In 2025, anti-fingerprinting bots were only blocked by ~7% of websites.

In 2025, fake Chrome and curl bots were detected just 21% of the time.

52% of all organisational communication in the UK flows through the inbox.

75% of UK IT leaders in the tech sector faced inbox breaches.

Latin America had the highest share of protected websites against bots.

In Latin America, only 3.5% of websites were fully protected against bots.

87% of UK IT leaders in the finance sector report exposure to email-related incidents.

85% of UK IT leaders in the legal sector report exposure to email-related incidents.

60% of organizations in the legal sector experienced email incidents, yet only 41% feel very confident in their compliance posture.

59% of organizations in the technology sector experienced email incidents, yet only 39% feel very confident in their compliance posture.

The financial services industry resolves about two-thirds (66.7%) of serious findings. This ranks the industry 10 out of the 13 industries Cobalt researched.

Financial services firms demonstrate strengths in avoiding common, code-level flaws due to mature security programs and automated scanning (SAST/DAST). However, they struggle with vulnerabilities that require human-led testing.

44% of all participants admitted to having interacted with a phishing message in the last year.

In the US, concern about AI compromising security increased from 61% in 2024 to 77% in 2025 (a 16-point increase).

47% of respondents use personal email accounts lacking MFA to log in to social media accounts.

92% of Government bodies in the UK reported an email-related breach.

In the UK, 37% of respondents believe hardware security keys and device-bound passkeys are the most secure authentication methods, up from 17% in 2024 (a 20-point increase).

78% of financial services firms report fixing critical vulnerabilities in business-critical assets within 14 days, indicating they narrowly meet strict internal SLA requirements.

70% of financial services firms report that delays in scheduling pentests sometimes impact compliance or business timelines.

Among enterprises with 10,001+ employees, just 2.2% had full protection against bots.