16% of breaches studied involved attackers using AI tools.

A third (33%) of UK business leaders believe that a ban would decrease the prevalence of ransomware attacks by reducing the incentive for attackers.

LLMs failed to secure code against cross-site scripting (CWE-80) in 86% of cases.

Java was found to be the riskiest language for AI code generation, with a security failure rate over 70%. Other major languages, such as Python, C#, and JavaScript, presented significant risk, with failure rates between 38 percent and 45 percent.

Less than 3 in 10 organisations allocate more than 20% of their cybersecurity budget to identity security.

85% of organisations are "extremely" or "very" confident in their ability to detect breaches within 24 hours.

The top consequences of breaches reported were operational downtime (71%), reputational damage (45%), and financial loss (41%)

32% of Canadians say they are more likely to open a financial account digitally than they were a year ago.

Only 37% of organisations have policies to manage AI or detect shadow AI.

The average cost of an extortion or ransomware incident remains high, particularly when disclosed by an attacker ($5.08 million).

Nearly all organisations studied suffered operational disruption following a data breach.

Of organisations that experienced attacks, 38% of breaches stemmed from compromised employee credentials.

51% of organizations have adopted AI for mission-critical operations.

2% of organizations have no plans to address quantum risks at all.

Social engineering attacks accounted for 39% of initial access incidents observed during the first half of 2025.

For the third year running, cyber is identified as the leading cause of downtime and data loss in the UK.

Organizations experience an average of six mission-critical workflow disruptions or failures in the past year.

49% of Canadians reported experiencing more frequent identity verification checks during online purchases.

34% of organisations have failed a compliance audit due to identity-related issues.

In real-world situations within the private sector, if a ransom payment ban were to take hold, only 10% of UK business leaders said they would comply if they were attacked.