44% of organizations test their security biannually or less, or not at all.

12% of CISOs report testing their endpoint protection detection capability within the last three months

55% of organizations are cutting or not increasing investment in red and purple teaming.

42% of organizations conduct code reviews and security testing.