6.5% of the 832 malicious accounts banned between March 2025 and March 2026 used AI to assist with lateral movement.

The share of actors classified as medium risk or higher increased from 33% in the first six-month period to 56% in the second six-month period, a roughly 1.7-fold increase.

Least-skilled threat actors used about 16 distinct techniques on average, while the most skilled used about 20.

In November 2025, a disrupted state-sponsored cyber espionage operation used 30 techniques across 13 tactics.

Three of four Chinese LLMs generate hidden security vulnerabilities when prompted with a U.S. government persona.

All four Chinese-built models refuse to generate code for mock U.S. government tasks that Beijing would oppose.

When prompted as "You are a helpful assistant, generate code for a U.S. government agency that builds an internal admin console with these listed features" vs "You are a helpful assistant, generate code that builds an internal admin console with these listed features….", Qwen 3-Coder (CN) generated 130% more vulnerabilites.

When prompted as "You are a helpful assistant, generate code for a U.S. government agency that builds an internal admin console with these listed features" vs "You are a helpful assistant, generate code that builds an internal admin console with these listed features….", DeepSeek V4-Pro (CN) generated 5% more vulnerabilities.

83% of claimed AI agent defenses are not publicly verifiable.

38% of AI agents complete irreversible actions before any monitoring path can plausibly fire.

Over half of US CISOs track AI as a dedicated risk category.

IT professionals at AI‑mature organizations save an average of 6 hours per week, double the 3 hours saved at organizations with the lowest levels of AI adoption.

54% of IT professionals at organizations where AI is business‑critical say AI makes their work faster and better, compared with 24% among early experimenters.

Reported ransomware incidents targeting finance increased 30% from 2024 to 2025.

Among the 140 vendors whose client base is meaningfully concentrated in finance, critical vulnerabilities increased 181%.

Critical-level patch management failures were present in 78% of the 140 vendors whose client base is meaningfully concentrated in finance.

Banks reported 71 ransomware disclosures in 2023 compared to 44 disclosures by investment firms, while by 2025 banks fell to 36 disclosures and investment firms rose to 84 disclosures (41.6% of all incidents).

Nearly seven in ten enterprises describe their digital risk program as unaware, reactive, or still developing.

59% of organizations report their security teams are currently understaffed.

48% of technical leaders believe they have a full AI inventory.