Almost all UK respondents (98%) stated that cyber readiness and recovery will be a top spending priority.

In 2H-2024, 66 KEVs were attributed to the Chinese threat actor Flax Typhoon (AKA Ethereal Panda).

33% of organizations plan to respond to quantum risks when they are more immediate.

The average U.S. cost of a breach reached a record $10.22 million.

AI-generated code introduces security vulnerabilities in 45% of cases.

23% of Canadians are confident their identity has never been used to open an account.

When given a choice between a secure and insecure method to write code, GenAI models chose the insecure option 45% of the time.

In 1H-2025, 29 KEVs were attributed to Iranian threat actors.

The global average breach lifecycle (mean time to identify and contain a breach, including restoring services) dropped to 241 days, a 17-day reduction from the year prior.

Breaches across the healthcare sector take the longest to identify and contain at 279 days, which is more than 5 weeks longer than the global average of 241 days.

38% of organisations suffered a phishing attack that led to unauthorised access.

36% of organisations experienced a data breach involving identity credentials.

75% of UK business leaders who believe ransomware payments should be banned admit they would still pay a ransom if it were the only way to save their organisation, even if a ban was extended to the private sector and civil or criminal penalties applied.

Nearly one-third of organisations reported price increases of 15% or more due to a data breach.

31% of Canadians are now more likely to open a financial account online than they were a year ago.

9 in 10 UK organisations tested elements of their recovery capabilities in the last 12 months, which is a significant increase from previous years.

Just 17% of UK organisations paid the ransom following a ransomware attack.

In real-world situations within the private sector, if a ransom payment ban were to take hold, 15% of UK business leaders said they would be neither likely nor unlikely to comply with such a ban.

The countries with the largest number of active threat actor groups are: China: 20 groups, Russia: 11 groups, North Korea: 9 groups, and Iran: 6 groups.

24% of organizations are waiting to see what actions other companies take regarding quantum risks.