48% of respondents cited a competitive edge as a key business driver for PQC readiness.

26.9% of KEVs first seen in 1H-2025 were still awaiting analysis by NIST.

Security incidents involving shadow AI led to more intellectual property (40%) being compromised compared to the global average (33%).

Organizations with dedicated mission-critical workflow teams report 10% fewer disruptions.

The C-suite (33%) and board members (22%) champion PQC preparedness

Breached emails increased by nearly 16% in Q2 2025.

The healthcare sector saw a $2.35 million reduction in costs compared to 2024.

A 62% rise in remote access attacks was noted in Q2 2025.

The top five categories for KEVs in 1H-2025 are: Content Management Systems (CMS): 86 KEVs, with a significant volume attributed to WordPress Plug-ins; Network Edge Devices: 77 KEVs; Server Software: 61 KEVs; Open Source Software: 55 KEVs; and Operating Systems: 38 KEVs.

Over 40% of personal loan, credit card, and card loan Canadian applicants expect to spend less than 30 minutes opening a checking account.

Vendors with Highest Number of KEVs in 1H-2025: Microsoft: 32 KEVs, with 26 of these being for Windows; Cisco: 10 KEVs; Apple OS: 6 KEVs; Totolink Networking Devices: 6 KEVs; and VMware: 6 KEVs.

49% of Canadians reported experiencing more frequent identity verification checks while logging into bank accounts.

60% of AI-related security incidents led to compromised data.

Organisations using AI and automation extensively throughout their security operations reduced the breach lifecycle by an average of 80 days.

Of the organisations that have AI governance policies in place, only 34% perform regular audits for unsanctioned AI.

Only 60% of organisations enforce multi-factor authentication (MFA) for all users.

The global average cost of a data breach fell to $4.44 million, marking the first decline in five years.

Only 39% of organizations are implementing risk mitigation strategies for their mission-critical collaboration tools

Among organisations that reported recovery following a data breach, most took more than 100 days on average to do so.

Reports of KEVs associated with China and North Korea decreased in 1H-2025, while reports associated with Russia and Iran increased.