30% of risk leaders claimed that third-party and nth-party risks are not having an impact or are only having a minimal impact on their business in 2024.

23% of companies globally have a policy against using foreign AI models such as Deepseek in 2025.

Only 10% of leaders expressed a lack of confidence in their risk management data in 2025, down from 16% in 2024, reflecting a six-point improvement in trust towards risk data.

72% of companies globally do not have a policy for the use of generative AI by partners and suppliers as of 2025.

66% of risk leaders stated they have reviewed and updated their IT and cyber risk management strategy in response to major disruptions such as the Crowdstrike outage or MOVEit breach

45% of risk leaders reported that they can only assess and monitor their tier 1 tech partners.

85% of risk leaders globally reported having a business continuity and resilience plan in place to maintain operations during a major IT outage or cyber incident at one of their business-critical service providers.

68% of risk leaders foresee data privacy and security issues as the biggest risks from deploying agentic AI.

Cyber risk incidents are reported as rising 22 percent in 2025.

Risk management ranks cyber attack or breach as the #1 current risk for global organizations.

The C-Suite ranks cyber attack or breach as the #1 current risk for global organizations.

HR ranks cyber attack or breach as the #3 current risk (after increasing competition and economic slowdown or slow recovery) for global organizations.

Finance ranks cyber attack or breach as the #2 current risk (after economic slowdown or slow recovery) for global organizations.

How cyber attack or breach ranked as current risk over the recent years: 2025 - #1, 2023 - #1, 2021 - #1, 2019 - #6, 2017 - #5, 2015 - #9.

AI ranks at #29 overall in current risks for global organizations.

Cyber attack or breach remains the top concern globally across current and future risks (no change from 2023) for global organizations.

More than three-quarters of bank CEOs, senior executives and directors named cybersecurity as a top risk for their institution.

69% of bank CEOs, senior executives and directors said fraud was a top risk for their institution.

The most common base terms used in breached passwords were “password”, “admin”, and “welcome”.

Mobile exploits accounted for 5.9% of the CISA KEV exploits.