The share of actors classified as medium risk or higher increased from 33% in the first six-month period to 56% in the second six-month period, a roughly 1.7-fold increase.

66% of analyzed CVEs had minimal real-world applicability.

More than 15,200 new software vulnerabilities were disclosed in Q1 2026, including nearly 3,900 classified as high risk.

Around a third of businesses (30%) conducted a risk assessment covering cyber security, in line with last year (29%).

57% of organizations report moderate or high confidence in identity scoping for AI agents.

33.1% of organizations consider non-human identities to be a material risk

31% of internal audit functions provide fraud risk assessments to leadership.

Enterprises conducting six or more risk assessments per year report stronger overall risk discipline and telemetry scores.