Thirty-four active malware families targeted 1,243 financial apps across 90 countries.

The United States had the highest concentration of targeted apps globally, with 162 banking applications under active targeting, up from 109 in 2023.

Over 80% of SaaS access is managed through static profiles.

One in four users (25%) rely on broad, difficult-to-audit static profile bundles for SaaS access.

52% of U.S.-based cybersecurity leaders say training for human-AI collaboration is limited or insufficient.

The average disclosure window worsened from 76 days in 2024 to 117 days in 2025.

A bot attack flooded one auto-lending partner with more than 10,000 fraudulent applications per day.

Nearly 87% of financial institutions use TPRM software.

The median security team spends 20 minutes dismissing a single junk alert.

Around 70% of midmarket security leaders say headcount has kept pace with their digital estate.

ChatGPT-User was the second most impersonated agent in early 2026.

The average number of weekly cyber attacks per organization reached 2,086, representing a 9.6% increase year over year.

Clop accounted for 13% of published attacks in February.

Organizations face an average annual recovery cost and downtime of $2.2 million from cyber incidents.

39% of organizations experience phishing attacks.

31% of users have the power to modify or delete sensitive data.

91% of people support national laws regulating personal data use.

73% of organizations report internal conflict over ownership of AI security controls.

81% of incidents carried out by Iran-affiliated groups target organizations in the U.S. and Israel.

57% of organizations report success using AI for alert triage and risk scoring, while 26% report success automating incident response.