87% of enterprise servers accept inbound RDP or SSH connections from broad internal sources, giving attackers wide access pathways once inside the network.

East–West internal traffic represents more than 70% of a company’s communications and remains unprotected.

80% of enterprise servers are reachable from anywhere inside the network, creating greenfield conditions for ransomware, operational disruption, and full-environment compromise.

24% of organizations can fully inspect AI traffic without impacting performance

49% of organizations expose risky ports and services.

9% of organizations expose SNMP on the public internet.

8% of organizations expose UPnP on the public internet.

When session volume and IP count spike simultaneously, lead time extends to 21 days.

52% of campus IT leaders cite cybersecurity and risk exposure as the top network challenge, surpassing network performance and reliability.

18% of higher education institutions are fully aligned with Zero Trust principles.

68% of IT leaders at higher education institutions want "built-in" security in their network architectures.

Distributed surges average 21.3 days of lead time before disclosure.

Concentrated hosting surges average 7.5 days of lead time before disclosure.

75% of network-layer DDoS attacks last less than one minute.

For network intrusions, unpatched vulnerabilities were the root cause 21% of the time.

Mexico, Brazil, and the United States accounted for 31%, 24%, and 20% of network-layer observed attack traffic, respectively.

For network intrusions, the root cause was not found 34% of the time.

Only 2% of network-layer DDoS attacks extend beyond ten minutes.

Network-layer attacks accounted for 82% of all observed DDoS incidents, a 20% increase from the previous report.

Nearly 60% of enterprises believe AI-driven networks require a fundamentally different security architecture than traditional networks.