BlackByte, a ransomware strain, had a prevention effectiveness rate of just 26%.

BabLock, another ransomware strain, had a prevention effectiveness rate of 34%.

High false positive rates triple the chance of missing genuine incidents for MSPs.

20% of MSPs who consolidate security tools report better outcomes across all metrics.

Broken Access Control accounted for 32% of high-severity findings across 4,200+ pen tests, making it the most prevalent and critical vulnerability.

Approximately 40% of financial firms have increased their penetration testing frequency to quarterly or continuous testing.

Cloud misconfigurations and excessive permissions vulnerabilities were found in 42% of cloud environments that were pen tested.

Discovery techniques like System Network Configuration Discovery and Process Discovery scored below 12% in prevention effectiveness.

Overall prevention effectiveness declined from 69% in 2024 to 62% in 2025.

Only 14% of attacks generated alerts.

In 46% of tested environments, at least one password hash was successfully cracked. This is an increase from 25% in 2024.

Nearly 7 in 10 retail & consumer goods organizations had APIs with misconfigured authorizations or data exposure issues. These retail & consumer goods APIs averaged 15 vulnerabilities per API.

Outdated or unpatched software leaves critical healthcare devices vulnerable to exploitation.

In Sweden, 74,000+ internet-connected healthcare devices and systems are exposed, endangering patient data.

In South Africa, 172,000+ internet-connected healthcare devices and systems are exposed, endangering patient data.

In the United States, 174,000+ internet-connected healthcare devices and systems are exposed, endangering patient data.

Many healthcare systems lack even basic authentication, and some use factory-default or weak passwords like, "admin" or "123456."

In France, 75,000+ internet-connected healthcare devices and systems are exposed, endangering patient data.

In Japan, 48,000+ internet-connected healthcare devices and systems are exposed, endangering patient data.

In Ireland, 81,000+ internet-connected healthcare devices and systems are exposed, endangering patient data.