There was an average of three API-related breaches per month in 2024, with some months seeing as many as five to seven.

Keyboard walks such as ‘qwerty’ are weak passwords used by millions of end users.

Simple passwords like Pass@123 and P@ssw0rd, which meet basic Active Directory requirements, are frequently used, increasing the risk of password reuse.

Kernel exploits accounted for 5.4% of the CISA KEV exploits.

Mobile exploits accounted for 5.9% of the CISA KEV exploits.

The most common base terms used in breached passwords were “password”, “admin”, and “welcome”.

53% of people admit to using the same password across multiple accounts.

AI vulnerabilities increased by 1,025% from 2023 to 2024.

Attackers can exfiltrate sensitive data in as little as 6 seconds in API attacks.

Browser exploits accounted for 9.2% of the CISA KEV exploits.

After analysing 1.8 million breached administrator credentials, 40,000 admin portal accounts were found to be using ‘admin’ as a password.

Supply chain exploits accounted for 1.1% of the CISA KEV exploits.

Requiring an Active Directory password length of at least 13 characters would significantly reduce the risk of cloud application password reuse.