Individual TPRM professionals are responsible for 100 or more vendor relationships.

13% of the most mature TPRM programs view TPRM as little more than a compliance formality.

Android malware-driven financial transactions increase 67% year-over-year.

Financial institutions using manual TPRM processes report 50% lower satisfaction with their tools.

Thirty-four active malware families targeted 1,243 financial apps across 90 countries.

The United States had the highest concentration of targeted apps globally, with 162 banking applications under active targeting, up from 109 in 2023.

Nearly 87% of financial institutions use TPRM software.

TsarBot, CopyBara, and Hook collectively targeted more than 60% of global banking and fintech apps.

63% of TPRM programs operate with just one or two dedicated full-time employees.

13% of TPRM programs have no dedicated staff.

26% of the most mature TPRM programs report TPRM delivering high value across the organization.

67% of organizations with no TPRM processes view TPRM as little more than a compliance formality.

53% of TPRM programs manage 300 or more vendors.

10% of financial institutions still rely on spreadsheets, down from 13% in 2025.

Across the META region, Internet and Financial services accounted for over 80% of phishing activity.

In 2025, phishing activity in the META region targeted internet services (52.49%), financial institutions (28.50%), and the logistics sector (11.20%).

Financial services (68.45%) was the top industry targeted by phishing attacks globally in 2025.

Financial services (82.74%) was the top industry targeted by phishing attacks in Europe in 2025.

Financial services (94.24%) was the top industry targeted by phishing attacks in Central Asia in 2025.

IT (38.24%) was the top industry targeted by phishing attacks in North America in 2025, followed by Financial Services (29.66%) and Internet Services (22.5%).