Only 20% of financial services organizations have yet to implement third-party risk oversight (a DORA requirement).

HR-related themes were cited in 42.5% of phishing failures.

Code and development artifacts made up 32.8% of sensitive data exposed through employee use of Chinese GenAI tools at work.

71.9% of interactions with malicious landing pages involved branded content.

Stolen identity "fullz" (comprehensive personal information) can be bought for as little as $3 on the dark web.

Financial information accounted for 14.4% of sensitive data exposed through employee use of Chinese GenAI tools at work.

Customer data represented 12.0% of sensitive data exposed through employee use of Chinese GenAI tools at work.

Legal documents made up 4.9% of sensitive data exposed through employee use of Chinese GenAI tools at work.

42% of IT and security decision-makers fail to involve IT/security teams in vendor presentations.

On average, IT and security decision-makers report having approximately 80 printers that are redundant or are in the process of being decommissioned within their organizations.

20% of financial services organizations have yet to secure the necessary budget to meet DORA requirements.

80.6% of the top 20 clicked links originated from internally-themed simulations.

PDF attachment clicks in phishing simulations increased by 8.1% compared to Q1 2025.

Among internally-themed links, 68.2% utilised domain spoofing techniques.

Only 32% of IT and security decision-makers can detect security events linked to hardware-level attacks.

Developer teams remediate, on average, 6 application vulnerabilities per month.

Half (50%) of the respondents said DORA requirements have been integrated into their broader resilience programs.

Over a third (more than 33.3%) of financial services organizations named third-party oversight the most challenging DORA requirement to implement.

22% of financial services organizations felt that DORA’s design could have been improved to aid compliance

The average application is targeted by attackers once every 3 minutes.