More than 48,000 CVEs were published in 2025, an 18% increase year-over-year.

97% of organizations commit to implementing AI.

57% of organizations report a significant capacity gap in AI security and risk management.

Capability gaps exist across the AI stack: 57% report gaps in AI security and risk management, 57% in AI operations and monitoring, 54% in cost optimization, and 45% in AI infrastructure expertise.

57% of organizations are upskilling existing staff as the primary response to talent gaps, compared with 49% hiring new technical staff.

Upskilling outperforms hiring: it provides a 7.9x advantage in business context, a 7.7x advantage in staff retention, a 7.3x advantage in team cohesion, a 5x advantage in total cost, and a 3.5x advantage in quality of work.

Mobile application attack rates climbed 58% between 2022 and 2026, rising from 55% to 87%.

Automotive applications faced a 91% attack rate in 2026.

89% of employees say they feel safe reporting mistakes in organizations that prioritize cybersecurity as a culture.

19% of cybersecurity leaders report their organizations have an integrated and culture-embedded approach in place to manage human-related cybersecurity risk.

58% of cybersecurity leaders report that AI agents are already taking actions within organizational workflows.

52% of organizations report their use of AI is unapproved or ungoverned.

86% of employees say deepfake content is so realistic that it is harder to know what to trust.

64% of employees say it is possible that they could be tricked by AI-enabled attacks.

58% of cybersecurity leaders say mistakes during everyday work have had the greatest impact on their organization’s cybersecurity in the past 12 months.

42% of cybersecurity leaders identify AI-enabled attacks as a key driver of future human-related cybersecurity risks.

Over a third of employees commonly source their own agentic AI tools when options are unavailable or restrictive.

Operations runs just 18% of its AI activity on enterprise plans.

74.6% of all AI use at work has a clear business purpose.

Malicious npm packages surged 451% year-over-year.