Banks remediate exposures in 11 days on average.

The insurance sector requires nearly 50 days to remediate exposures.

64 distinct CWEs mapped in Q4 2025, down from 82 in Q3 2025

Over 100 advertised leaks and ransomware breaches targeted the automotive supply chain on the dark web in Q4 2025

UK SI 2025/1110 mandates UN R155 and R156 for type-approval effective 13 November 2025

EU Delegated Regulation 2025/1455 extends UN R155 to L-category vehicles: new types compliant by 11 December 2027, existing types by 11 June 2029

Financial service organizations outside of banking require 24 days to remediate exposures.

ControlLoc adversarial attack on AV object trackers achieved up to 98.5% success digitally and over 79% in physical tests against the Baidu Apollo stack

US Tier-1 automotive supplier had approximately 1.9 TB of internal files publicly posted on an extortion site at the end of October 2025

Japanese vehicle manufacturer's customer management environment breach exfiltrated roughly 900 GB in December 2025

Japanese vehicle manufacturer third-party cloud compromise exposed around 21,000 customer records in December 2025

German aftermarket parts and distribution business had 1.4 TB of internal data advertised on underground forums in December 2025

Automotive and pharmaceutical sectors average 43 days to remediate exposures.

More than 50% of organizations check for unusual login attempts every three months or less.

Across multiple identity-related breach categories, 90% of organizations report a successful identity-related breach in the last 12 months, with 83% seeing it happen at least twice, and 76% experiencing it three or more times.

56% of security leaders now experience cybersecurity-related downtime caused by SaaS and other third-party application issues often or very often, nearly triple the rate in 2024.

66% of ITOps and engineering leaders are prioritizing investments in automation to mitigate the risks of human error.

85% of technology leaders prioritize AI-driven security automation.

More than 48,000 CVEs were published in 2025, an 18% increase year-over-year.

Financial services applications faced a 91% attack rate in 2026, the highest recorded for any vertical.