Nearly half of IT, security, and engineering professionals (49%) say their access infrastructure is not scalable.

Organisations relying solely on security awareness training (SAT) have visibility into only 12% of risky behaviour.

68% of companies still manage access controls manually.

Just 10% of employees are responsible for 73% of cyber risk. This also means that a small fraction of employees (specifically 10%) are responsible for 73% of risky behaviour.

Mature HRM programmes have 5 times the visibility into risky behaviour compared to organisations relying solely on SAT.

90% of IT, security, and engineering professionals report limitations with their current VPN setup, such as security risks, latency, or operational overhead.

75% of analysts indicate that AI tools are already improving their job satisfaction by reducing alert fatigue and automating repetitive triage tasks.

At companies heavily reliant on VPNs, employees were nearly twice as likely to report broken access or security workarounds compared to those using modern tools.

Nearly half of companies are actively trying to consolidate their toolsets

100% of security professionals—including both leaders and analysts—state that implementing AI in the Security Operations Centre (SOC) is their top business objective.

96% of leaders report they have no plans to reduce headcount as AI adoption accelerates.

99% of professionals want to redesign their secure access infrastructure.

83% of IT and engineering professionals admit to actively bypassing security controls to get their work done.

Just 29% of organisations use identity-based access as their primary model.

Cybersecurity Controls have been identified as one of the top three "hot" compliance topics for 2025, with 38% of investment adviser firms listing it as a leading priority.

Strategic Human Risk Management (HRM) programmes can reduce risk 60% faster than traditional methods.

46% of respondents at investment adviser firms reported increased compliance testing around AI—up from 32% last year, but 44% of firms that have adopted AI tools have no formal testing or validation of the outputs from their AI tools.

Only 10% of IT, security, and engineering professionals say their current VPN setup "works well" with no major issues.

Over the next 3–5 years, both leaders and analysts expect autonomous SOC operations to become the norm

Cybersecurity ranks as the #2 top area for increased testing, with 55% of CCOs at investment adviser firms reporting heightened focus in this domain.