Every model produced at least one false-positive run by hallucinating vulnerable paths in the OpenNDS real-world task

66% of security practitioners spend more than half their time manually validating findings rather than resolving the underlying vulnerabilities.

69% of security practitioners at mid-sized organizations report growing difficulty keeping up with increased code volume.

53% of security practitioners spend time each week coordinating fixes.

46% of security practitioners spend time each week validating exploitability.

57% of security practitioners would require a full audit trail of actions taken to trust AI-based penetration testing.

The rate of effective automation between CTI and SecOps tools doubled from 13% in 2025 to 26% in 2026.

6% of campus IT teams describe themselves as adequately staffed to work proactively.

Activity from the Qilin ransomware group declined by 25% and activity from the Akira ransomware group declined by 22%.

90% of organizations say they can recover from a cyber incident within their recovery time objectives (RTOs).

69% of organizations say their recovery time objectives (RTOs) are fully aligned with business continuity goals.

Among organizations hit by ransomware where operations or data were affected, 44% recovered less than 75% of affected data.

Almost one-third of organizations report extensive AI use across most or all threat detection and incident response activities, up from 25% last year.

79% of General Counsels lack confidence that current board reporting strikes the right balance between clarity and overload.

Only 19% say their organization’s GRC systems are fully integrated, 65% say they are somewhat integrated, and 16% report no integration at all.

100% of surveyed cybersecurity practitioners report increased engineering delivery over the past twelve months.

Nearly 60% of security practitioners say they are able to keep up with the increased code volume for now, but it is getting harder.

78% of security practitioners rank exposure of secrets as the top challenge introduced or amplified by AI-assisted coding.

60% of security practitioners perform triaging of alerts as a top weekly activity.

35% of identity crime victims report losses exceeding $10,000.