Q1 2026 automotive vulnerabilities map to 25 distinct TTPs in the Auto-ISAC Automotive Threat Matrix

77 distinct CWEs mapped in Q1 2026, up from 64 in Q4 2025

58% of decision makers said that improving the overall security posture related to internal threats was a security priority over the next 12 months.

34% of decision-makers said genAI capabilities are paramount to data security today. This figure balloons to 64% as they look two years ahead.

65% of organizations globally say AI identities are fully registered, authenticated and authorized in a formal system.

56% of consumers encounter scam attempts at least monthly.

55% of Americans aged 25 to 34 are concerned about deepfake scams.

Roughly 1 in 3 older Americans may not recognize impersonation scams when they encounter them.

5% of organizations reported six or more identity-related breaches.

Across multiple identity-related breach categories, 90% of organizations report a successful identity-related breach in the last 12 months, with 83% seeing it happen at least twice, and 76% experiencing it three or more times.

81% of technology leaders cite customer loss as a consequence of downtime.

68% of technology leaders express concern that their AI agents will behave unpredictably.

About three-fourths of ITOps and engineering leaders identify end-to-end observability as their top investment priority to improve infrastructure resilience.

2,130 AI-related vulnerabilities were reported in 2025, a more than 200% increase since 2023.

More than 48,000 CVEs were published in 2025, an 18% increase year-over-year.

89% of employees say they feel safe reporting mistakes in organizations that prioritize cybersecurity as a culture.

74.6% of all AI use at work has a clear business purpose.

Malicious npm packages surged 451% year-over-year.

102% year-on-year increase in automotive vulnerabilities (Q1 2026 vs Q1 2025)

Q1 2026 automotive vulnerabilities span 77 unique CWEs