In 2025, ransomware accounted for 36% of security incidents affecting financial institutions.

Third-party involvement occurs in 30% of financial-sector breaches.

In 2025, approximately 12.8% of B2B financial organizations experienced ransomware.

In 2025, data breaches accounted for 64% of security incidents affecting financial institutions.

Akira accounted for more than 40% of all ransomware claims in At-Bay’s portfolio for the full year.

86% of Akira attacks occurred in environments where a SonicWall device was present.

The largest single business interruption claim hit $5M, the policy limit.

Roughly one in 10 ransomware incidents caused downtime exceeding 30 days.

Financial fraud was the most common incident type for the third consecutive year, accounting for 30% of all claims.

The average amount stolen reached $285K, up 16% from the prior year and up significantly from $199K in 2023.

The single largest fraud loss in 2025 hit $9.7M.

IT services spending is forecast to surpass $1.87 trillion in 2026, growing 9.0% year-over-year.

Device spending is forecast to reach $856.19 billion in 2026, growing 8.2% year-over-year.

43% of UK IT decision makers report having some governance for agentic AI but with gaps.

89% of UK IT decision makers agree that public policy and regulation should mandate open source principles such as transparency and auditability to help organisations achieve AI sovereignty.

The regional average agreement across EMEA that public policy should mandate open source principles is 77%, with France at 70% and Germany at 72%.

GreyNoise sensors observe eight distinct surges targeting Cisco before the advisory for CVE-2026-20127, with the earliest surge occurring 39 days before disclosure.

SonicWall CVE-2026-0400 experienced six surges with lead times compressing from 37 days to 3 days and peak session volume reaching 69 times the median.

Fortinet CVE-2026-24858 provides one day of warning before disclosure.

More than 80% of fraud prevention, risk, and compliance professionals report that mule activity is detected reactively rather than prevented before suspicious transactions occur.