaries maintained access to enterprise networks for nearly 2.5 weeks on average before being detected in ransomware incidents.

27% of security and IT leaders report undetermined baseline behavior enables anomalous actions to go undetected, delaying critical alerts.

30% of security and IT leaders report alert fatigue causes initial detections to be deprioritized, delaying critical alerts.

14% of breached organizations cannot detect and stop their most significant identity attack before damage is done.

78% of senior cybersecurity decision makers indicate that potential visibility gaps or blind spots could slow detection or investigation of malicious activity.

Organizations first detected evidence of malicious activity internally 52% of the time in 2025, up from 43% in 2024.

One-third of organizations operate five or more insider risk tools, yet 66% still struggle with detection accuracy and 58% cite tool and data fragmentation as a primary challenge.

Nearly 48% of teams struggle to detect identity misuse in real time

65% of CISOs agreed that their organization prioritizes Cyber Resilience over traditional prevention, detection, and response.

More than a third of financial services firms said it would take a week or longer to detect and contain a breach.

6% of financial services firms admitted it could stretch into a month or longer to detect and contain a breach.

81% of Pacesetters (most AI-ready group) report full capability to detect and prevent unauthorized tampering, compared to 29% of all companies.

Only 31% of security leaders use AI-powered SOC tools across core detection and response workflows.

64% of security leaders still rely heavily on manual detection, triage, and investigation processes.

In 2025, healthcare breaches took an average of 224 days to detect and another 84 days to contain—making it over 10 months total.