HR/Payroll

31% of federal cyber and IT leaders are fully or substantially prepared to employ AI-powered cyber defenses that integrate with existing security infrastructure

31% say autonomous action is more acceptable with rollback options.

33.8% of surveyed OT and ICS cybersecurity professionals report using AI for threat detection and alerting.

33% say autonomous action is more acceptable with visible activity logs.

34 of 104 attacks (33%) in H1 2026 targeted educational institutions in the US, a 44% decline from 61 attacks in H2 2025.

34% of ransomware incidents begin with phishing emails or other email-based social engineering.

35% of enterprise environments contain more AI agents than devices.

35% of survey participants are ready to allow AI to act more autonomously on their behalf.

36% of federal cyber and IT leaders are confident that cyber defenses can keep pace with AI-enabled attackers

36% say autonomous action is more acceptable with limits on what AI can access.

36% say autonomous action is more acceptable with notifications before major changes.

37% of federal IT and cybersecurity decision makers list resilience against adversarial manipulation and prompt injection attacks as a top concern for agentic AI deployments

37% of global organizations that experienced a ransomware attack report that AI somewhat increases the attack's effectiveness.

37% of organizations that experienced a ransomware attack say AI somewhat increased the attack’s effectiveness.

37% of organizations that paid a ransom face a second extortion demand.

37% of organizations that pay a ransom face a second extortion demand.

38% of enterprise security leaders report that at least one-quarter of their critical attack surface had not been independently tested or validated in the previous 90 days.

38% of organizations attribute ransomware incidents to users interacting with malicious content.

38% of organizations report that employees interact with malicious content.

39% say autonomous action is more acceptable with strong security and privacy protections.