38% of organizations that experienced a cyber incident report extended downtime of critical systems.

Full data recovery is 40% among organizations reporting increased cybersecurity budgets versus 16% among organizations without increased budgets.

Among organizations hit by ransomware where operations or data were affected, 44% recovered less than 75% of affected data.

75% of senior cybersecurity decision makers report legal and communications issues slow down decision making during incident response.

28% of CIOs identify AI itself as a threat.

62% are not strongly confident that AI investments have delivered measurable business value so far.

86% of IT and security leaders expect AI agents to outpace their organization’s security guardrails within the next year.

Almost one-third of organizations report extensive AI use across most or all threat detection and incident response activities, up from 25% last year.

Among identity crime victims who receive support from the ITRC, 14% have seriously considered self-harm.

6% of campus IT teams describe themselves as adequately staffed to work proactively.

11% of higher education institutions that experience disruptions report outages occurring weekly or daily.

79% of General Counsels lack confidence that current board reporting strikes the right balance between clarity and overload.

Only 19% say their organization’s GRC systems are fully integrated, 65% say they are somewhat integrated, and 16% report no integration at all.

39% of enterprises identify over-trust in AI-generated outputs as a leading anticipated risk.

86% of enterprises are using AI-generated code in production.

89% of enterprises are confident in their ability to secure AI-generated code.

Security teams' confidence in their ability to keep up with the security implications of AI adoption declined from 64% to 51%.

In 2025, the Lumma infostealer was responsible for 2.2 million dark web listings, roughly 42% of the total.

In 2025, the Qilin group was responsible for 12.8% of ransomware attacks.

In 2025, nation-state activity accounted for 56.6% of threat activity in the Middle East.