27% of UK IT leaders in the public sector say they've adopted email security training.

41% of respondents use personal email accounts lacking MFA to log in to banking services.

Approximately one-third of serious issues are never resolved by the organizations in the financial services industry, contributing to backlog and systemic risk.

60% of organizations have experienced data breaches or theft in software development, AI, and analytics environments, an 11% increase from the previous year.

In North America and Europe, over 60% of websites lack any bot protection.

In the UK, concern about AI compromising security increased from 61% in 2024 to 81% in 2025 (a 20 percentage point increase).

84% of organizations surveyed are still allowing data compliance exceptions in non-production.

63% of UK IT leaders in the tech sector say they've adopted email filtering.

In 2025, 5% of AI bot traffic reached checkout flows.

Due to the concerns and confusion around safety, 86% of organizations are planning to invest in AI data privacy solutions over the next 1–2 years.

Business logic flaws: 2.9% in the financial services industry (versus 2.3% average in other industries).

Only 48% of respondents said their company uses Multi-Factor Authentication (MFA) across all apps and services.

Usernames and passwords are used by 60% of respondents as an authentication method for personal accounts.

41% of UK IT leaders cited multi-factor authentication (MFA) as the most common defence against email-related incidents.

Server-side injection (Web/API): 4.2% in the financial services industry (versus 5.3% average in other industries).

In Asia Pacific, just 1.6% are fully protected against bots.

Industries like hospitality resolve serious findings significantly faster than the financial services industry (61 days vs 20 days).

70% of respondents believe phishing attempts have become more successful due to the use of AI.

78% of respondents believe phishing attempts have become more sophisticated due to the use of AI.

47% of UK IT leaders cited employee security awareness training as the most common defence against email-related incidents.