More than 1 in 7 organizations expose API documentation to the internet.

48% of organizations report security concerns as the top barrier to AI adoption, up from 17% in 2024.

China hosted 42.3% of all tracked Cobalt Strike infrastructure, the US hosted 18.9%, and Hong Kong hosted 15.8%.

WhiteSnake Stealer was the most widely observed infostealer family, accounting for 31.6% of all tracked output, followed by RedLine at 23.9%, Rhadamanthys at 17.1%, and StealC at 6.9%.

Across 2025, 7,918 victim postings were observed on ransomware group data-leak sites (DLS) across 129 distinct threat actors sourced from ransomware.

31% of breaches now start with software vulnerabilities.

48% of all breaches now involve ransomware.

Only 23% of third-party organizations fully remediated missing or improperly secured multifactor authentication (MFA) on their cloud accounts, with 50% of all findings being resolved within a month.

Human element was present in 62% of breaches

67% percent of users are using non-corporate accounts on their corporate devices to access AI services

88% of Q1 2026 automotive vulnerabilities require Low Attack Complexity

Ethernet represented over 25% of all automotive attack vector entries in Q1 2026

BEAST threat actor leaked 700 GB of internal data from a large Chinese automotive group in late February 2026

2024 SafePay ransomware breach at a global BPO provider exposed nearly 17,000 employees and customers of a major commercial vehicle manufacturer, disclosed in January 2026 after a 14-month notification delay

Incransom ransomware group published a 200 GB leak from a Tier-1 electronics component supplier in January 2026

An automotive parts marketplace database with over 7.7 million records was exposed via a misconfigured Elasticsearch instance in January 2026

86% of organizations say vulnerability remediation is a critical part of their security strategy.

3.7 million of the 12.4 million records exposed in the ShinyHunters automotive marketplace breach were previously unseen in other breaches

206 unique automotive vulnerabilities identified in Q4 2025, a 19% increase over Q3 2025

Q4 2025 automotive vulnerabilities span 64 unique CWEs