Among organizations with confirmed AI-related security incidents, Shadow AI contributed to 44% of incidents, data or model poisoning 41%, improper output handling 41%, supply chain vulnerabilities 35%, and prompt injection 34%.

30% of security and IT leaders report alert fatigue causes initial detections to be deprioritized, delaying critical alerts.

Security teams require mid-to-high levels of manual intervention for detection, at 42%.

Security teams require mid-to-high levels of manual intervention for alert triage, at 43%.

Security teams require mid-to-high levels of manual intervention for investigation, at 49%.

SOC analysts spend just 44% of their time on proactive efforts like threat hunting and detection engineering.

30% of security and IT leaders report AI-generated alerts produce false positives that negatively impact investigation timelines.

40% of security and IT leaders identify AI-enhanced external attacks as security incidents tied to AI systems.

38% of security and IT leaders identify compromised AI identity and session theft as security incidents tied to AI systems.

36% of security and IT leaders identify third-party vendor or supply chain breaches involving integrated AI or agents as security incidents tied to AI systems.

Adversaries maintained access to enterprise networks for nearly 2.5 weeks on average before being detected in ransomware incidents.

49% of organizations did not detect the threat until after data is stolen, up from 31% the previous year.

14% of organizations were unaware of an attack until they receive a ransom demand, compared to 6% the previous year.

34% of security and IT leaders report adversaries use valid, high-privilege account permissions, delaying critical alerts.

55% of security and IT leaders cite AI agents, agentic infrastructure, and Gen AI applications as the biggest cybersecurity risk to their organization.

In the first 63 days of the Anthropic Claude Mythos Preview, Mythos disclosed 1,596 verified vulnerabilities across 281 open-source projects.

95% of Anthropic Mythos disclosures have no public advisory and are not visible through CVE, NVD, GitHub advisory, or scanner-driven workflows.

AI-driven discovery outpaces visible Mythos-attributed remediation by roughly 16.5x, with about 25.3 disclosures per day versus about 1.5 patches per day.

Only 6.1% of Mythos disclosures are marked as patched, despite 90.9% maintainer acknowledgment.

73% of organizations say overall code quality has improved with AI coding tools.