MURKY PANDA's password-spraying campaign impacted more than 340 U.S.-based entities.

FAMOUS CHOLLIMA accounted for 47% of all state-sponsored interactive intrusions against the technology sector.

Financially motivated attacks accounted for 65% of all interactive operations against the technology sector.

Big game hunting adversaries named 572 technology entities on dedicated leak sites for extortion.

The Axios NPM package was downloaded 100 million times per week.

Malware operators compromised 350 GitHub repositories to inject malicious code into JavaScript and Python projects.

Initial access brokers advertised access to 277 technology organizations, a nearly 30% increase.

93% of security executives voice absolute confidence in their AI governance.

52% of all generative AI usage occurs on mobile endpoints.

Organizations allocate an average of 19% of their 2026 security budgets to AI compliance.

59% of mobile AI traffic is hidden from traditional network-discovery tools, routing directly between local apps and external clouds without ever crossing a corporate gateway.

72% of organizations are structurally incapable of auditing embedded AI Software Development Kits (SDKs) hidden inside everyday mobile applications.

78% of security leaders cannot generate the audit-ready evidence required by emerging frameworks like the EU AI Act.

84% of IT leaders actively stall business-led AI initiatives.

97% of leaders agree that AI governance is mission-critical.

63% of organizations have investigated severe data leaks within the past 12 months where generative AI tools were a definitive contributing factor.

Phishing activity declined by approximately 20% year-over-year in both 2024 and 2025.

Services industry phishing hits surged 65.5% year-over-year from 330.9 million to 547.7 million hits.

95.2% of phishing activity is delivered over encrypted channels.

60% of organizations report the CISO has ultimate responsibility for OT cybersecurity, down from 69% in 2025.